netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-28vh-xppq-c3v4
GHSA-3phv-44jf-4v33
GHSA-5gxc-5wfv-r5f9
GHSA-8522-pjcf-fhc2
GHSA-j6m3-gc37-6r6q
GHSA-h9pr-qr4v-f87f
GHSA-qqpr-fvmc-87j3
GHSA-mww2-g4ww-rm9w
GHSA-mx84-33q7-299w
GHSA-pqhh-45r9-vjw6
GHSA-r566-fcmc-4j3v
GHSA-rm3h-m7rx-3jrq
GHSA-rpxm-rfxp-96qq
GHSA-w2x6-9r88-x4c6
GHSA-c2w9-h5r4-gc47
GHSA-frpv-8jj9-m3cv
GHSA-vxpp-6299-mxw3
GHSA-2r26-hfxw-87wc
GHSA-3cgj-v3m4-cgcq
GHSA-g8fv-r98j-937r
GHSA-g8qj-jv5h-78cp
GHSA-j238-4ph7-9jqw
This commit is contained in:
advisory-database[bot]
2025-03-14 03:32:54 +00:00
parent 97e5eb1846
commit e410ed7478
22 changed files with 274 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/03/GHSA-28vh-xppq-c3v4/GHSA-28vh-xppq-c3v4.json
+12 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-28vh-xppq-c3v4",
"modified": "2024-03-01T15:31:38Z",
"modified": "2025-03-14T03:31:21Z",
"published": "2024-03-01T15:31:38Z",
"aliases": [
"CVE-2024-27570"
],
"details": "LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the generate_conf_router function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,11 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-121",
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T14:15:54Z"
advisories/unreviewed/2024/03/GHSA-3phv-44jf-4v33/GHSA-3phv-44jf-4v33.json
+12 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3phv-44jf-4v33",
"modified": "2024-03-18T21:31:23Z",
"modified": "2025-03-14T03:31:21Z",
"published": "2024-03-18T21:31:23Z",
"aliases": [
"CVE-2024-25654"
],
"details": "Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application server) to access credentials to authenticate to all services, and to decrypt sensitive data stored in the database.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,11 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-276",
"CWE-532"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-18T20:15:08Z"
advisories/unreviewed/2024/03/GHSA-5gxc-5wfv-r5f9/GHSA-5gxc-5wfv-r5f9.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5gxc-5wfv-r5f9",
"modified": "2024-03-24T03:30:44Z",
"modified": "2025-03-14T03:31:21Z",
"published": "2024-03-24T03:30:44Z",
"aliases": [
"CVE-2024-30161"
],
"details": "In Qt before 6.5.6 and 6.6.x before 6.6.3, the wasm component may access QNetworkReply header data via a dangling pointer.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-416"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-24T01:15:45Z"
advisories/unreviewed/2024/03/GHSA-8522-pjcf-fhc2/GHSA-8522-pjcf-fhc2.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/03/GHSA-j6m3-gc37-6r6q/GHSA-j6m3-gc37-6r6q.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j6m3-gc37-6r6q",
"modified": "2024-05-01T18:30:36Z",
"modified": "2025-03-14T03:31:21Z",
"published": "2024-03-06T00:31:27Z",
"aliases": [
"CVE-2024-24785"
],
"details": "If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -41,7 +46,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-05T23:15:07Z"
advisories/unreviewed/2024/04/GHSA-h9pr-qr4v-f87f/GHSA-h9pr-qr4v-f87f.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h9pr-qr4v-f87f",
"modified": "2024-04-15T06:30:34Z",
"modified": "2025-03-14T03:31:21Z",
"published": "2024-04-15T06:30:34Z",
"aliases": [
"CVE-2024-1846"
],
"details": "The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-15T05:15:15Z"
advisories/unreviewed/2024/04/GHSA-qqpr-fvmc-87j3/GHSA-qqpr-fvmc-87j3.json
+3 -1
View File
@@ -41,7 +41,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-119"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/05/GHSA-mww2-g4ww-rm9w/GHSA-mww2-g4ww-rm9w.json
+12 -5
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mww2-g4ww-rm9w",
"modified": "2024-05-23T18:30:55Z",
"modified": "2025-03-14T03:31:22Z",
"published": "2024-05-23T18:30:55Z",
"aliases": [
"CVE-2024-2301"
],
"details": "Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device. ",
"severity": [],
"details": "Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-23T17:15:28Z"
advisories/unreviewed/2024/05/GHSA-mx84-33q7-299w/GHSA-mx84-33q7-299w.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-120"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/05/GHSA-pqhh-45r9-vjw6/GHSA-pqhh-45r9-vjw6.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pqhh-45r9-vjw6",
"modified": "2024-05-07T21:31:45Z",
"modified": "2025-03-14T03:31:22Z",
"published": "2024-05-07T21:31:45Z",
"aliases": [
"CVE-2024-34314"
],
"details": "CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fetch_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-98"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T19:15:08Z"
advisories/unreviewed/2024/05/GHSA-r566-fcmc-4j3v/GHSA-r566-fcmc-4j3v.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r566-fcmc-4j3v",
"modified": "2024-05-14T15:32:54Z",
"modified": "2025-03-14T03:31:22Z",
"published": "2024-05-14T15:32:54Z",
"aliases": [
"CVE-2024-2441"
],
"details": "The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-285"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T15:19:20Z"
advisories/unreviewed/2024/05/GHSA-rm3h-m7rx-3jrq/GHSA-rm3h-m7rx-3jrq.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rm3h-m7rx-3jrq",
"modified": "2024-05-15T06:30:44Z",
"modified": "2025-03-14T03:31:22Z",
"published": "2024-05-15T06:30:44Z",
"aliases": [
"CVE-2024-3405"
],
"details": "The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-15T06:15:09Z"
advisories/unreviewed/2024/05/GHSA-rpxm-rfxp-96qq/GHSA-rpxm-rfxp-96qq.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rpxm-rfxp-96qq",
"modified": "2024-05-01T03:30:31Z",
"modified": "2025-03-14T03:31:22Z",
"published": "2024-05-01T03:30:31Z",
"aliases": [
"CVE-2024-33767"
],
"details": "lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-125"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-01T03:15:07Z"
advisories/unreviewed/2024/05/GHSA-w2x6-9r88-x4c6/GHSA-w2x6-9r88-x4c6.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w2x6-9r88-x4c6",
"modified": "2024-05-02T06:30:31Z",
"modified": "2025-03-14T03:31:22Z",
"published": "2024-05-02T06:30:31Z",
"aliases": [
"CVE-2024-3475"
],
"details": "The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-02T06:15:50Z"
advisories/unreviewed/2024/06/GHSA-c2w9-h5r4-gc47/GHSA-c2w9-h5r4-gc47.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c2w9-h5r4-gc47",
"modified": "2024-06-20T18:34:08Z",
"modified": "2025-03-14T03:31:23Z",
"published": "2024-06-20T18:34:08Z",
"aliases": [
"CVE-2022-41324"
],
"details": "Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensitive device information.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-20T17:15:50Z"
advisories/unreviewed/2024/06/GHSA-frpv-8jj9-m3cv/GHSA-frpv-8jj9-m3cv.json
+2 -1
View File
@@ -30,7 +30,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-1021"
"CWE-1021",
"CWE-451"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/06/GHSA-vxpp-6299-mxw3/GHSA-vxpp-6299-mxw3.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vxpp-6299-mxw3",
"modified": "2024-12-20T21:30:45Z",
"modified": "2025-03-14T03:31:23Z",
"published": "2024-06-09T21:30:34Z",
"aliases": [
"CVE-2024-4577"
@@ -91,6 +91,10 @@
"type": "WEB",
"url": "https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately"
},
{
"type": "WEB",
"url": "https://blog.talosintelligence.com/new-persistent-attacks-japan"
},
{
"type": "WEB",
"url": "https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html"
advisories/unreviewed/2025/03/GHSA-2r26-hfxw-87wc/GHSA-2r26-hfxw-87wc.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2r26-hfxw-87wc",
"modified": "2025-03-14T03:31:24Z",
"published": "2025-03-14T03:31:24Z",
"aliases": [
"CVE-2025-26163"
],
"details": "CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the CPF parameter.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26163"
},
{
"type": "WEB",
"url": "https://github.com/Fr1t0viski/PoCs/blob/main/SQL_Injection_AutoAtendimento"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-14T03:15:44Z"
}
}
advisories/unreviewed/2025/03/GHSA-3cgj-v3m4-cgcq/GHSA-3cgj-v3m4-cgcq.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3cgj-v3m4-cgcq",
"modified": "2025-03-14T03:31:24Z",
"published": "2025-03-14T03:31:24Z",
"aliases": [
"CVE-2025-24855"
],
"details": "numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24855"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/128"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-14T02:15:15Z"
}
}
advisories/unreviewed/2025/03/GHSA-g8fv-r98j-937r/GHSA-g8fv-r98j-937r.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g8fv-r98j-937r",
"modified": "2025-03-14T03:31:24Z",
"published": "2025-03-14T03:31:24Z",
"aliases": [
"CVE-2024-55549"
],
"details": "xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55549"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/127"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-14T02:15:15Z"
}
}

Some files were not shown because too many files have changed in this diff Show More