From bdaf449ee1979b8401340fda1b26aab11215123d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 6 Jan 2025 00:32:05 +0000 Subject: [PATCH] Publish Advisories GHSA-8464-8v52-xm79 GHSA-f6c3-7j6r-gqx3 GHSA-j4jc-69x3-7rr6 GHSA-pwgw-g9f5-ghw2 GHSA-q7wx-v3rg-fjvx GHSA-xwpp-qxq5-q73h --- .../GHSA-8464-8v52-xm79.json | 56 +++++++++++++++++++ .../GHSA-f6c3-7j6r-gqx3.json | 52 +++++++++++++++++ .../GHSA-j4jc-69x3-7rr6.json | 52 +++++++++++++++++ .../GHSA-pwgw-g9f5-ghw2.json | 52 +++++++++++++++++ .../GHSA-q7wx-v3rg-fjvx.json | 52 +++++++++++++++++ .../GHSA-xwpp-qxq5-q73h.json | 52 +++++++++++++++++ 6 files changed, 316 insertions(+) create mode 100644 advisories/unreviewed/2025/01/GHSA-8464-8v52-xm79/GHSA-8464-8v52-xm79.json create mode 100644 advisories/unreviewed/2025/01/GHSA-f6c3-7j6r-gqx3/GHSA-f6c3-7j6r-gqx3.json create mode 100644 advisories/unreviewed/2025/01/GHSA-j4jc-69x3-7rr6/GHSA-j4jc-69x3-7rr6.json create mode 100644 advisories/unreviewed/2025/01/GHSA-pwgw-g9f5-ghw2/GHSA-pwgw-g9f5-ghw2.json create mode 100644 advisories/unreviewed/2025/01/GHSA-q7wx-v3rg-fjvx/GHSA-q7wx-v3rg-fjvx.json create mode 100644 advisories/unreviewed/2025/01/GHSA-xwpp-qxq5-q73h/GHSA-xwpp-qxq5-q73h.json diff --git a/advisories/unreviewed/2025/01/GHSA-8464-8v52-xm79/GHSA-8464-8v52-xm79.json b/advisories/unreviewed/2025/01/GHSA-8464-8v52-xm79/GHSA-8464-8v52-xm79.json new file mode 100644 index 00000000000..dc1f3249e01 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-8464-8v52-xm79/GHSA-8464-8v52-xm79.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8464-8v52-xm79", + "modified": "2025-01-06T00:30:41Z", + "published": "2025-01-06T00:30:41Z", + "aliases": [ + "CVE-2024-13144" + ], + "details": "A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13144" + }, + { + "type": "WEB", + "url": "https://github.com/ZHENFENG13/My-Blog/issues/140" + }, + { + "type": "WEB", + "url": "https://github.com/ZHENFENG13/My-Blog/issues/140#issue-2759813820" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290232" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290232" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.469220" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-06T00:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-f6c3-7j6r-gqx3/GHSA-f6c3-7j6r-gqx3.json b/advisories/unreviewed/2025/01/GHSA-f6c3-7j6r-gqx3/GHSA-f6c3-7j6r-gqx3.json new file mode 100644 index 00000000000..3f62606aeee --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-f6c3-7j6r-gqx3/GHSA-f6c3-7j6r-gqx3.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f6c3-7j6r-gqx3", + "modified": "2025-01-06T00:30:41Z", + "published": "2025-01-06T00:30:41Z", + "aliases": [ + "CVE-2025-0232" + ], + "details": "A vulnerability was found in Codezips Blood Bank Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /successadmin.php. The manipulation of the argument psw leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0232" + }, + { + "type": "WEB", + "url": "https://github.com/alc9700jmo/CVE/issues/7" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290228" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290228" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.474597" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-05T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-j4jc-69x3-7rr6/GHSA-j4jc-69x3-7rr6.json b/advisories/unreviewed/2025/01/GHSA-j4jc-69x3-7rr6/GHSA-j4jc-69x3-7rr6.json new file mode 100644 index 00000000000..8137292a842 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-j4jc-69x3-7rr6/GHSA-j4jc-69x3-7rr6.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j4jc-69x3-7rr6", + "modified": "2025-01-06T00:30:41Z", + "published": "2025-01-06T00:30:41Z", + "aliases": [ + "CVE-2024-13143" + ], + "details": "A vulnerability was found in ZeroWdd studentmanager 1.0. It has been rated as problematic. This issue affects the function submitAddPermission of the file src/main/java/com/zero/system/controller/PermissionController. java. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13143" + }, + { + "type": "WEB", + "url": "https://github.com/ZeroWdd/manager-system/issues/7" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290231" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290231" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.469217" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-06T00:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-pwgw-g9f5-ghw2/GHSA-pwgw-g9f5-ghw2.json b/advisories/unreviewed/2025/01/GHSA-pwgw-g9f5-ghw2/GHSA-pwgw-g9f5-ghw2.json new file mode 100644 index 00000000000..982994fae57 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-pwgw-g9f5-ghw2/GHSA-pwgw-g9f5-ghw2.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pwgw-g9f5-ghw2", + "modified": "2025-01-06T00:30:41Z", + "published": "2025-01-06T00:30:41Z", + "aliases": [ + "CVE-2025-0233" + ], + "details": "A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/course.php. The manipulation of the argument course_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0233" + }, + { + "type": "WEB", + "url": "https://github.com/1074923869/CVE/issues/1" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290229" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290229" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.474673" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-05T23:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-q7wx-v3rg-fjvx/GHSA-q7wx-v3rg-fjvx.json b/advisories/unreviewed/2025/01/GHSA-q7wx-v3rg-fjvx/GHSA-q7wx-v3rg-fjvx.json new file mode 100644 index 00000000000..095e73a4c52 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-q7wx-v3rg-fjvx/GHSA-q7wx-v3rg-fjvx.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7wx-v3rg-fjvx", + "modified": "2025-01-06T00:30:41Z", + "published": "2025-01-06T00:30:41Z", + "aliases": [ + "CVE-2024-13142" + ], + "details": "A vulnerability was found in ZeroWdd studentmanager 1.0. It has been declared as problematic. This vulnerability affects the function submitAddRole of the file src/main/java/com/zero/system/controller/RoleController. java. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13142" + }, + { + "type": "WEB", + "url": "https://github.com/ZeroWdd/manager-system/issues/6" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290230" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290230" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.469213" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-05T23:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-xwpp-qxq5-q73h/GHSA-xwpp-qxq5-q73h.json b/advisories/unreviewed/2025/01/GHSA-xwpp-qxq5-q73h/GHSA-xwpp-qxq5-q73h.json new file mode 100644 index 00000000000..9a67872b27c --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-xwpp-qxq5-q73h/GHSA-xwpp-qxq5-q73h.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xwpp-qxq5-q73h", + "modified": "2025-01-06T00:30:41Z", + "published": "2025-01-06T00:30:41Z", + "aliases": [ + "CVE-2025-0231" + ], + "details": "A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/submit_payments.php. The manipulation of the argument m_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0231" + }, + { + "type": "WEB", + "url": "https://github.com/gh464646/CVE/issues/1" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290227" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290227" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.474596" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-05T22:15:05Z" + } +} \ No newline at end of file