netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-445m-27cf-gr3x
GHSA-vq95-6x79-qv8j
GHSA-wvcx-j62q-45qw
GHSA-445m-27cf-gr3x
This commit is contained in:
advisory-database[bot]
2025-04-21 21:55:21 +00:00
parent e09e1313fe
commit e519a75445
4 changed files with 124 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-445m-27cf-gr3x",
"modified": "2025-04-21T21:54:24Z",
"published": "2025-04-18T21:31:20Z",
"aliases": [
"CVE-2025-28197"
],
"summary": "Crawl4AI SSRF vulnerability",
"details": "Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Crawl4AI"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.4.247"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28197"
},
{
"type": "WEB",
"url": "https://gist.github.com/AndrewDzzz/f49e79b09ce0643ee1fc2a829e8875e0"
},
{
"type": "PACKAGE",
"url": "https://github.com/unclecode/crawl4ai"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-04-21T21:54:24Z",
"nvd_published_at": "2025-04-18T20:15:16Z"
}
}
advisories/unreviewed/2025/04/GHSA-vq95-6x79-qv8j/GHSA-vq95-6x79-qv8j.json → advisories/github-reviewed/2025/04/GHSA-vq95-6x79-qv8j/GHSA-vq95-6x79-qv8j.json
+33 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vq95-6x79-qv8j",
"modified": "2025-04-18T21:31:19Z",
"modified": "2025-04-21T21:54:11Z",
"published": "2025-04-18T18:31:24Z",
"aliases": [
"CVE-2024-41447"
],
"summary": "Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability",
"details": "A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function.",
"severity": [
{
@@ -13,12 +14,40 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.opencms:opencms-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "17.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41447"
},
{
"type": "WEB",
"url": "https://github.com/Sidd545-cr/CVE/blob/main/CVE-2024-41447%20-%20Stored%20XSS%20in%20author%20field.pdf"
},
{
"type": "PACKAGE",
"url": "https://github.com/alkacon/opencms-core"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/52209"
@@ -29,8 +58,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-21T21:54:11Z",
"nvd_published_at": "2025-04-18T17:15:33Z"
}
}
advisories/unreviewed/2025/04/GHSA-wvcx-j62q-45qw/GHSA-wvcx-j62q-45qw.json → advisories/github-reviewed/2025/04/GHSA-wvcx-j62q-45qw/GHSA-wvcx-j62q-45qw.json
+30 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wvcx-j62q-45qw",
"modified": "2025-04-19T15:30:23Z",
"modified": "2025-04-21T21:54:52Z",
"published": "2025-04-19T15:30:23Z",
"aliases": [
"CVE-2025-3801"
],
"summary": "one-api Cross-site Scripting vulnerability",
"details": "A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
@@ -14,15 +15,39 @@
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/songquanpeng/one-api"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.6.10"
}
]
}
]
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3801"
},
{
"type": "PACKAGE",
"url": "https://github.com/songquanpeng/one-api"
},
{
"type": "WEB",
"url": "https://github.com/yaowenxiao721/Poc/blob/main/One-API/One-API-poc.md"
@@ -45,8 +70,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-21T21:54:52Z",
"nvd_published_at": "2025-04-19T14:15:38Z"
}
}
advisories/unreviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json
-29
View File
@@ -1,29 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-445m-27cf-gr3x",
"modified": "2025-04-18T21:31:20Z",
"published": "2025-04-18T21:31:20Z",
"aliases": [
"CVE-2025-28197"
],
"details": "Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28197"
},
{
"type": "WEB",
"url": "https://gist.github.com/AndrewDzzz/f49e79b09ce0643ee1fc2a829e8875e0"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-18T20:15:16Z"
}
}