From c1a1373c8920a9d2430f8c79322736c6fa20ff4e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sat, 3 May 2025 21:31:58 +0000 Subject: [PATCH] Publish Advisories GHSA-6jx6-mrpj-vr27 GHSA-f54f-hr32-586f GHSA-hgm9-29r5-x94q GHSA-mr9x-8334-2fgf GHSA-w4rj-x734-wm94 --- .../GHSA-6jx6-mrpj-vr27.json | 56 +++++++++++++++++++ .../GHSA-f54f-hr32-586f.json | 44 +++++++++++++++ .../GHSA-hgm9-29r5-x94q.json | 56 +++++++++++++++++++ .../GHSA-mr9x-8334-2fgf.json | 56 +++++++++++++++++++ .../GHSA-w4rj-x734-wm94.json | 36 ++++++++++++ 5 files changed, 248 insertions(+) create mode 100644 advisories/unreviewed/2025/05/GHSA-6jx6-mrpj-vr27/GHSA-6jx6-mrpj-vr27.json create mode 100644 advisories/unreviewed/2025/05/GHSA-f54f-hr32-586f/GHSA-f54f-hr32-586f.json create mode 100644 advisories/unreviewed/2025/05/GHSA-hgm9-29r5-x94q/GHSA-hgm9-29r5-x94q.json create mode 100644 advisories/unreviewed/2025/05/GHSA-mr9x-8334-2fgf/GHSA-mr9x-8334-2fgf.json create mode 100644 advisories/unreviewed/2025/05/GHSA-w4rj-x734-wm94/GHSA-w4rj-x734-wm94.json diff --git a/advisories/unreviewed/2025/05/GHSA-6jx6-mrpj-vr27/GHSA-6jx6-mrpj-vr27.json b/advisories/unreviewed/2025/05/GHSA-6jx6-mrpj-vr27/GHSA-6jx6-mrpj-vr27.json new file mode 100644 index 00000000000..0a9699873fe --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-6jx6-mrpj-vr27/GHSA-6jx6-mrpj-vr27.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6jx6-mrpj-vr27", + "modified": "2025-05-03T21:30:23Z", + "published": "2025-05-03T21:30:23Z", + "aliases": [ + "CVE-2025-4244" + ], + "details": "A vulnerability, which was classified as critical, was found in code-projects Online Bus Reservation System 1.0. This affects an unknown part of the file /seatlocation.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4244" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/zzZxby/Vulnerability-Exploration/blob/main/Online%20Bus%20Reservation%20System/Online%20Bus%20Reservation%20System2.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.307335" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.307335" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.562691" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-03T20:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-f54f-hr32-586f/GHSA-f54f-hr32-586f.json b/advisories/unreviewed/2025/05/GHSA-f54f-hr32-586f/GHSA-f54f-hr32-586f.json new file mode 100644 index 00000000000..c30c7319437 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-f54f-hr32-586f/GHSA-f54f-hr32-586f.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f54f-hr32-586f", + "modified": "2025-05-03T21:30:23Z", + "published": "2025-05-03T21:30:23Z", + "aliases": [ + "CVE-2025-47241" + ], + "details": "In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "WEB", + "url": "https://github.com/browser-use/browser-use/security/advisories/GHSA-x39x-9qw5-ghrf" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47241" + }, + { + "type": "WEB", + "url": "https://github.com/browser-use/browser-use/pull/1561" + }, + { + "type": "WEB", + "url": "https://github.com/browser-use/browser-use/releases/tag/0.1.45" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-647" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-03T21:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-hgm9-29r5-x94q/GHSA-hgm9-29r5-x94q.json b/advisories/unreviewed/2025/05/GHSA-hgm9-29r5-x94q/GHSA-hgm9-29r5-x94q.json new file mode 100644 index 00000000000..6942a406bef --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-hgm9-29r5-x94q/GHSA-hgm9-29r5-x94q.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hgm9-29r5-x94q", + "modified": "2025-05-03T21:30:23Z", + "published": "2025-05-03T21:30:23Z", + "aliases": [ + "CVE-2025-4242" + ], + "details": "A vulnerability classified as critical was found in PHPGurukul Online Birth Certificate System 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/between-dates-report.php. The manipulation of the argument fromdate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4242" + }, + { + "type": "WEB", + "url": "https://github.com/bluechips-zhao/myCVE/issues/8" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.307333" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.307333" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.562624" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-03T19:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-mr9x-8334-2fgf/GHSA-mr9x-8334-2fgf.json b/advisories/unreviewed/2025/05/GHSA-mr9x-8334-2fgf/GHSA-mr9x-8334-2fgf.json new file mode 100644 index 00000000000..f949b1a60ae --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-mr9x-8334-2fgf/GHSA-mr9x-8334-2fgf.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mr9x-8334-2fgf", + "modified": "2025-05-03T21:30:23Z", + "published": "2025-05-03T21:30:23Z", + "aliases": [ + "CVE-2025-4243" + ], + "details": "A vulnerability, which was classified as critical, has been found in code-projects Online Bus Reservation System 1.0. Affected by this issue is some unknown functionality of the file /print.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4243" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/zzZxby/Vulnerability-Exploration/blob/main/Online%20Bus%20Reservation%20System/Online%20Bus%20Reservation%20System1.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.307334" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.307334" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.562690" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-03T19:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-w4rj-x734-wm94/GHSA-w4rj-x734-wm94.json b/advisories/unreviewed/2025/05/GHSA-w4rj-x734-wm94/GHSA-w4rj-x734-wm94.json new file mode 100644 index 00000000000..f3cfd950725 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-w4rj-x734-wm94/GHSA-w4rj-x734-wm94.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w4rj-x734-wm94", + "modified": "2025-05-03T21:30:23Z", + "published": "2025-05-03T21:30:23Z", + "aliases": [ + "CVE-2025-1838" + ], + "details": "IBM Cloud Pak for Business Automation\n\n 24.0.0 and 24.0.1 through 24.0.1 IF001 \n\nAuthoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1838" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7232429" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-602" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-03T19:15:48Z" + } +} \ No newline at end of file