From d914053167a08cd6952060984c4ce21a54b72aab Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 20 Mar 2025 18:32:04 +0000 Subject: [PATCH] Publish Advisories GHSA-2r4x-667f-mpfh GHSA-95gx-prcc-xj69 GHSA-52mp-7hrc-jmxc GHSA-pqj9-qcr7-74fh GHSA-3936-2wwp-m9f7 GHSA-74rc-h3mh-g8wh GHSA-9fcc-m4p7-2rp9 GHSA-9fcg-wrp8-qhr4 GHSA-gxxp-q6ph-495x GHSA-hgp6-2x4p-6v2c GHSA-j48m-433v-3q7r GHSA-jjx5-r5w6-73ph GHSA-m6rg-ch98-wgfm GHSA-mqwp-h2ff-5c74 GHSA-pgpf-3pvh-h5g7 GHSA-r56h-j38w-hrqq GHSA-rc85-x3gg-f85v GHSA-v222-4cxf-9gp4 GHSA-v6jq-9h5f-2qcm GHSA-vr2c-m23r-wq27 GHSA-wp93-prx6-vqjm GHSA-xpgm-5xx8-gwpg --- .../GHSA-2r4x-667f-mpfh.json | 12 +++- .../GHSA-95gx-prcc-xj69.json | 2 +- .../GHSA-52mp-7hrc-jmxc.json | 2 +- .../GHSA-pqj9-qcr7-74fh.json | 1 + .../GHSA-3936-2wwp-m9f7.json | 60 +++++++++++++++++++ .../GHSA-74rc-h3mh-g8wh.json | 40 +++++++++++++ .../GHSA-9fcc-m4p7-2rp9.json | 60 +++++++++++++++++++ .../GHSA-9fcg-wrp8-qhr4.json | 36 +++++++++++ .../GHSA-gxxp-q6ph-495x.json | 44 ++++++++++++++ .../GHSA-hgp6-2x4p-6v2c.json | 60 +++++++++++++++++++ .../GHSA-j48m-433v-3q7r.json | 33 ++++++++++ .../GHSA-jjx5-r5w6-73ph.json | 60 +++++++++++++++++++ .../GHSA-m6rg-ch98-wgfm.json | 50 ++++++++++++++++ .../GHSA-mqwp-h2ff-5c74.json | 33 ++++++++++ .../GHSA-pgpf-3pvh-h5g7.json | 29 +++++++++ .../GHSA-r56h-j38w-hrqq.json | 40 +++++++++++++ .../GHSA-rc85-x3gg-f85v.json | 60 +++++++++++++++++++ .../GHSA-v222-4cxf-9gp4.json | 33 ++++++++++ .../GHSA-v6jq-9h5f-2qcm.json | 29 +++++++++ .../GHSA-vr2c-m23r-wq27.json | 60 +++++++++++++++++++ .../GHSA-wp93-prx6-vqjm.json | 60 +++++++++++++++++++ .../GHSA-xpgm-5xx8-gwpg.json | 52 ++++++++++++++++ 22 files changed, 852 insertions(+), 4 deletions(-) create mode 100644 advisories/unreviewed/2025/03/GHSA-3936-2wwp-m9f7/GHSA-3936-2wwp-m9f7.json create mode 100644 advisories/unreviewed/2025/03/GHSA-74rc-h3mh-g8wh/GHSA-74rc-h3mh-g8wh.json create mode 100644 advisories/unreviewed/2025/03/GHSA-9fcc-m4p7-2rp9/GHSA-9fcc-m4p7-2rp9.json create mode 100644 advisories/unreviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json create mode 100644 advisories/unreviewed/2025/03/GHSA-gxxp-q6ph-495x/GHSA-gxxp-q6ph-495x.json create mode 100644 advisories/unreviewed/2025/03/GHSA-hgp6-2x4p-6v2c/GHSA-hgp6-2x4p-6v2c.json create mode 100644 advisories/unreviewed/2025/03/GHSA-j48m-433v-3q7r/GHSA-j48m-433v-3q7r.json create mode 100644 advisories/unreviewed/2025/03/GHSA-jjx5-r5w6-73ph/GHSA-jjx5-r5w6-73ph.json create mode 100644 advisories/unreviewed/2025/03/GHSA-m6rg-ch98-wgfm/GHSA-m6rg-ch98-wgfm.json create mode 100644 advisories/unreviewed/2025/03/GHSA-mqwp-h2ff-5c74/GHSA-mqwp-h2ff-5c74.json create mode 100644 advisories/unreviewed/2025/03/GHSA-pgpf-3pvh-h5g7/GHSA-pgpf-3pvh-h5g7.json create mode 100644 advisories/unreviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json create mode 100644 advisories/unreviewed/2025/03/GHSA-rc85-x3gg-f85v/GHSA-rc85-x3gg-f85v.json create mode 100644 advisories/unreviewed/2025/03/GHSA-v222-4cxf-9gp4/GHSA-v222-4cxf-9gp4.json create mode 100644 advisories/unreviewed/2025/03/GHSA-v6jq-9h5f-2qcm/GHSA-v6jq-9h5f-2qcm.json create mode 100644 advisories/unreviewed/2025/03/GHSA-vr2c-m23r-wq27/GHSA-vr2c-m23r-wq27.json create mode 100644 advisories/unreviewed/2025/03/GHSA-wp93-prx6-vqjm/GHSA-wp93-prx6-vqjm.json create mode 100644 advisories/unreviewed/2025/03/GHSA-xpgm-5xx8-gwpg/GHSA-xpgm-5xx8-gwpg.json diff --git a/advisories/github-reviewed/2025/03/GHSA-2r4x-667f-mpfh/GHSA-2r4x-667f-mpfh.json b/advisories/github-reviewed/2025/03/GHSA-2r4x-667f-mpfh/GHSA-2r4x-667f-mpfh.json index 975eef6b65f..08e0374e1c9 100644 --- a/advisories/github-reviewed/2025/03/GHSA-2r4x-667f-mpfh/GHSA-2r4x-667f-mpfh.json +++ b/advisories/github-reviewed/2025/03/GHSA-2r4x-667f-mpfh/GHSA-2r4x-667f-mpfh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2r4x-667f-mpfh", - "modified": "2025-03-20T18:24:23Z", + "modified": "2025-03-20T18:30:50Z", "published": "2025-03-20T09:30:26Z", "aliases": [ "CVE-2024-47552" @@ -18,7 +18,7 @@ { "package": { "ecosystem": "Maven", - "name": "org.apache.seata:seata-parent" + "name": "org.apache.seata:seata-config-core" }, "ranges": [ { @@ -40,10 +40,18 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47552" }, + { + "type": "WEB", + "url": "https://github.com/apache/incubator-seata/commit/c0d2ac540b5579e909ae3240f112575313fcad34" + }, { "type": "PACKAGE", "url": "https://github.com/apache/incubator-seata" }, + { + "type": "WEB", + "url": "https://github.com/apache/incubator-seata/releases/tag/v2.2.0" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/652o82vzk9qrtgksk55cfgpbvdgtkch0" diff --git a/advisories/unreviewed/2024/07/GHSA-95gx-prcc-xj69/GHSA-95gx-prcc-xj69.json b/advisories/unreviewed/2024/07/GHSA-95gx-prcc-xj69/GHSA-95gx-prcc-xj69.json index 933f3c66387..1d627ba2a73 100644 --- a/advisories/unreviewed/2024/07/GHSA-95gx-prcc-xj69/GHSA-95gx-prcc-xj69.json +++ b/advisories/unreviewed/2024/07/GHSA-95gx-prcc-xj69/GHSA-95gx-prcc-xj69.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-95gx-prcc-xj69", - "modified": "2024-07-20T12:30:25Z", + "modified": "2025-03-20T18:30:27Z", "published": "2024-07-20T12:30:25Z", "aliases": [ "CVE-2024-6848" diff --git a/advisories/unreviewed/2024/12/GHSA-52mp-7hrc-jmxc/GHSA-52mp-7hrc-jmxc.json b/advisories/unreviewed/2024/12/GHSA-52mp-7hrc-jmxc/GHSA-52mp-7hrc-jmxc.json index d8edd018220..e0ed7c76190 100644 --- a/advisories/unreviewed/2024/12/GHSA-52mp-7hrc-jmxc/GHSA-52mp-7hrc-jmxc.json +++ b/advisories/unreviewed/2024/12/GHSA-52mp-7hrc-jmxc/GHSA-52mp-7hrc-jmxc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-52mp-7hrc-jmxc", - "modified": "2025-01-21T21:30:49Z", + "modified": "2025-03-20T18:30:27Z", "published": "2024-12-19T21:31:11Z", "aliases": [ "CVE-2024-11364" diff --git a/advisories/unreviewed/2025/01/GHSA-pqj9-qcr7-74fh/GHSA-pqj9-qcr7-74fh.json b/advisories/unreviewed/2025/01/GHSA-pqj9-qcr7-74fh/GHSA-pqj9-qcr7-74fh.json index f92487b526e..eef746bbc9c 100644 --- a/advisories/unreviewed/2025/01/GHSA-pqj9-qcr7-74fh/GHSA-pqj9-qcr7-74fh.json +++ b/advisories/unreviewed/2025/01/GHSA-pqj9-qcr7-74fh/GHSA-pqj9-qcr7-74fh.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-400", "CWE-770" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2025/03/GHSA-3936-2wwp-m9f7/GHSA-3936-2wwp-m9f7.json b/advisories/unreviewed/2025/03/GHSA-3936-2wwp-m9f7/GHSA-3936-2wwp-m9f7.json new file mode 100644 index 00000000000..db20bcc68d0 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-3936-2wwp-m9f7/GHSA-3936-2wwp-m9f7.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3936-2wwp-m9f7", + "modified": "2025-03-20T18:30:31Z", + "published": "2025-03-20T18:30:31Z", + "aliases": [ + "CVE-2025-2552" + ], + "details": "A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/formTcpipSetup. The manipulation leads to improper access controls. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2552" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formTcpipSetup-1b153a41781f80a7967ae08c81147a39?pvs=4" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formTcpipSetup-1b053a41781f80fbbf94fda0c3b5ebfa?pvs=4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.300166" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.300166" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.516794" + }, + { + "type": "WEB", + "url": "https://www.dlink.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-74rc-h3mh-g8wh/GHSA-74rc-h3mh-g8wh.json b/advisories/unreviewed/2025/03/GHSA-74rc-h3mh-g8wh/GHSA-74rc-h3mh-g8wh.json new file mode 100644 index 00000000000..bb64caf069a --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-74rc-h3mh-g8wh/GHSA-74rc-h3mh-g8wh.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-74rc-h3mh-g8wh", + "modified": "2025-03-20T18:30:29Z", + "published": "2025-03-20T18:30:29Z", + "aliases": [ + "CVE-2025-23120" + ], + "details": "A vulnerability allowing remote code execution (RCE) for domain users.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23120" + }, + { + "type": "WEB", + "url": "https://labs.watchtowr.com/by-executive-order-we-are-banning-blacklists-domain-level-rce-in-veeam-backup-replication-cve-2025-23120" + }, + { + "type": "WEB", + "url": "https://www.veeam.com/kb4724" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T16:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-9fcc-m4p7-2rp9/GHSA-9fcc-m4p7-2rp9.json b/advisories/unreviewed/2025/03/GHSA-9fcc-m4p7-2rp9/GHSA-9fcc-m4p7-2rp9.json new file mode 100644 index 00000000000..1879ad2d625 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-9fcc-m4p7-2rp9/GHSA-9fcc-m4p7-2rp9.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9fcc-m4p7-2rp9", + "modified": "2025-03-20T18:30:32Z", + "published": "2025-03-20T18:30:32Z", + "aliases": [ + "CVE-2025-2553" + ], + "details": "A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /goform/formVirtualServ. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2553" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formVirtualServ-1b153a41781f80b98645c3f7f4c5f4ae?pvs=4" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formVirtualServ-1b053a41781f80b28443daabf03c0825?pvs=4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.300167" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.300167" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.516795" + }, + { + "type": "WEB", + "url": "https://www.dlink.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T18:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json b/advisories/unreviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json new file mode 100644 index 00000000000..dfa37e1fb03 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-9fcg-wrp8-qhr4/GHSA-9fcg-wrp8-qhr4.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9fcg-wrp8-qhr4", + "modified": "2025-03-20T18:30:31Z", + "published": "2025-03-20T18:30:31Z", + "aliases": [ + "CVE-2025-2565" + ], + "details": "The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 allows an unauthorized user to obtain entry data from forms.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2565" + }, + { + "type": "WEB", + "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2025-2565" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-201" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-gxxp-q6ph-495x/GHSA-gxxp-q6ph-495x.json b/advisories/unreviewed/2025/03/GHSA-gxxp-q6ph-495x/GHSA-gxxp-q6ph-495x.json new file mode 100644 index 00000000000..cc0e3121f67 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-gxxp-q6ph-495x/GHSA-gxxp-q6ph-495x.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gxxp-q6ph-495x", + "modified": "2025-03-20T18:30:31Z", + "published": "2025-03-20T18:30:31Z", + "aliases": [ + "CVE-2025-2480" + ], + "details": "Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in execution of arbitrary code by a local attacker.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2480" + }, + { + "type": "WEB", + "url": "https://santesoft.com/win/sante-dicom-viewer-pro/download.html" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-079-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-hgp6-2x4p-6v2c/GHSA-hgp6-2x4p-6v2c.json b/advisories/unreviewed/2025/03/GHSA-hgp6-2x4p-6v2c/GHSA-hgp6-2x4p-6v2c.json new file mode 100644 index 00000000000..3a01e92c831 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-hgp6-2x4p-6v2c/GHSA-hgp6-2x4p-6v2c.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hgp6-2x4p-6v2c", + "modified": "2025-03-20T18:30:31Z", + "published": "2025-03-20T18:30:31Z", + "aliases": [ + "CVE-2025-2551" + ], + "details": "A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of the file /goform/formSetPortTr. The manipulation leads to improper access controls. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2551" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetPortTr-1b153a41781f809d95c8e39c6c31c348?pvs=4" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetPortTr-1b053a41781f8000a9ded17aa2f587cc?pvs=4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.300165" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.300165" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.516793" + }, + { + "type": "WEB", + "url": "https://www.dlink.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:39Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-j48m-433v-3q7r/GHSA-j48m-433v-3q7r.json b/advisories/unreviewed/2025/03/GHSA-j48m-433v-3q7r/GHSA-j48m-433v-3q7r.json new file mode 100644 index 00000000000..f1c4f0e518a --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-j48m-433v-3q7r/GHSA-j48m-433v-3q7r.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j48m-433v-3q7r", + "modified": "2025-03-20T18:30:30Z", + "published": "2025-03-20T18:30:30Z", + "aliases": [ + "CVE-2024-57440" + ], + "details": "D-Link DSL-3788 revA1 1.01R1B036_EU_EN is vulnerable to Buffer Overflow via the COMM_MAKECustomMsg function of the webproc cgi", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57440" + }, + { + "type": "WEB", + "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10418" + }, + { + "type": "WEB", + "url": "https://www.dlink.com/en/security-bulletin" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-jjx5-r5w6-73ph/GHSA-jjx5-r5w6-73ph.json b/advisories/unreviewed/2025/03/GHSA-jjx5-r5w6-73ph/GHSA-jjx5-r5w6-73ph.json new file mode 100644 index 00000000000..1e23727e674 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-jjx5-r5w6-73ph/GHSA-jjx5-r5w6-73ph.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jjx5-r5w6-73ph", + "modified": "2025-03-20T18:30:31Z", + "published": "2025-03-20T18:30:31Z", + "aliases": [ + "CVE-2025-2550" + ], + "details": "A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/formSetDDNS of the component DDNS Service. The manipulation leads to improper access controls. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2550" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetDDNS-1b153a41781f80feb80bd24afc8f83d5?pvs=4" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetDDNS-1b053a41781f80659702da9a589e4f4a?pvs=4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.300164" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.300164" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.516792" + }, + { + "type": "WEB", + "url": "https://www.dlink.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-m6rg-ch98-wgfm/GHSA-m6rg-ch98-wgfm.json b/advisories/unreviewed/2025/03/GHSA-m6rg-ch98-wgfm/GHSA-m6rg-ch98-wgfm.json new file mode 100644 index 00000000000..1df19b83cea --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-m6rg-ch98-wgfm/GHSA-m6rg-ch98-wgfm.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m6rg-ch98-wgfm", + "modified": "2025-03-20T18:30:32Z", + "published": "2025-03-20T18:30:32Z", + "aliases": [ + "CVE-2025-2555" + ], + "details": "A vulnerability classified as problematic has been found in Audi Universal Traffic Recorder App 2.0. Affected is an unknown function of the component FTP Credentials. The manipulation leads to use of hard-coded password. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.89 and 2.90 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about these issues and acted very professional. Version 2.89 is fixing this issue for new customers and 2.90 is going to fix it for existing customers.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2555" + }, + { + "type": "WEB", + "url": "https://github.com/geo-chen/Audi/blob/main/README.md#finding-2-hardcoded-credentials-in-audi-universal-traffic-recorder-app" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.300168" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.300168" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.513391" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T18:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-mqwp-h2ff-5c74/GHSA-mqwp-h2ff-5c74.json b/advisories/unreviewed/2025/03/GHSA-mqwp-h2ff-5c74/GHSA-mqwp-h2ff-5c74.json new file mode 100644 index 00000000000..90547bd76e8 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-mqwp-h2ff-5c74/GHSA-mqwp-h2ff-5c74.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mqwp-h2ff-5c74", + "modified": "2025-03-20T18:30:31Z", + "published": "2025-03-20T18:30:31Z", + "aliases": [ + "CVE-2025-29215" + ], + "details": "Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29215" + }, + { + "type": "WEB", + "url": "https://gist.github.com/isstabber/a42b32a7dcd401d79c5866247329cddd" + }, + { + "type": "WEB", + "url": "https://github.com/isstabber/my_VulnHub/blob/main/Tenda/AX12/tenda_ax12v1_setnetcontrollist_stack_overflow.pdf" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T18:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-pgpf-3pvh-h5g7/GHSA-pgpf-3pvh-h5g7.json b/advisories/unreviewed/2025/03/GHSA-pgpf-3pvh-h5g7/GHSA-pgpf-3pvh-h5g7.json new file mode 100644 index 00000000000..e923741aa94 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-pgpf-3pvh-h5g7/GHSA-pgpf-3pvh-h5g7.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pgpf-3pvh-h5g7", + "modified": "2025-03-20T18:30:30Z", + "published": "2025-03-20T18:30:30Z", + "aliases": [ + "CVE-2025-29149" + ], + "details": "Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29149" + }, + { + "type": "WEB", + "url": "https://github.com/Raining-101/IOT_cve/blob/main/tenda%20i12formSetAutoPing_ping1.md" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json b/advisories/unreviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json new file mode 100644 index 00000000000..0ff11f8e3ab --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-r56h-j38w-hrqq/GHSA-r56h-j38w-hrqq.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r56h-j38w-hrqq", + "modified": "2025-03-20T18:30:30Z", + "published": "2025-03-20T18:30:30Z", + "aliases": [ + "CVE-2024-7598" + ], + "details": "A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7598" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/126587" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/67D7UFqiPRc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-362" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-rc85-x3gg-f85v/GHSA-rc85-x3gg-f85v.json b/advisories/unreviewed/2025/03/GHSA-rc85-x3gg-f85v/GHSA-rc85-x3gg-f85v.json new file mode 100644 index 00000000000..c581e49f64e --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-rc85-x3gg-f85v/GHSA-rc85-x3gg-f85v.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rc85-x3gg-f85v", + "modified": "2025-03-20T18:30:31Z", + "published": "2025-03-20T18:30:30Z", + "aliases": [ + "CVE-2025-2548" + ], + "details": "A vulnerability, which was classified as problematic, was found in D-Link DIR-618 and DIR-605L 2.02/3.02. Affected is an unknown function of the file /goform/formSetDomainFilter. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2548" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetDomainFilter-1b153a41781f80498fcdf9d675df9b39?pvs=4" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetDomainFilter-1b053a41781f80ffa989c54c391636f6?pvs=4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.300162" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.300162" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.516790" + }, + { + "type": "WEB", + "url": "https://www.dlink.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T16:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-v222-4cxf-9gp4/GHSA-v222-4cxf-9gp4.json b/advisories/unreviewed/2025/03/GHSA-v222-4cxf-9gp4/GHSA-v222-4cxf-9gp4.json new file mode 100644 index 00000000000..206bae98c91 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-v222-4cxf-9gp4/GHSA-v222-4cxf-9gp4.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v222-4cxf-9gp4", + "modified": "2025-03-20T18:30:30Z", + "published": "2025-03-20T18:30:30Z", + "aliases": [ + "CVE-2025-29214" + ], + "details": "Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29214" + }, + { + "type": "WEB", + "url": "https://gist.github.com/isstabber/85fe01ed47ad7ef820f86bfbd64a022c" + }, + { + "type": "WEB", + "url": "https://github.com/isstabber/my_VulnHub/blob/main/Tenda/AX12/tenda_ax12_setMacFilterCfg_stack_overflow_en.pdf" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T16:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-v6jq-9h5f-2qcm/GHSA-v6jq-9h5f-2qcm.json b/advisories/unreviewed/2025/03/GHSA-v6jq-9h5f-2qcm/GHSA-v6jq-9h5f-2qcm.json new file mode 100644 index 00000000000..f6a904af47e --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-v6jq-9h5f-2qcm/GHSA-v6jq-9h5f-2qcm.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v6jq-9h5f-2qcm", + "modified": "2025-03-20T18:30:30Z", + "published": "2025-03-20T18:30:30Z", + "aliases": [ + "CVE-2025-29121" + ], + "details": "A vulnerability was found in Tenda AC6 V15.03.05.16. The vulnerability affects the functionality of the /goform/fast_setting_wifi_set file form_fast_setting_wifi_set. Using the timeZone parameter causes a stack-based buffer overflow.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29121" + }, + { + "type": "WEB", + "url": "https://github.com/Raining-101/IOT_cve/blob/main/ac6_form_fast_setting_wifi_set%20_timeZone.md" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-vr2c-m23r-wq27/GHSA-vr2c-m23r-wq27.json b/advisories/unreviewed/2025/03/GHSA-vr2c-m23r-wq27/GHSA-vr2c-m23r-wq27.json new file mode 100644 index 00000000000..1be824564db --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-vr2c-m23r-wq27/GHSA-vr2c-m23r-wq27.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vr2c-m23r-wq27", + "modified": "2025-03-20T18:30:31Z", + "published": "2025-03-20T18:30:31Z", + "aliases": [ + "CVE-2025-2549" + ], + "details": "A vulnerability has been found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/formSetPassword. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2549" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formSetPassword-1b153a41781f803d8166f9b551b30cd4?pvs=4" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formSetPassword-1b053a41781f8021b704f7dfeb1fcd09?pvs=4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.300163" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.300163" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.516791" + }, + { + "type": "WEB", + "url": "https://www.dlink.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T17:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-wp93-prx6-vqjm/GHSA-wp93-prx6-vqjm.json b/advisories/unreviewed/2025/03/GHSA-wp93-prx6-vqjm/GHSA-wp93-prx6-vqjm.json new file mode 100644 index 00000000000..c4f6f96bb71 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-wp93-prx6-vqjm/GHSA-wp93-prx6-vqjm.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wp93-prx6-vqjm", + "modified": "2025-03-20T18:30:30Z", + "published": "2025-03-20T18:30:30Z", + "aliases": [ + "CVE-2025-2547" + ], + "details": "A vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unknown processing of the file /goform/formAdvNetwork. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2547" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-605L-formAdvNetwork-1b153a41781f80109325dbc96ffc0295?pvs=4" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/D-Link-DIR-618-formAdvNetwork-1b053a41781f8085a4e8d3c1d1de5f56?pvs=4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.300161" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.300161" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.516789" + }, + { + "type": "WEB", + "url": "https://www.dlink.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T16:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-xpgm-5xx8-gwpg/GHSA-xpgm-5xx8-gwpg.json b/advisories/unreviewed/2025/03/GHSA-xpgm-5xx8-gwpg/GHSA-xpgm-5xx8-gwpg.json new file mode 100644 index 00000000000..81043eb3560 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-xpgm-5xx8-gwpg/GHSA-xpgm-5xx8-gwpg.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xpgm-5xx8-gwpg", + "modified": "2025-03-20T18:30:32Z", + "published": "2025-03-20T18:30:32Z", + "aliases": [ + "CVE-2025-2556" + ], + "details": "A vulnerability classified as problematic was found in Audi UTR Dashcam 2.0. Affected by this vulnerability is an unknown functionality of the component Video Stream Handler. The manipulation leads to hard-coded credentials. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 2.89 and 2.90 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about these issues and acted very professional. Version 2.89 is fixing this issue for new customers and 2.90 is going to fix it for existing customers.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2556" + }, + { + "type": "WEB", + "url": "https://github.com/geo-chen/Audi/blob/main/README.md#finding-3-rtsp-and-ftp-wide-open" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.300169" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.300169" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.513392" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-259" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-20T18:15:20Z" + } +} \ No newline at end of file