From cd4ddafc7e3f62ad20050e6176414aeaf8d2b453 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sat, 24 May 2025 03:31:55 +0000 Subject: [PATCH] Publish Advisories GHSA-mcv5-jrjw-4vgm GHSA-ccg8-phgc-f279 GHSA-xcgh-pcrh-mfp2 GHSA-2cr5-mf95-c6r3 GHSA-3h5m-h2xr-8j2p GHSA-4pfj-xhf6-v58f GHSA-4x5x-v34x-mqxm GHSA-5r4r-9fgh-pw53 GHSA-6v24-6wgf-8vj6 GHSA-7f4f-7v48-7gv6 GHSA-7q9j-33vm-8375 GHSA-9wh7-3gp5-48qg GHSA-cm3g-qm4h-xm6m GHSA-fx39-f7f6-8prj GHSA-j68f-x23w-cvmr GHSA-mqwx-r894-9hfp GHSA-rj37-wp7c-8779 GHSA-v373-prqc-2h4q --- .../GHSA-mcv5-jrjw-4vgm.json | 4 +- .../GHSA-ccg8-phgc-f279.json | 2 +- .../GHSA-xcgh-pcrh-mfp2.json | 2 +- .../GHSA-2cr5-mf95-c6r3.json | 40 +++++++++++++++++ .../GHSA-3h5m-h2xr-8j2p.json | 44 +++++++++++++++++++ .../GHSA-4pfj-xhf6-v58f.json | 40 +++++++++++++++++ .../GHSA-4x5x-v34x-mqxm.json | 40 +++++++++++++++++ .../GHSA-5r4r-9fgh-pw53.json | 40 +++++++++++++++++ .../GHSA-6v24-6wgf-8vj6.json | 40 +++++++++++++++++ .../GHSA-7f4f-7v48-7gv6.json | 3 +- .../GHSA-7q9j-33vm-8375.json | 6 ++- .../GHSA-9wh7-3gp5-48qg.json | 3 +- .../GHSA-cm3g-qm4h-xm6m.json | 40 +++++++++++++++++ .../GHSA-fx39-f7f6-8prj.json | 3 +- .../GHSA-j68f-x23w-cvmr.json | 3 +- .../GHSA-mqwx-r894-9hfp.json | 40 +++++++++++++++++ .../GHSA-rj37-wp7c-8779.json | 40 +++++++++++++++++ .../GHSA-v373-prqc-2h4q.json | 3 +- 18 files changed, 384 insertions(+), 9 deletions(-) create mode 100644 advisories/unreviewed/2025/05/GHSA-2cr5-mf95-c6r3/GHSA-2cr5-mf95-c6r3.json create mode 100644 advisories/unreviewed/2025/05/GHSA-3h5m-h2xr-8j2p/GHSA-3h5m-h2xr-8j2p.json create mode 100644 advisories/unreviewed/2025/05/GHSA-4pfj-xhf6-v58f/GHSA-4pfj-xhf6-v58f.json create mode 100644 advisories/unreviewed/2025/05/GHSA-4x5x-v34x-mqxm/GHSA-4x5x-v34x-mqxm.json create mode 100644 advisories/unreviewed/2025/05/GHSA-5r4r-9fgh-pw53/GHSA-5r4r-9fgh-pw53.json create mode 100644 advisories/unreviewed/2025/05/GHSA-6v24-6wgf-8vj6/GHSA-6v24-6wgf-8vj6.json create mode 100644 advisories/unreviewed/2025/05/GHSA-cm3g-qm4h-xm6m/GHSA-cm3g-qm4h-xm6m.json create mode 100644 advisories/unreviewed/2025/05/GHSA-mqwx-r894-9hfp/GHSA-mqwx-r894-9hfp.json create mode 100644 advisories/unreviewed/2025/05/GHSA-rj37-wp7c-8779/GHSA-rj37-wp7c-8779.json diff --git a/advisories/unreviewed/2025/01/GHSA-mcv5-jrjw-4vgm/GHSA-mcv5-jrjw-4vgm.json b/advisories/unreviewed/2025/01/GHSA-mcv5-jrjw-4vgm/GHSA-mcv5-jrjw-4vgm.json index 1331363dcc5..35c7543b184 100644 --- a/advisories/unreviewed/2025/01/GHSA-mcv5-jrjw-4vgm/GHSA-mcv5-jrjw-4vgm.json +++ b/advisories/unreviewed/2025/01/GHSA-mcv5-jrjw-4vgm/GHSA-mcv5-jrjw-4vgm.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/02/GHSA-ccg8-phgc-f279/GHSA-ccg8-phgc-f279.json b/advisories/unreviewed/2025/02/GHSA-ccg8-phgc-f279/GHSA-ccg8-phgc-f279.json index 845379fb44f..b7a66b3a262 100644 --- a/advisories/unreviewed/2025/02/GHSA-ccg8-phgc-f279/GHSA-ccg8-phgc-f279.json +++ b/advisories/unreviewed/2025/02/GHSA-ccg8-phgc-f279/GHSA-ccg8-phgc-f279.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-ccg8-phgc-f279", - "modified": "2025-02-19T09:33:28Z", + "modified": "2025-05-24T03:30:18Z", "published": "2025-02-19T09:33:28Z", "aliases": [ "CVE-2024-13592" diff --git a/advisories/unreviewed/2025/02/GHSA-xcgh-pcrh-mfp2/GHSA-xcgh-pcrh-mfp2.json b/advisories/unreviewed/2025/02/GHSA-xcgh-pcrh-mfp2/GHSA-xcgh-pcrh-mfp2.json index ab590f5ee2e..47b8d6f6c96 100644 --- a/advisories/unreviewed/2025/02/GHSA-xcgh-pcrh-mfp2/GHSA-xcgh-pcrh-mfp2.json +++ b/advisories/unreviewed/2025/02/GHSA-xcgh-pcrh-mfp2/GHSA-xcgh-pcrh-mfp2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xcgh-pcrh-mfp2", - "modified": "2025-02-27T15:31:51Z", + "modified": "2025-05-24T03:30:18Z", "published": "2025-02-27T15:31:51Z", "aliases": [ "CVE-2024-13402" diff --git a/advisories/unreviewed/2025/05/GHSA-2cr5-mf95-c6r3/GHSA-2cr5-mf95-c6r3.json b/advisories/unreviewed/2025/05/GHSA-2cr5-mf95-c6r3/GHSA-2cr5-mf95-c6r3.json new file mode 100644 index 00000000000..a106f158114 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-2cr5-mf95-c6r3/GHSA-2cr5-mf95-c6r3.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2cr5-mf95-c6r3", + "modified": "2025-05-24T03:30:19Z", + "published": "2025-05-24T03:30:19Z", + "aliases": [ + "CVE-2024-13427" + ], + "details": "The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 1.9.9 and completely fixed in version 2.0.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13427" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3298138/pagelayer" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5df2f3cc-affc-4549-b59e-d145cce10c79?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-24T03:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-3h5m-h2xr-8j2p/GHSA-3h5m-h2xr-8j2p.json b/advisories/unreviewed/2025/05/GHSA-3h5m-h2xr-8j2p/GHSA-3h5m-h2xr-8j2p.json new file mode 100644 index 00000000000..c9782127013 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-3h5m-h2xr-8j2p/GHSA-3h5m-h2xr-8j2p.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3h5m-h2xr-8j2p", + "modified": "2025-05-24T03:30:19Z", + "published": "2025-05-24T03:30:19Z", + "aliases": [ + "CVE-2025-3869" + ], + "details": "The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the stats/stats.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3869" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/4stats/tags/2.0.9/4stats.php" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/4stats" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/453b246f-7e39-4adb-9506-77d96146ab50?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-24T03:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-4pfj-xhf6-v58f/GHSA-4pfj-xhf6-v58f.json b/advisories/unreviewed/2025/05/GHSA-4pfj-xhf6-v58f/GHSA-4pfj-xhf6-v58f.json new file mode 100644 index 00000000000..17981b93ee8 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-4pfj-xhf6-v58f/GHSA-4pfj-xhf6-v58f.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4pfj-xhf6-v58f", + "modified": "2025-05-24T03:30:19Z", + "published": "2025-05-24T03:30:19Z", + "aliases": [ + "CVE-2025-48755" + ], + "details": "In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48755" + }, + { + "type": "WEB", + "url": "https://github.com/blyssprivacy/sdk/issues/36" + }, + { + "type": "WEB", + "url": "https://crates.io/crates/spiral-rs" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-762" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-24T03:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-4x5x-v34x-mqxm/GHSA-4x5x-v34x-mqxm.json b/advisories/unreviewed/2025/05/GHSA-4x5x-v34x-mqxm/GHSA-4x5x-v34x-mqxm.json new file mode 100644 index 00000000000..3ae64af1005 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-4x5x-v34x-mqxm/GHSA-4x5x-v34x-mqxm.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4x5x-v34x-mqxm", + "modified": "2025-05-24T03:30:19Z", + "published": "2025-05-24T03:30:19Z", + "aliases": [ + "CVE-2025-48753" + ], + "details": "In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48753" + }, + { + "type": "WEB", + "url": "https://github.com/obsidiandynamics/anode/issues/1" + }, + { + "type": "WEB", + "url": "https://crates.io/crates/anode" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-362" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-24T03:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-5r4r-9fgh-pw53/GHSA-5r4r-9fgh-pw53.json b/advisories/unreviewed/2025/05/GHSA-5r4r-9fgh-pw53/GHSA-5r4r-9fgh-pw53.json new file mode 100644 index 00000000000..05dc14b0452 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-5r4r-9fgh-pw53/GHSA-5r4r-9fgh-pw53.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5r4r-9fgh-pw53", + "modified": "2025-05-24T03:30:19Z", + "published": "2025-05-24T03:30:19Z", + "aliases": [ + "CVE-2025-48754" + ], + "details": "In the memory_pages crate 0.1.0 for Rust, division by zero can occur.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48754" + }, + { + "type": "WEB", + "url": "https://github.com/FractalFir/memory_pages/issues/1" + }, + { + "type": "WEB", + "url": "https://crates.io/crates/memory_pages" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-369" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-24T03:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-6v24-6wgf-8vj6/GHSA-6v24-6wgf-8vj6.json b/advisories/unreviewed/2025/05/GHSA-6v24-6wgf-8vj6/GHSA-6v24-6wgf-8vj6.json new file mode 100644 index 00000000000..e0498cd156e --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-6v24-6wgf-8vj6/GHSA-6v24-6wgf-8vj6.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6v24-6wgf-8vj6", + "modified": "2025-05-24T03:30:19Z", + "published": "2025-05-24T03:30:19Z", + "aliases": [ + "CVE-2025-48751" + ], + "details": "The process_lock crate 0.1.0 for Rust allows data races in unlock.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48751" + }, + { + "type": "WEB", + "url": "https://github.com/tickbh/ProcessLock/issues/1" + }, + { + "type": "WEB", + "url": "https://crates.io/crates/process_lock" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-362" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-24T03:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-7f4f-7v48-7gv6/GHSA-7f4f-7v48-7gv6.json b/advisories/unreviewed/2025/05/GHSA-7f4f-7v48-7gv6/GHSA-7f4f-7v48-7gv6.json index 56ca33f552a..82dc64206c4 100644 --- a/advisories/unreviewed/2025/05/GHSA-7f4f-7v48-7gv6/GHSA-7f4f-7v48-7gv6.json +++ b/advisories/unreviewed/2025/05/GHSA-7f4f-7v48-7gv6/GHSA-7f4f-7v48-7gv6.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-77" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/05/GHSA-7q9j-33vm-8375/GHSA-7q9j-33vm-8375.json b/advisories/unreviewed/2025/05/GHSA-7q9j-33vm-8375/GHSA-7q9j-33vm-8375.json index 8577dcf11fb..620d9de2934 100644 --- a/advisories/unreviewed/2025/05/GHSA-7q9j-33vm-8375/GHSA-7q9j-33vm-8375.json +++ b/advisories/unreviewed/2025/05/GHSA-7q9j-33vm-8375/GHSA-7q9j-33vm-8375.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7q9j-33vm-8375", - "modified": "2025-05-23T06:30:30Z", + "modified": "2025-05-24T03:30:19Z", "published": "2025-05-23T06:30:30Z", "aliases": [ "CVE-2025-48708" @@ -26,6 +26,10 @@ { "type": "WEB", "url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=b587663c623b4462f9e78686a31fd880207303ee" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/05/23/2" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-9wh7-3gp5-48qg/GHSA-9wh7-3gp5-48qg.json b/advisories/unreviewed/2025/05/GHSA-9wh7-3gp5-48qg/GHSA-9wh7-3gp5-48qg.json index 6501801bc7e..5236f10c472 100644 --- a/advisories/unreviewed/2025/05/GHSA-9wh7-3gp5-48qg/GHSA-9wh7-3gp5-48qg.json +++ b/advisories/unreviewed/2025/05/GHSA-9wh7-3gp5-48qg/GHSA-9wh7-3gp5-48qg.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-119" + "CWE-119", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/05/GHSA-cm3g-qm4h-xm6m/GHSA-cm3g-qm4h-xm6m.json b/advisories/unreviewed/2025/05/GHSA-cm3g-qm4h-xm6m/GHSA-cm3g-qm4h-xm6m.json new file mode 100644 index 00000000000..c9d7067257f --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-cm3g-qm4h-xm6m/GHSA-cm3g-qm4h-xm6m.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cm3g-qm4h-xm6m", + "modified": "2025-05-24T03:30:19Z", + "published": "2025-05-24T03:30:19Z", + "aliases": [ + "CVE-2025-48756" + ], + "details": "In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g., 5 bits) for group number.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48756" + }, + { + "type": "WEB", + "url": "https://github.com/maboroshinokiseki/scsir/issues/4" + }, + { + "type": "WEB", + "url": "https://crates.io/crates/scsir" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-843" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-24T03:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-fx39-f7f6-8prj/GHSA-fx39-f7f6-8prj.json b/advisories/unreviewed/2025/05/GHSA-fx39-f7f6-8prj/GHSA-fx39-f7f6-8prj.json index 066a407e8d2..b33d59e52c0 100644 --- a/advisories/unreviewed/2025/05/GHSA-fx39-f7f6-8prj/GHSA-fx39-f7f6-8prj.json +++ b/advisories/unreviewed/2025/05/GHSA-fx39-f7f6-8prj/GHSA-fx39-f7f6-8prj.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-119" + "CWE-119", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/05/GHSA-j68f-x23w-cvmr/GHSA-j68f-x23w-cvmr.json b/advisories/unreviewed/2025/05/GHSA-j68f-x23w-cvmr/GHSA-j68f-x23w-cvmr.json index d9fd26b7773..4acf527d83a 100644 --- a/advisories/unreviewed/2025/05/GHSA-j68f-x23w-cvmr/GHSA-j68f-x23w-cvmr.json +++ b/advisories/unreviewed/2025/05/GHSA-j68f-x23w-cvmr/GHSA-j68f-x23w-cvmr.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-77" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/05/GHSA-mqwx-r894-9hfp/GHSA-mqwx-r894-9hfp.json b/advisories/unreviewed/2025/05/GHSA-mqwx-r894-9hfp/GHSA-mqwx-r894-9hfp.json new file mode 100644 index 00000000000..8696dee9363 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-mqwx-r894-9hfp/GHSA-mqwx-r894-9hfp.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mqwx-r894-9hfp", + "modified": "2025-05-24T03:30:19Z", + "published": "2025-05-24T03:30:19Z", + "aliases": [ + "CVE-2025-48752" + ], + "details": "In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48752" + }, + { + "type": "WEB", + "url": "https://github.com/Forestryks/process-sync-rs/issues/3" + }, + { + "type": "WEB", + "url": "https://crates.io/crates/process-sync" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-24T03:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-rj37-wp7c-8779/GHSA-rj37-wp7c-8779.json b/advisories/unreviewed/2025/05/GHSA-rj37-wp7c-8779/GHSA-rj37-wp7c-8779.json new file mode 100644 index 00000000000..cbce2e590c1 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-rj37-wp7c-8779/GHSA-rj37-wp7c-8779.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rj37-wp7c-8779", + "modified": "2025-05-24T03:30:19Z", + "published": "2025-05-24T03:30:19Z", + "aliases": [ + "CVE-2025-5055" + ], + "details": "The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5055" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/smart-forms" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7f52cbb4-8fe3-4402-8ece-261d32329a42?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-24T03:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-v373-prqc-2h4q/GHSA-v373-prqc-2h4q.json b/advisories/unreviewed/2025/05/GHSA-v373-prqc-2h4q/GHSA-v373-prqc-2h4q.json index 5c365104cf2..3345534842c 100644 --- a/advisories/unreviewed/2025/05/GHSA-v373-prqc-2h4q/GHSA-v373-prqc-2h4q.json +++ b/advisories/unreviewed/2025/05/GHSA-v373-prqc-2h4q/GHSA-v373-prqc-2h4q.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-77" ], "severity": "MODERATE", "github_reviewed": false,