From e519a75445687c66b7f29ddd1cbc81c99c1615a8 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 21 Apr 2025 21:55:21 +0000 Subject: [PATCH] Publish Advisories GHSA-445m-27cf-gr3x GHSA-vq95-6x79-qv8j GHSA-wvcx-j62q-45qw GHSA-445m-27cf-gr3x --- .../GHSA-445m-27cf-gr3x.json | 61 +++++++++++++++++++ .../GHSA-vq95-6x79-qv8j.json | 37 +++++++++-- .../GHSA-wvcx-j62q-45qw.json | 35 +++++++++-- .../GHSA-445m-27cf-gr3x.json | 29 --------- 4 files changed, 124 insertions(+), 38 deletions(-) create mode 100644 advisories/github-reviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json rename advisories/{unreviewed => github-reviewed}/2025/04/GHSA-vq95-6x79-qv8j/GHSA-vq95-6x79-qv8j.json (51%) rename advisories/{unreviewed => github-reviewed}/2025/04/GHSA-wvcx-j62q-45qw/GHSA-wvcx-j62q-45qw.json (67%) delete mode 100644 advisories/unreviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json diff --git a/advisories/github-reviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json b/advisories/github-reviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json new file mode 100644 index 00000000000..e302340e02c --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-445m-27cf-gr3x", + "modified": "2025-04-21T21:54:24Z", + "published": "2025-04-18T21:31:20Z", + "aliases": [ + "CVE-2025-28197" + ], + "summary": "Crawl4AI SSRF vulnerability", + "details": "Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "Crawl4AI" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.4.247" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28197" + }, + { + "type": "WEB", + "url": "https://gist.github.com/AndrewDzzz/f49e79b09ce0643ee1fc2a829e8875e0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/unclecode/crawl4ai" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-21T21:54:24Z", + "nvd_published_at": "2025-04-18T20:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-vq95-6x79-qv8j/GHSA-vq95-6x79-qv8j.json b/advisories/github-reviewed/2025/04/GHSA-vq95-6x79-qv8j/GHSA-vq95-6x79-qv8j.json similarity index 51% rename from advisories/unreviewed/2025/04/GHSA-vq95-6x79-qv8j/GHSA-vq95-6x79-qv8j.json rename to advisories/github-reviewed/2025/04/GHSA-vq95-6x79-qv8j/GHSA-vq95-6x79-qv8j.json index 8b4ee9346c7..5bf70075a06 100644 --- a/advisories/unreviewed/2025/04/GHSA-vq95-6x79-qv8j/GHSA-vq95-6x79-qv8j.json +++ b/advisories/github-reviewed/2025/04/GHSA-vq95-6x79-qv8j/GHSA-vq95-6x79-qv8j.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vq95-6x79-qv8j", - "modified": "2025-04-18T21:31:19Z", + "modified": "2025-04-21T21:54:11Z", "published": "2025-04-18T18:31:24Z", "aliases": [ "CVE-2024-41447" ], + "summary": "Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability", "details": "A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function.", "severity": [ { @@ -13,12 +14,40 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.opencms:opencms-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "17.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41447" }, + { + "type": "WEB", + "url": "https://github.com/Sidd545-cr/CVE/blob/main/CVE-2024-41447%20-%20Stored%20XSS%20in%20author%20field.pdf" + }, + { + "type": "PACKAGE", + "url": "https://github.com/alkacon/opencms-core" + }, { "type": "WEB", "url": "https://www.exploit-db.com/exploits/52209" @@ -29,8 +58,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-21T21:54:11Z", "nvd_published_at": "2025-04-18T17:15:33Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-wvcx-j62q-45qw/GHSA-wvcx-j62q-45qw.json b/advisories/github-reviewed/2025/04/GHSA-wvcx-j62q-45qw/GHSA-wvcx-j62q-45qw.json similarity index 67% rename from advisories/unreviewed/2025/04/GHSA-wvcx-j62q-45qw/GHSA-wvcx-j62q-45qw.json rename to advisories/github-reviewed/2025/04/GHSA-wvcx-j62q-45qw/GHSA-wvcx-j62q-45qw.json index 374d5d6e7a7..cea8df5b64c 100644 --- a/advisories/unreviewed/2025/04/GHSA-wvcx-j62q-45qw/GHSA-wvcx-j62q-45qw.json +++ b/advisories/github-reviewed/2025/04/GHSA-wvcx-j62q-45qw/GHSA-wvcx-j62q-45qw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wvcx-j62q-45qw", - "modified": "2025-04-19T15:30:23Z", + "modified": "2025-04-21T21:54:52Z", "published": "2025-04-19T15:30:23Z", "aliases": [ "CVE-2025-3801" ], + "summary": "one-api Cross-site Scripting vulnerability", "details": "A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", "severity": [ { @@ -14,15 +15,39 @@ }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/songquanpeng/one-api" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.6.10" + } + ] + } + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3801" }, + { + "type": "PACKAGE", + "url": "https://github.com/songquanpeng/one-api" + }, { "type": "WEB", "url": "https://github.com/yaowenxiao721/Poc/blob/main/One-API/One-API-poc.md" @@ -45,8 +70,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-21T21:54:52Z", "nvd_published_at": "2025-04-19T14:15:38Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json b/advisories/unreviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json deleted file mode 100644 index 58e58fd1115..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-445m-27cf-gr3x/GHSA-445m-27cf-gr3x.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-445m-27cf-gr3x", - "modified": "2025-04-18T21:31:20Z", - "published": "2025-04-18T21:31:20Z", - "aliases": [ - "CVE-2025-28197" - ], - "details": "Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28197" - }, - { - "type": "WEB", - "url": "https://gist.github.com/AndrewDzzz/f49e79b09ce0643ee1fc2a829e8875e0" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-04-18T20:15:16Z" - } -} \ No newline at end of file