diff --git a/advisories/github-reviewed/2025/04/GHSA-389x-67px-mjg3/GHSA-389x-67px-mjg3.json b/advisories/github-reviewed/2025/04/GHSA-389x-67px-mjg3/GHSA-389x-67px-mjg3.json new file mode 100644 index 00000000000..e8c0ec0c2d7 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-389x-67px-mjg3/GHSA-389x-67px-mjg3.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-389x-67px-mjg3", + "modified": "2025-04-09T13:08:59Z", + "published": "2025-04-09T13:08:59Z", + "aliases": [], + "summary": "xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory", + "details": "### Summary\n\nXgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can be abused to fill up a host's memory and case a denial of service. For example, sending many small requests to an LLM inference server with unique JSON schemas would eventually cause this denial of service to occur.\n\n### Details\n\nThe fix is to add a limit to the cache size. This was done in https://github.com/mlc-ai/xgrammar/pull/243\n\nAn example of making use of the new cache size limit can be found in vLLM here: https://github.com/vllm-project/vllm/pull/16283\n\n### Impact\n\nAny system making use of Xgrammar and taking requests as input from potentially untrusted parties would be vulnerable to this denial of service issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "xgrammar" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.18" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-389x-67px-mjg3" + }, + { + "type": "WEB", + "url": "https://github.com/mlc-ai/xgrammar/pull/243" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mlc-ai/xgrammar" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-09T13:08:59Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-44v2-prcf-pc3m/GHSA-44v2-prcf-pc3m.json b/advisories/github-reviewed/2025/04/GHSA-44v2-prcf-pc3m/GHSA-44v2-prcf-pc3m.json new file mode 100644 index 00000000000..927ae05bb04 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-44v2-prcf-pc3m/GHSA-44v2-prcf-pc3m.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-44v2-prcf-pc3m", + "modified": "2025-04-09T13:08:26Z", + "published": "2025-04-08T18:34:43Z", + "aliases": [ + "CVE-2025-25226" + ], + "summary": "Joomla Framework Database Package Vulnerable to SQL Injection", + "details": "Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "joomla/database" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.4.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "joomla/database" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "2.2.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25226" + }, + { + "type": "WEB", + "url": "https://developer.joomla.org/security-centre/963-20250401-framework-sql-injection-vulnerability-in-quotenamestr-method-of-database-package.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/joomla-framework/database" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-09T13:08:26Z", + "nvd_published_at": "2025-04-08T17:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-5pm7-cp8f-p2c2/GHSA-5pm7-cp8f-p2c2.json b/advisories/github-reviewed/2025/04/GHSA-5pm7-cp8f-p2c2/GHSA-5pm7-cp8f-p2c2.json new file mode 100644 index 00000000000..01dc749ee49 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-5pm7-cp8f-p2c2/GHSA-5pm7-cp8f-p2c2.json @@ -0,0 +1,127 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5pm7-cp8f-p2c2", + "modified": "2025-04-09T13:09:26Z", + "published": "2025-04-09T13:09:26Z", + "aliases": [], + "summary": "wallabag/wallabag Has Multiple Cross-Site Request Forgery (CSRF) Vulnerabilities", + "details": "## Impact\n\nwallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could trick the user's browser into performing unintended actions within their wallabag account without their consent. Additionally, one endpoint affects the login page locale setting.\n\nThe affected endpoints allow attackers to potentially perform actions such as:\n\n* **Manage API Tokens:**\n * `/generate-token`\n * `/revoke-token`\n* **Manage User Rules:**\n * `/tagging-rule/delete/{taggingRule}`\n * `/ignore-origin-user-rule/delete/{ignoreOriginUserRule}`\n* **Modify User Configuration:**\n * `/config/view-mode`\n* **Manage Individual Entries:**\n * `/reload/{id}`\n * `/archive/{id}`\n * `/star/{id}`\n * `/delete/{id}`\n * `/share/{id}`\n * `/share/delete/{id}`\n* **Manage Tags:**\n * `/remove-tag/{entry}/{tag}`\n * `/tag/search/{filter}`\n * `/tag/delete/{slug}`\n* **Perform Bulk Actions:**\n * `/mass`\n* **Change Interface Language (Login Page):**\n * `/locale/{language}`\n\nSuccessfully exploiting these vulnerabilities could lead to unauthorized modification or deletion of user data, configuration changes, token manipulation, or interface changes, depending on the specific endpoint targeted.\n\nThis set of vulnerabilities has an aggregated CVSS v3.1 score of 4.3 (Medium).\n\n**Users are strongly advised to upgrade their wallabag instance to version 2.6.11 or later to mitigate these vulnerabilities.**\n\n## Resolution\n\nThese vulnerabilities have been addressed in wallabag version **2.6.11**. The affected endpoints have been modified to require the HTTP POST method along with a valid CSRF token for state-changing actions, preventing attackers from forcing users' browsers to perform these actions unintentionally.\n\n## Credits\n\nFound, reported and fixed by @yguedidi", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "wallabag/wallabag" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.11" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/security/advisories/GHSA-5pm7-cp8f-p2c2" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/edffef837598355c9bec433c469f1e04c35b27cb" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/ed1acf59e166a2a6bb81c52baaeabd6196feae98" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/eb8408b22fbaa6b3d78047d6203b23b7f52bbf03" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/e162408139ac9bb12e69f4d49de45ade49369c21" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/ddf2e808422e41ea55cebf2aa12eb1823c5c340a" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/d703fa6a3a75f7c3b433e8caf618bfb0a9a0ba63" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/d1e128900acc0cb8c88eb7a085c9ef5420cf0c43" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/cf49be694089667bbab9f10d52862fbdba9a89de" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/ac5b5fb379233d6e96ea14ae21b7f88761d5fa3f" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/99c8a06594d6ee7480ce4d041ccff3025b353656" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/6fa61c0f9c48d37625c92a8913b487230761fb47" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/677b2986bc78df4c7ecfed87a24593fa0553fd3c" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/5ea5115a721651f2af349e8451be8947dad9c814" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/3817010e29ed368df271cdd11ec71a46a341c673" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/27f0d94db72fb2a54b5965e4e9908a0f418f44b5" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/264f91126e2c42188b80848c881264da743b4dc1" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/0d8429dfc77b84f50060b253fd84f1c09b892226" + }, + { + "type": "WEB", + "url": "https://github.com/wallabag/wallabag/commit/00d0e6f951927434039465b4d3ae3dd661911172" + }, + { + "type": "PACKAGE", + "url": "https://github.com/wallabag/wallabag" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-09T13:09:26Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-6423-85cc-8gf6/GHSA-6423-85cc-8gf6.json b/advisories/github-reviewed/2025/04/GHSA-6423-85cc-8gf6/GHSA-6423-85cc-8gf6.json new file mode 100644 index 00000000000..237a2f65151 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-6423-85cc-8gf6/GHSA-6423-85cc-8gf6.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6423-85cc-8gf6", + "modified": "2025-04-09T13:08:22Z", + "published": "2025-04-08T18:34:43Z", + "aliases": [ + "CVE-2025-25227" + ], + "summary": "Joomla CMS Multi-Factor Authentication Bypass", + "details": "Insufficient state checks lead to a vector that allows to bypass 2FA checks.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "joomla/joomla-cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "fixed": "5.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "joomla/joomla-cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.4.13" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25227" + }, + { + "type": "WEB", + "url": "https://developer.joomla.org/security-centre/964-20250402-core-mfa-authentication-bypass.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/joomla/joomla-cms" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-09T13:08:22Z", + "nvd_published_at": "2025-04-08T17:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-44v2-prcf-pc3m/GHSA-44v2-prcf-pc3m.json b/advisories/unreviewed/2025/04/GHSA-44v2-prcf-pc3m/GHSA-44v2-prcf-pc3m.json deleted file mode 100644 index 9d9522d1f22..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-44v2-prcf-pc3m/GHSA-44v2-prcf-pc3m.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-44v2-prcf-pc3m", - "modified": "2025-04-08T18:34:43Z", - "published": "2025-04-08T18:34:43Z", - "aliases": [ - "CVE-2025-25226" - ], - "details": "Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25226" - }, - { - "type": "WEB", - "url": "https://developer.joomla.org/security-centre/963-20250401-framework-sql-injection-vulnerability-in-quotenamestr-method-of-database-package.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-89" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-04-08T17:15:35Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-6423-85cc-8gf6/GHSA-6423-85cc-8gf6.json b/advisories/unreviewed/2025/04/GHSA-6423-85cc-8gf6/GHSA-6423-85cc-8gf6.json deleted file mode 100644 index 195c57336bc..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-6423-85cc-8gf6/GHSA-6423-85cc-8gf6.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6423-85cc-8gf6", - "modified": "2025-04-08T21:31:38Z", - "published": "2025-04-08T18:34:43Z", - "aliases": [ - "CVE-2025-25227" - ], - "details": "Insufficient state checks lead to a vector that allows to bypass 2FA checks.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25227" - }, - { - "type": "WEB", - "url": "https://developer.joomla.org/security-centre/964-20250402-core-mfa-authentication-bypass.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-287" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-04-08T17:15:35Z" - } -} \ No newline at end of file