netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-x4m2-px5g-5q55
GHSA-jg82-rw7g-6936
GHSA-23x6-43x8-rcvc
GHSA-3gjw-gxfc-mqhv
GHSA-4jjg-vcj3-q93v
GHSA-6fhq-fgj9-wmh6
GHSA-6h54-vm3j-p486
GHSA-7g36-rwff-h8xw
GHSA-8ffh-fmcj-65vx
GHSA-jmqj-768c-pw4r
GHSA-r72r-v289-fm3p
GHSA-rh7c-27w5-qh7x
GHSA-xf37-jxxr-pmvg
This commit is contained in:
advisory-database[bot]
2025-03-08 00:32:50 +00:00
parent 65290d120a
commit e703666bcc
13 changed files with 510 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-x4m2-px5g-5q55/GHSA-x4m2-px5g-5q55.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x4m2-px5g-5q55",
"modified": "2022-07-13T00:01:31Z",
"modified": "2025-03-08T00:31:17Z",
"published": "2022-05-24T19:09:02Z",
"aliases": [
"CVE-2021-36934"
@@ -23,6 +23,10 @@
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/506989"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html"
advisories/unreviewed/2023/03/GHSA-jg82-rw7g-6936/GHSA-jg82-rw7g-6936.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jg82-rw7g-6936",
"modified": "2023-03-13T18:30:42Z",
"modified": "2025-03-08T00:31:19Z",
"published": "2023-03-06T00:30:16Z",
"aliases": [
"CVE-2023-22438"
advisories/unreviewed/2025/03/GHSA-23x6-43x8-rcvc/GHSA-23x6-43x8-rcvc.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-23x6-43x8-rcvc",
"modified": "2025-03-08T00:31:21Z",
"published": "2025-03-08T00:31:21Z",
"aliases": [
"CVE-2025-2096"
],
"details": "A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mode/week/minute/recHour leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2096"
},
{
"type": "WEB",
"url": "https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/OS%20Command%20Injection%2004%20setRebootScheCfg-_mode.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298954"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298954"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.515322"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:39Z"
}
}
advisories/unreviewed/2025/03/GHSA-3gjw-gxfc-mqhv/GHSA-3gjw-gxfc-mqhv.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3gjw-gxfc-mqhv",
"modified": "2025-03-08T00:31:21Z",
"published": "2025-03-08T00:31:21Z",
"aliases": [
"CVE-2025-2094"
],
"details": "A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliKey/key leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2094"
},
{
"type": "WEB",
"url": "https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/OS%20Command%20Injection%2001%20setWiFiExtenderConfig-_apcliKey.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298952"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298952"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.515319"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:38Z"
}
}
advisories/unreviewed/2025/03/GHSA-4jjg-vcj3-q93v/GHSA-4jjg-vcj3-q93v.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jjg-vcj3-q93v",
"modified": "2025-03-08T00:31:20Z",
"published": "2025-03-08T00:31:20Z",
"aliases": [
"CVE-2025-27825"
],
"details": "An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27825"
},
{
"type": "WEB",
"url": "https://backdropcms.org/security/backdrop-sa-contrib-2025-004"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:38Z"
}
}
advisories/unreviewed/2025/03/GHSA-6fhq-fgj9-wmh6/GHSA-6fhq-fgj9-wmh6.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6fhq-fgj9-wmh6",
"modified": "2025-03-08T00:31:20Z",
"published": "2025-03-08T00:31:20Z",
"aliases": [
"CVE-2025-27823"
],
"details": "An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent spambots from collecting them. The module doesn't sufficiently validate the data attribute value on links, potentially leading to a Cross Site Scripting (XSS) vulnerability. This is mitigated by the fact an attacker must be able to insert link (<a>) HTML elements containing data attributes into the page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27823"
},
{
"type": "WEB",
"url": "https://backdropcms.org/security/backdrop-sa-contrib-2025-007"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:38Z"
}
}
advisories/unreviewed/2025/03/GHSA-6h54-vm3j-p486/GHSA-6h54-vm3j-p486.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6h54-vm3j-p486",
"modified": "2025-03-08T00:31:20Z",
"published": "2025-03-08T00:31:20Z",
"aliases": [
"CVE-2025-27822"
],
"details": "An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module provides a \"Masquerade as admin\" permission to restrict people (who can masquerade) from switching to an account with administrative privileges. This permission is not always honored and may allow non-administrative users to masquerade as an administrator. This vulnerability is mitigated by the fact that an attacker must have a role with the \"Masquerade as user\" permission.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27822"
},
{
"type": "WEB",
"url": "https://backdropcms.org/security/backdrop-sa-contrib-2025-006"
}
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:37Z"
}
}
advisories/unreviewed/2025/03/GHSA-7g36-rwff-h8xw/GHSA-7g36-rwff-h8xw.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7g36-rwff-h8xw",
"modified": "2025-03-08T00:31:22Z",
"published": "2025-03-08T00:31:21Z",
"aliases": [
"CVE-2025-2097"
],
"details": "A vulnerability, which was classified as critical, has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This issue affects the function setRptWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument loginpass leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2097"
},
{
"type": "WEB",
"url": "https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/Stack-based%20Buffer%20Overflow%2001%20setRptWizardCfg-_loginpass.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298955"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298955"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.515326"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T23:15:16Z"
}
}
advisories/unreviewed/2025/03/GHSA-8ffh-fmcj-65vx/GHSA-8ffh-fmcj-65vx.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8ffh-fmcj-65vx",
"modified": "2025-03-08T00:31:21Z",
"published": "2025-03-08T00:31:21Z",
"aliases": [
"CVE-2025-27826"
],
"details": "An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27826"
},
{
"type": "WEB",
"url": "https://backdropcms.org/security/backdrop-sa-core-2025-005"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:38Z"
}
}
advisories/unreviewed/2025/03/GHSA-jmqj-768c-pw4r/GHSA-jmqj-768c-pw4r.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jmqj-768c-pw4r",
"modified": "2025-03-08T00:31:22Z",
"published": "2025-03-08T00:31:22Z",
"aliases": [
"CVE-2025-27839"
],
"details": "operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27839"
},
{
"type": "WEB",
"url": "https://github.com/tangem/tangem-sdk-android/commit/24588188fdb51ed469cd59d2c595128c1fe63b07"
},
{
"type": "WEB",
"url": "https://github.com/tangem/tangem-sdk-android/releases/tag/release-app_5.18-409"
},
{
"type": "WEB",
"url": "https://tangem.com/en/blog/post/app-update"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1025"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-08T00:15:38Z"
}
}
advisories/unreviewed/2025/03/GHSA-r72r-v289-fm3p/GHSA-r72r-v289-fm3p.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r72r-v289-fm3p",
"modified": "2025-03-08T00:31:21Z",
"published": "2025-03-08T00:31:21Z",
"aliases": [
"CVE-2025-2095"
],
"details": "A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2095"
},
{
"type": "WEB",
"url": "https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/OS%20Command%20Injection%2003%20setDmzCfg-_ip.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298953"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298953"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.515321"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:39Z"
}
}
advisories/unreviewed/2025/03/GHSA-rh7c-27w5-qh7x/GHSA-rh7c-27w5-qh7x.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rh7c-27w5-qh7x",
"modified": "2025-03-08T00:31:21Z",
"published": "2025-03-08T00:31:21Z",
"aliases": [
"CVE-2025-2093"
],
"details": "A vulnerability was found in PHPGurukul Online Library Management System 3.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /change-password.php. The manipulation of the argument email/phone number leads to weak password recovery. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2093"
},
{
"type": "WEB",
"url": "https://github.com/SECWG/cve/issues/4"
},
{
"type": "WEB",
"url": "https://phpgurukul.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.298951"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.298951"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.515207"
}
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:38Z"
}
}
advisories/unreviewed/2025/03/GHSA-xf37-jxxr-pmvg/GHSA-xf37-jxxr-pmvg.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xf37-jxxr-pmvg",
"modified": "2025-03-08T00:31:20Z",
"published": "2025-03-08T00:31:20Z",
"aliases": [
"CVE-2025-27824"
],
"details": "An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an iFrame field.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27824"
},
{
"type": "WEB",
"url": "https://backdropcms.org/security/backdrop-sa-contrib-2025-003"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T22:15:38Z"
}
}