netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2025-02-14 21:31:28 +00:00
parent 531eeb1667
commit ddeeea6c42
37 changed files with 504 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/02/GHSA-xg2h-7cxj-3gvh/GHSA-xg2h-7cxj-3gvh.json
+4 -3
View File
@@ -1,13 +1,14 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xg2h-7cxj-3gvh",
"modified": "2025-02-12T19:33:10Z",
"modified": "2025-02-14T21:30:14Z",
"published": "2025-02-12T00:32:17Z",
"withdrawn": "2025-02-14T21:30:14Z",
"aliases": [
"CVE-2024-57000"
],
"summary": "Command injection in Ray",
"details": "An issue in Anyscale Inc Ray between v.2.9.3 and v.2.40.0 allows a remote attacker to execute arbitrary code via a crafted script.",
"summary": "Withdrawn Advisory: Command injection in Ray",
"details": "# Withdrawn Advisory\nThis advisory is a duplicate of GHSA-6wgj-66m2-xxp2 / CVE-2023-48022.\n\n# Original Description\nAn issue in Anyscale Inc Ray between v.2.9.3 and v.2.40.0 allows a remote attacker to execute arbitrary code via a crafted script.",
"severity": [
{
"type": "CVSS_V3",
advisories/unreviewed/2022/05/GHSA-p27r-23gv-6hr2/GHSA-p27r-23gv-6hr2.json
+7 -2
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p27r-23gv-6hr2",
"modified": "2022-05-24T19:16:46Z",
"modified": "2025-02-14T21:31:00Z",
"published": "2022-05-24T19:16:46Z",
"aliases": [
"CVE-2021-39351"
],
"details": "The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
advisories/unreviewed/2023/03/GHSA-6mcj-frmm-wmr5/GHSA-6mcj-frmm-wmr5.json
+17 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6mcj-frmm-wmr5",
"modified": "2023-04-08T03:30:28Z",
"modified": "2025-02-14T21:31:01Z",
"published": "2023-03-31T18:30:20Z",
"aliases": [
"CVE-2023-28879"
@@ -27,6 +27,10 @@
"type": "WEB",
"url": "https://ghostscript.readthedocs.io/en/latest/News.html"
},
{
"type": "WEB",
"url": "https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179"
},
{
"type": "WEB",
"url": "https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=37ed5022cecd584de868933b5b60da2e995b3179"
@@ -35,6 +39,18 @@
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00003.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CI6UCKM3XMK7PYNIRGAVDJ5VKN6XYZOE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHJX62KSRIOBZA6FKONMJP7MEFY7LTH2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MADLP3GWJFLLFVNZGEDNPMDQR6CCXAHN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CI6UCKM3XMK7PYNIRGAVDJ5VKN6XYZOE"
advisories/unreviewed/2023/03/GHSA-f3hr-rv72-879p/GHSA-f3hr-rv72-879p.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2023/03/GHSA-j4f5-gw7r-fr82/GHSA-j4f5-gw7r-fr82.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2023/03/GHSA-mhh7-364w-v3ph/GHSA-mhh7-364w-v3ph.json
+8 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mhh7-364w-v3ph",
"modified": "2023-04-08T03:30:28Z",
"modified": "2025-02-14T21:31:01Z",
"published": "2023-03-31T18:30:20Z",
"aliases": [
"CVE-2023-28877"
@@ -19,13 +19,19 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28877"
},
{
"type": "WEB",
"url": "https://developers.vtex.com/updates/release-notes/deprecation-of-apps-graphql%402.x"
},
{
"type": "WEB",
"url": "https://developers.vtex.com/updates/release-notes/deprecation-of-apps-graphql@2.x"
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-284"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2023/04/GHSA-vrfj-56m3-478f/GHSA-vrfj-56m3-478f.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vrfj-56m3-478f",
"modified": "2023-04-07T03:30:16Z",
"modified": "2025-02-14T21:31:02Z",
"published": "2023-04-04T15:30:27Z",
"aliases": [
"CVE-2020-19699"
advisories/unreviewed/2025/02/GHSA-359j-pv49-2m97/GHSA-359j-pv49-2m97.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-359j-pv49-2m97",
"modified": "2025-02-12T18:31:35Z",
"modified": "2025-02-14T21:31:03Z",
"published": "2025-02-12T18:31:35Z",
"aliases": [
"CVE-2025-25351"
],
"details": "PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T16:15:46Z"
advisories/unreviewed/2025/02/GHSA-37rg-82p6-6g3x/GHSA-37rg-82p6-6g3x.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-37rg-82p6-6g3x",
"modified": "2025-02-14T00:30:44Z",
"modified": "2025-02-14T21:31:04Z",
"published": "2025-02-14T00:30:44Z",
"aliases": [
"CVE-2024-37603"
],
"details": "An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible type confusion exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-843"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-13T23:15:10Z"
advisories/unreviewed/2025/02/GHSA-4994-gjh6-5rmr/GHSA-4994-gjh6-5rmr.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4994-gjh6-5rmr",
"modified": "2025-02-14T18:30:52Z",
"modified": "2025-02-14T21:31:05Z",
"published": "2025-02-14T18:30:52Z",
"aliases": [
"CVE-2025-25994"
],
"details": "SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-14T17:15:21Z"
advisories/unreviewed/2025/02/GHSA-4gcq-fhhf-j285/GHSA-4gcq-fhhf-j285.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4gcq-fhhf-j285",
"modified": "2025-02-14T18:30:52Z",
"modified": "2025-02-14T21:31:05Z",
"published": "2025-02-14T18:30:52Z",
"aliases": [
"CVE-2025-25992"
],
"details": "SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php component.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-14T17:15:21Z"
advisories/unreviewed/2025/02/GHSA-4h5r-r8cj-6rj3/GHSA-4h5r-r8cj-6rj3.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-121"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2025/02/GHSA-4hj2-83vx-rh57/GHSA-4hj2-83vx-rh57.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4hj2-83vx-rh57",
"modified": "2025-02-14T21:31:05Z",
"published": "2025-02-14T21:31:05Z",
"aliases": [
"CVE-2025-0593"
],
"details": "The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0593"
},
{
"type": "WEB",
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
},
{
"type": "WEB",
"url": "https://sick.com/psirt"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"type": "WEB",
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0002.json"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0002.pdf"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-14T21:15:16Z"
}
}
advisories/unreviewed/2025/02/GHSA-4xph-hcw4-77x7/GHSA-4xph-hcw4-77x7.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4xph-hcw4-77x7",
"modified": "2025-02-14T18:30:51Z",
"modified": "2025-02-14T21:31:04Z",
"published": "2025-02-14T18:30:51Z",
"aliases": [
"CVE-2024-57778"
],
"details": "An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-269"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-14T16:15:34Z"
advisories/unreviewed/2025/02/GHSA-6vpc-jmr8-rh6f/GHSA-6vpc-jmr8-rh6f.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vpc-jmr8-rh6f",
"modified": "2025-02-12T00:32:16Z",
"modified": "2025-02-14T21:31:03Z",
"published": "2025-02-12T00:32:16Z",
"aliases": [
"CVE-2024-57241"
],
"details": "Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirection.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-601"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T22:15:29Z"
advisories/unreviewed/2025/02/GHSA-739j-9mp5-mmf8/GHSA-739j-9mp5-mmf8.json
+15 -4
View File
@@ -1,27 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-739j-9mp5-mmf8",
"modified": "2025-02-13T00:33:07Z",
"modified": "2025-02-14T21:31:04Z",
"published": "2025-02-13T00:33:07Z",
"aliases": [
"CVE-2024-56939"
],
"details": "LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56939"
},
{
"type": "WEB",
"url": "https://github.com/nikolas-ch/CVEs/blob/main/LearnDash_v6.7.1/CVE-2024-56939/StoredXSS_LDCommentBody_LearnDash_v6.7.1.PNG"
},
{
"type": "WEB",
"url": "https://github.com/nikolas-ch/CVEs/tree/main/LearnDash_v6.7.1"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T22:15:40Z"
advisories/unreviewed/2025/02/GHSA-73xc-hhcm-f4v8/GHSA-73xc-hhcm-f4v8.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-73xc-hhcm-f4v8",
"modified": "2025-02-13T18:32:34Z",
"modified": "2025-02-14T21:31:04Z",
"published": "2025-02-13T18:32:34Z",
"aliases": [
"CVE-2025-25354"
],
"details": "A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactnumber POST request parameter.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-13T16:16:49Z"
advisories/unreviewed/2025/02/GHSA-74p9-4v44-wwx5/GHSA-74p9-4v44-wwx5.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-74p9-4v44-wwx5",
"modified": "2025-02-14T18:30:51Z",
"modified": "2025-02-14T21:31:04Z",
"published": "2025-02-14T18:30:51Z",
"aliases": [
"CVE-2024-3220"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/02/14/8"
}
],
"database_specific": {
advisories/unreviewed/2025/02/GHSA-7fx8-mhcf-6p64/GHSA-7fx8-mhcf-6p64.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7fx8-mhcf-6p64",
"modified": "2025-02-14T18:30:52Z",
"modified": "2025-02-14T21:31:05Z",
"published": "2025-02-14T18:30:52Z",
"aliases": [
"CVE-2025-25988"
],
"details": "Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parameter and the Title parameter.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-14T17:15:21Z"
advisories/unreviewed/2025/02/GHSA-7p8p-8grh-gvmj/GHSA-7p8p-8grh-gvmj.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7p8p-8grh-gvmj",
"modified": "2025-02-13T18:32:34Z",
"modified": "2025-02-14T21:31:04Z",
"published": "2025-02-13T18:32:34Z",
"aliases": [
"CVE-2025-25352"
],
"details": "A SQL Injection vulnerability was found in /admin/aboutus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the pagetitle POST request parameter.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-13T16:16:49Z"

Some files were not shown because too many files have changed in this diff Show More