netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-498c-98jc-j5pq
GHSA-68cw-2c7v-6c2c
GHSA-7x89-hg32-8xpm
GHSA-9935-9fvv-4c6p
GHSA-h46m-532h-mwqc
GHSA-j634-qrvx-mfvr
GHSA-p4j8-rc7w-24gr
GHSA-xrpv-p27x-5mvw
GHSA-4qgw-f8fj-66qh
GHSA-6vwh-w96v-4q99
GHSA-cx27-3285-95p7
GHSA-f2q5-6mx7-q9qq
GHSA-j2gw-r24m-j2qw
GHSA-wp68-xrfg-xvq4
This commit is contained in:
advisory-database[bot]
2025-02-05 06:32:20 +00:00
parent 00176935ca
commit e09003c1c2
14 changed files with 320 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/01/GHSA-498c-98jc-j5pq/GHSA-498c-98jc-j5pq.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-498c-98jc-j5pq",
"modified": "2025-01-30T21:31:22Z",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-01-30T21:31:22Z",
"aliases": [
"CVE-2025-24505"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362"
}
],
"database_specific": {
advisories/unreviewed/2025/01/GHSA-68cw-2c7v-6c2c/GHSA-68cw-2c7v-6c2c.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-68cw-2c7v-6c2c",
"modified": "2025-01-30T21:31:22Z",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-01-30T21:31:22Z",
"aliases": [
"CVE-2025-24506"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362"
}
],
"database_specific": {
advisories/unreviewed/2025/01/GHSA-7x89-hg32-8xpm/GHSA-7x89-hg32-8xpm.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7x89-hg32-8xpm",
"modified": "2025-01-30T21:31:22Z",
"modified": "2025-02-05T06:30:25Z",
"published": "2025-01-30T21:31:22Z",
"aliases": [
"CVE-2025-24500"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362"
}
],
"database_specific": {
advisories/unreviewed/2025/01/GHSA-9935-9fvv-4c6p/GHSA-9935-9fvv-4c6p.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9935-9fvv-4c6p",
"modified": "2025-01-30T21:31:22Z",
"modified": "2025-02-05T06:30:25Z",
"published": "2025-01-30T21:31:22Z",
"aliases": [
"CVE-2025-24501"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362"
}
],
"database_specific": {
advisories/unreviewed/2025/01/GHSA-h46m-532h-mwqc/GHSA-h46m-532h-mwqc.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h46m-532h-mwqc",
"modified": "2025-01-30T21:31:22Z",
"modified": "2025-02-05T06:30:25Z",
"published": "2025-01-30T21:31:22Z",
"aliases": [
"CVE-2025-24502"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362"
}
],
"database_specific": {
advisories/unreviewed/2025/01/GHSA-j634-qrvx-mfvr/GHSA-j634-qrvx-mfvr.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j634-qrvx-mfvr",
"modified": "2025-01-30T21:31:22Z",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-01-30T21:31:22Z",
"aliases": [
"CVE-2025-24503"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362"
}
],
"database_specific": {
advisories/unreviewed/2025/01/GHSA-p4j8-rc7w-24gr/GHSA-p4j8-rc7w-24gr.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p4j8-rc7w-24gr",
"modified": "2025-01-30T21:31:22Z",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-01-30T21:31:22Z",
"aliases": [
"CVE-2025-24504"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362"
}
],
"database_specific": {
advisories/unreviewed/2025/01/GHSA-xrpv-p27x-5mvw/GHSA-xrpv-p27x-5mvw.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xrpv-p27x-5mvw",
"modified": "2025-01-30T21:31:22Z",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-01-30T21:31:22Z",
"aliases": [
"CVE-2025-24507"
@@ -22,6 +22,10 @@
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25362"
}
],
"database_specific": {
advisories/unreviewed/2025/02/GHSA-4qgw-f8fj-66qh/GHSA-4qgw-f8fj-66qh.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4qgw-f8fj-66qh",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-02-05T06:30:26Z",
"aliases": [
"CVE-2025-25246"
],
"details": "NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25246"
},
{
"type": "WEB",
"url": "https://kb.netgear.com/000066558/Security-Advisory-for-Unauthenticated-RCE-on-Some-WiFi-Routers-PSV-2023-0039"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T05:15:11Z"
}
}
advisories/unreviewed/2025/02/GHSA-6vwh-w96v-4q99/GHSA-6vwh-w96v-4q99.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vwh-w96v-4q99",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-02-05T06:30:26Z",
"aliases": [
"CVE-2025-1028"
],
"details": "The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to, and including, 8.6.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in specific configurations where the first extension is processed over the final. This vulnerability also requires successfully exploiting a race condition in order to exploit.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1028"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?old_path=/contact-manager/tags/8.6.4&new_path=/contact-manager/tags/8.6.5&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f51a8e-4a59-4b64-b0c6-2ce3933a1df5?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T04:15:06Z"
}
}
advisories/unreviewed/2025/02/GHSA-cx27-3285-95p7/GHSA-cx27-3285-95p7.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cx27-3285-95p7",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-02-05T06:30:26Z",
"aliases": [
"CVE-2024-13829"
],
"details": "The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.0.8 via the 'attachments.php' file. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via forms.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13829"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/attachments.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3231968"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a938042-bad6-4fe0-8905-148d07a22996?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T06:15:31Z"
}
}
advisories/unreviewed/2025/02/GHSA-f2q5-6mx7-q9qq/GHSA-f2q5-6mx7-q9qq.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f2q5-6mx7-q9qq",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-02-05T06:30:26Z",
"aliases": [
"CVE-2025-1026"
],
"details": "Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files.\n\n**Note:**\n\nThis is a bypass of the fix for [CVE-2024-21549](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1026"
},
{
"type": "WEB",
"url": "https://github.com/spatie/browsershot/pull/908"
},
{
"type": "WEB",
"url": "https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72"
},
{
"type": "WEB",
"url": "https://gist.github.com/chuajianshen/6291920112fcf1543fa7b43862112be6"
},
{
"type": "WEB",
"url": "https://gist.github.com/mrdgef/54a8783408220c67c1b859df38a52d65"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533024"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T05:15:10Z"
}
}
advisories/unreviewed/2025/02/GHSA-j2gw-r24m-j2qw/GHSA-j2gw-r24m-j2qw.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j2gw-r24m-j2qw",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-02-05T06:30:26Z",
"aliases": [
"CVE-2025-1022"
],
"details": "Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1022"
},
{
"type": "WEB",
"url": "https://github.com/spatie/browsershot/commit/bcfd608b264fab654bf78e199bdfbb03e9323eb7"
},
{
"type": "WEB",
"url": "https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72"
},
{
"type": "WEB",
"url": "https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496747"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T05:15:10Z"
}
}
advisories/unreviewed/2025/02/GHSA-wp68-xrfg-xvq4/GHSA-wp68-xrfg-xvq4.json
+52
View File
@@ -0,0 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wp68-xrfg-xvq4",
"modified": "2025-02-05T06:30:26Z",
"published": "2025-02-05T06:30:26Z",
"aliases": [
"CVE-2025-1025"
],
"details": "Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1025"
},
{
"type": "WEB",
"url": "https://github.com/Cockpit-HQ/Cockpit/commit/984ef9ad270357b843af63c81db95178eae42cae"
},
{
"type": "WEB",
"url": "https://github.com/Cockpit-HQ/Cockpit/commit/becca806c7071ecc732521bb5ad0bb9c64299592"
},
{
"type": "WEB",
"url": "https://gist.github.com/CHOOCS/fe1227443544d5d74c33982814f290af"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-PHP-COCKPITHQCOCKPIT-8516320"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T05:15:10Z"
}
}