From dde672d16b7b4f4e95f2f36e470740f55655f73e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sun, 27 Apr 2025 09:32:38 +0000 Subject: [PATCH] Publish Advisories GHSA-6v67-599p-fprc GHSA-5j93-g7gj-8hgg GHSA-76j2-36mj-g8c9 GHSA-96ww-v34w-gmvc GHSA-fcvq-7qm5-g2jm GHSA-rmm7-5phh-4q5m GHSA-w6pr-9q7f-5phx --- .../GHSA-6v67-599p-fprc.json | 6 ++- .../GHSA-5j93-g7gj-8hgg.json | 52 +++++++++++++++++++ .../GHSA-76j2-36mj-g8c9.json | 52 +++++++++++++++++++ .../GHSA-96ww-v34w-gmvc.json | 36 +++++++++++++ .../GHSA-fcvq-7qm5-g2jm.json | 36 +++++++++++++ .../GHSA-rmm7-5phh-4q5m.json | 52 +++++++++++++++++++ .../GHSA-w6pr-9q7f-5phx.json | 52 +++++++++++++++++++ 7 files changed, 285 insertions(+), 1 deletion(-) create mode 100644 advisories/unreviewed/2025/04/GHSA-5j93-g7gj-8hgg/GHSA-5j93-g7gj-8hgg.json create mode 100644 advisories/unreviewed/2025/04/GHSA-76j2-36mj-g8c9/GHSA-76j2-36mj-g8c9.json create mode 100644 advisories/unreviewed/2025/04/GHSA-96ww-v34w-gmvc/GHSA-96ww-v34w-gmvc.json create mode 100644 advisories/unreviewed/2025/04/GHSA-fcvq-7qm5-g2jm/GHSA-fcvq-7qm5-g2jm.json create mode 100644 advisories/unreviewed/2025/04/GHSA-rmm7-5phh-4q5m/GHSA-rmm7-5phh-4q5m.json create mode 100644 advisories/unreviewed/2025/04/GHSA-w6pr-9q7f-5phx/GHSA-w6pr-9q7f-5phx.json diff --git a/advisories/unreviewed/2025/03/GHSA-6v67-599p-fprc/GHSA-6v67-599p-fprc.json b/advisories/unreviewed/2025/03/GHSA-6v67-599p-fprc/GHSA-6v67-599p-fprc.json index f85c51a7efc..c3afc63d870 100644 --- a/advisories/unreviewed/2025/03/GHSA-6v67-599p-fprc/GHSA-6v67-599p-fprc.json +++ b/advisories/unreviewed/2025/03/GHSA-6v67-599p-fprc/GHSA-6v67-599p-fprc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6v67-599p-fprc", - "modified": "2025-03-11T18:32:17Z", + "modified": "2025-04-27T09:30:34Z", "published": "2025-03-11T18:32:17Z", "aliases": [ "CVE-2025-24054" @@ -22,6 +22,10 @@ { "type": "WEB", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054" + }, + { + "type": "WEB", + "url": "http://seclists.org/fulldisclosure/2025/Apr/28" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/04/GHSA-5j93-g7gj-8hgg/GHSA-5j93-g7gj-8hgg.json b/advisories/unreviewed/2025/04/GHSA-5j93-g7gj-8hgg/GHSA-5j93-g7gj-8hgg.json new file mode 100644 index 00000000000..21fbe8a07c6 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-5j93-g7gj-8hgg/GHSA-5j93-g7gj-8hgg.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5j93-g7gj-8hgg", + "modified": "2025-04-27T09:30:34Z", + "published": "2025-04-27T09:30:34Z", + "aliases": [ + "CVE-2025-3962" + ], + "details": "A vulnerability classified as problematic was found in withstars Books-Management-System 1.0. This vulnerability affects unknown code of the file /api/comment/add of the component Comment Handler. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3962" + }, + { + "type": "WEB", + "url": "https://github.com/caigo8/CVE-md/blob/main/Blog-System/XSS2.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306298" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306298" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557236" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T07:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-76j2-36mj-g8c9/GHSA-76j2-36mj-g8c9.json b/advisories/unreviewed/2025/04/GHSA-76j2-36mj-g8c9/GHSA-76j2-36mj-g8c9.json new file mode 100644 index 00000000000..e09676dd4b5 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-76j2-36mj-g8c9/GHSA-76j2-36mj-g8c9.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-76j2-36mj-g8c9", + "modified": "2025-04-27T09:30:35Z", + "published": "2025-04-27T09:30:35Z", + "aliases": [ + "CVE-2025-3963" + ], + "details": "A vulnerability, which was classified as critical, has been found in withstars Books-Management-System 1.0. This issue affects some unknown processing of the file /admin/article/list of the component Background Interface. The manipulation leads to missing authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3963" + }, + { + "type": "WEB", + "url": "https://github.com/caigo8/CVE-md/blob/main/Blog-System/%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306299" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306299" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557237" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T08:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-96ww-v34w-gmvc/GHSA-96ww-v34w-gmvc.json b/advisories/unreviewed/2025/04/GHSA-96ww-v34w-gmvc/GHSA-96ww-v34w-gmvc.json new file mode 100644 index 00000000000..98678209fab --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-96ww-v34w-gmvc/GHSA-96ww-v34w-gmvc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-96ww-v34w-gmvc", + "modified": "2025-04-27T09:30:34Z", + "published": "2025-04-27T09:30:34Z", + "aliases": [ + "CVE-2024-52888" + ], + "details": "For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52888" + }, + { + "type": "WEB", + "url": "https://support.checkpoint.com/results/sk/sk183055" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T08:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-fcvq-7qm5-g2jm/GHSA-fcvq-7qm5-g2jm.json b/advisories/unreviewed/2025/04/GHSA-fcvq-7qm5-g2jm/GHSA-fcvq-7qm5-g2jm.json new file mode 100644 index 00000000000..f69f2736244 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-fcvq-7qm5-g2jm/GHSA-fcvq-7qm5-g2jm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fcvq-7qm5-g2jm", + "modified": "2025-04-27T09:30:34Z", + "published": "2025-04-27T09:30:34Z", + "aliases": [ + "CVE-2024-52887" + ], + "details": "Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52887" + }, + { + "type": "WEB", + "url": "https://support.checkpoint.com/results/sk/sk183054" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T08:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-rmm7-5phh-4q5m/GHSA-rmm7-5phh-4q5m.json b/advisories/unreviewed/2025/04/GHSA-rmm7-5phh-4q5m/GHSA-rmm7-5phh-4q5m.json new file mode 100644 index 00000000000..88350ed2bb0 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-rmm7-5phh-4q5m/GHSA-rmm7-5phh-4q5m.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rmm7-5phh-4q5m", + "modified": "2025-04-27T09:30:35Z", + "published": "2025-04-27T09:30:35Z", + "aliases": [ + "CVE-2025-3964" + ], + "details": "A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of the file /api/article/del of the component Article Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3964" + }, + { + "type": "WEB", + "url": "https://github.com/caigo8/CVE-md/blob/main/Blog-System/CSRF.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306300" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306300" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557239" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T09:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-w6pr-9q7f-5phx/GHSA-w6pr-9q7f-5phx.json b/advisories/unreviewed/2025/04/GHSA-w6pr-9q7f-5phx/GHSA-w6pr-9q7f-5phx.json new file mode 100644 index 00000000000..9333d95c03b --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-w6pr-9q7f-5phx/GHSA-w6pr-9q7f-5phx.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6pr-9q7f-5phx", + "modified": "2025-04-27T09:30:34Z", + "published": "2025-04-27T09:30:34Z", + "aliases": [ + "CVE-2025-3961" + ], + "details": "A vulnerability classified as problematic has been found in withstars Books-Management-System 1.0. This affects an unknown part of the file /admin/article/add/do. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3961" + }, + { + "type": "WEB", + "url": "https://github.com/caigo8/CVE-md/blob/main/Blog-System/XSS1.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.306297" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.306297" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.557231" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-27T07:15:15Z" + } +} \ No newline at end of file