diff --git a/advisories/unreviewed/2025/01/GHSA-2f82-fhcf-rx3f/GHSA-2f82-fhcf-rx3f.json b/advisories/unreviewed/2025/01/GHSA-2f82-fhcf-rx3f/GHSA-2f82-fhcf-rx3f.json new file mode 100644 index 00000000000..eaee02bab61 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-2f82-fhcf-rx3f/GHSA-2f82-fhcf-rx3f.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2f82-fhcf-rx3f", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43769" + ], + "details": "In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43769" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/frameworks/base/+/619ffc299bf33566ba6daee8301ee0fc96e015f4" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-2vvg-qw4w-m46v/GHSA-2vvg-qw4w-m46v.json b/advisories/unreviewed/2025/01/GHSA-2vvg-qw4w-m46v/GHSA-2vvg-qw4w-m46v.json new file mode 100644 index 00000000000..c7efae88fc4 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-2vvg-qw4w-m46v/GHSA-2vvg-qw4w-m46v.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2vvg-qw4w-m46v", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43764" + ], + "details": "In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43764" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/frameworks/base/+/70eb75df7d342429c3ee225feb7c011df727442f" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-c9wr-34xc-92vr/GHSA-c9wr-34xc-92vr.json b/advisories/unreviewed/2025/01/GHSA-c9wr-34xc-92vr/GHSA-c9wr-34xc-92vr.json new file mode 100644 index 00000000000..7c6bcb08f4a --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-c9wr-34xc-92vr/GHSA-c9wr-34xc-92vr.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c9wr-34xc-92vr", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43762" + ], + "details": "In multiple locations, there is a possible way to avoid unbinding of a service from the system due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43762" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/frameworks/base/+/ae43ac7f3d3d5112b0f54b5315a15b08208acf9c" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-fvg9-4m3g-p4h7/GHSA-fvg9-4m3g-p4h7.json b/advisories/unreviewed/2025/01/GHSA-fvg9-4m3g-p4h7/GHSA-fvg9-4m3g-p4h7.json new file mode 100644 index 00000000000..c82550d9a67 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-fvg9-4m3g-p4h7/GHSA-fvg9-4m3g-p4h7.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fvg9-4m3g-p4h7", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43768" + ], + "details": "In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43768" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/external/skia/+/b5543cb8c6b95623743016055220378efe73eb93" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-m5fr-264j-4mq3/GHSA-m5fr-264j-4mq3.json b/advisories/unreviewed/2025/01/GHSA-m5fr-264j-4mq3/GHSA-m5fr-264j-4mq3.json new file mode 100644 index 00000000000..eb7ad49cc4c --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-m5fr-264j-4mq3/GHSA-m5fr-264j-4mq3.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m5fr-264j-4mq3", + "modified": "2025-01-03T03:30:26Z", + "published": "2025-01-03T03:30:26Z", + "aliases": [ + "CVE-2024-43077" + ], + "details": "In DevmemValidateFlags of devicemem_server.c , there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43077" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-q4c8-95h3-qpvr/GHSA-q4c8-95h3-qpvr.json b/advisories/unreviewed/2025/01/GHSA-q4c8-95h3-qpvr/GHSA-q4c8-95h3-qpvr.json new file mode 100644 index 00000000000..fed9cd21b48 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-q4c8-95h3-qpvr/GHSA-q4c8-95h3-qpvr.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q4c8-95h3-qpvr", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2025-0176" + ], + "details": "A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /user/add_cart.php. The manipulation of the argument id/qty leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0176" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Masamuneee/9c539b89dad40033a5037b744e394ae0" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290105" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290105" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.473347" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T02:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-q7cq-v47g-g2v2/GHSA-q7cq-v47g-g2v2.json b/advisories/unreviewed/2025/01/GHSA-q7cq-v47g-g2v2/GHSA-q7cq-v47g-g2v2.json new file mode 100644 index 00000000000..2333cf991fc --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-q7cq-v47g-g2v2/GHSA-q7cq-v47g-g2v2.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7cq-v47g-g2v2", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43767" + ], + "details": "In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43767" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/external/skia/+/796c2040f641bb287dba66c9823ce45e9f8b5807" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-rr2x-3m79-49mj/GHSA-rr2x-3m79-49mj.json b/advisories/unreviewed/2025/01/GHSA-rr2x-3m79-49mj/GHSA-rr2x-3m79-49mj.json new file mode 100644 index 00000000000..5a5d32c51f9 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-rr2x-3m79-49mj/GHSA-rr2x-3m79-49mj.json @@ -0,0 +1,57 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rr2x-3m79-49mj", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2025-0174" + ], + "details": "A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /user/search_result2.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0174" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Masamuneee/ca3f96ac0ec34bb7c1dd4bfd180f11bb" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290103" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290103" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.473330" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74", + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-vvqr-c837-hr5q/GHSA-vvqr-c837-hr5q.json b/advisories/unreviewed/2025/01/GHSA-vvqr-c837-hr5q/GHSA-vvqr-c837-hr5q.json new file mode 100644 index 00000000000..95881890ccd --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-vvqr-c837-hr5q/GHSA-vvqr-c837-hr5q.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vvqr-c837-hr5q", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43097" + ], + "details": "In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43097" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/external/skia/+/8d355fe1d0795fc30b84194b87563f75c6f8f2a7" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file