diff --git a/advisories/unreviewed/2024/03/GHSA-36c8-x5g7-w9x4/GHSA-36c8-x5g7-w9x4.json b/advisories/unreviewed/2024/03/GHSA-36c8-x5g7-w9x4/GHSA-36c8-x5g7-w9x4.json index c2c85fec0ad..54465861b2e 100644 --- a/advisories/unreviewed/2024/03/GHSA-36c8-x5g7-w9x4/GHSA-36c8-x5g7-w9x4.json +++ b/advisories/unreviewed/2024/03/GHSA-36c8-x5g7-w9x4/GHSA-36c8-x5g7-w9x4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-36c8-x5g7-w9x4", - "modified": "2024-06-26T00:31:35Z", + "modified": "2025-04-26T21:31:25Z", "published": "2024-03-14T18:30:30Z", "aliases": [ "CVE-2023-28746" @@ -46,6 +46,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/03/12/13" + }, + { + "type": "WEB", + "url": "http://xenbits.xen.org/xsa/advisory-452.html" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/03/GHSA-mxh6-2xpg-m77w/GHSA-mxh6-2xpg-m77w.json b/advisories/unreviewed/2024/03/GHSA-mxh6-2xpg-m77w/GHSA-mxh6-2xpg-m77w.json index 1a764a1948b..ea205269898 100644 --- a/advisories/unreviewed/2024/03/GHSA-mxh6-2xpg-m77w/GHSA-mxh6-2xpg-m77w.json +++ b/advisories/unreviewed/2024/03/GHSA-mxh6-2xpg-m77w/GHSA-mxh6-2xpg-m77w.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mxh6-2xpg-m77w", - "modified": "2024-11-05T21:30:31Z", + "modified": "2025-04-26T21:31:25Z", "published": "2024-03-20T15:32:57Z", "aliases": [ "CVE-2023-46841" ], - "details": "Recent x86 CPUs offer functionality named Control-flow Enforcement\nTechnology (CET). A sub-feature of this are Shadow Stacks (CET-SS).\nCET-SS is a hardware feature designed to protect against Return Oriented\nProgramming attacks. When enabled, traditional stacks holding both data\nand return addresses are accompanied by so called \"shadow stacks\",\nholding little more than return addresses. Shadow stacks aren't\nwritable by normal instructions, and upon function returns their\ncontents are used to check for possible manipulation of a return address\ncoming from the traditional stack.\n\nIn particular certain memory accesses need intercepting by Xen. In\nvarious cases the necessary emulation involves kind of replaying of\nthe instruction. Such replaying typically involves filling and then\ninvoking of a stub. Such a replayed instruction may raise an\nexceptions, which is expected and dealt with accordingly.\n\nUnfortunately the interaction of both of the above wasn't right:\nRecovery involves removal of a call frame from the (traditional) stack.\nThe counterpart of this operation for the shadow stack was missing.\n", + "details": "Recent x86 CPUs offer functionality named Control-flow Enforcement\nTechnology (CET). A sub-feature of this are Shadow Stacks (CET-SS).\nCET-SS is a hardware feature designed to protect against Return Oriented\nProgramming attacks. When enabled, traditional stacks holding both data\nand return addresses are accompanied by so called \"shadow stacks\",\nholding little more than return addresses. Shadow stacks aren't\nwritable by normal instructions, and upon function returns their\ncontents are used to check for possible manipulation of a return address\ncoming from the traditional stack.\n\nIn particular certain memory accesses need intercepting by Xen. In\nvarious cases the necessary emulation involves kind of replaying of\nthe instruction. Such replaying typically involves filling and then\ninvoking of a stub. Such a replayed instruction may raise an\nexceptions, which is expected and dealt with accordingly.\n\nUnfortunately the interaction of both of the above wasn't right:\nRecovery involves removal of a call frame from the (traditional) stack.\nThe counterpart of this operation for the shadow stack was missing.", "severity": [ { "type": "CVSS_V3", @@ -26,6 +26,10 @@ { "type": "WEB", "url": "https://xenbits.xenproject.org/xsa/advisory-451.html" + }, + { + "type": "WEB", + "url": "http://xenbits.xen.org/xsa/advisory-451.html" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/07/GHSA-cjq8-723f-8fmv/GHSA-cjq8-723f-8fmv.json b/advisories/unreviewed/2024/07/GHSA-cjq8-723f-8fmv/GHSA-cjq8-723f-8fmv.json index cf8eb02d8a0..2d5dfd34005 100644 --- a/advisories/unreviewed/2024/07/GHSA-cjq8-723f-8fmv/GHSA-cjq8-723f-8fmv.json +++ b/advisories/unreviewed/2024/07/GHSA-cjq8-723f-8fmv/GHSA-cjq8-723f-8fmv.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cjq8-723f-8fmv", - "modified": "2024-08-21T15:30:50Z", + "modified": "2025-04-26T21:31:26Z", "published": "2024-07-18T15:31:19Z", "aliases": [ "CVE-2024-31143" ], - "details": "An optional feature of PCI MSI called \"Multiple Message\" allows a\ndevice to use multiple consecutive interrupt vectors. Unlike for MSI-X,\nthe setting up of these consecutive vectors needs to happen all in one\ngo. In this handling an error path could be taken in different\nsituations, with or without a particular lock held. This error path\nwrongly releases the lock even when it is not currently held.\n", + "details": "An optional feature of PCI MSI called \"Multiple Message\" allows a\ndevice to use multiple consecutive interrupt vectors. Unlike for MSI-X,\nthe setting up of these consecutive vectors needs to happen all in one\ngo. In this handling an error path could be taken in different\nsituations, with or without a particular lock held. This error path\nwrongly releases the lock even when it is not currently held.", "severity": [ { "type": "CVSS_V3", @@ -22,6 +22,14 @@ { "type": "WEB", "url": "https://xenbits.xenproject.org/xsa/advisory-458.html" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/07/16/3" + }, + { + "type": "WEB", + "url": "http://xenbits.xen.org/xsa/advisory-458.html" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/02/GHSA-fg38-pgj3-5w5f/GHSA-fg38-pgj3-5w5f.json b/advisories/unreviewed/2025/02/GHSA-fg38-pgj3-5w5f/GHSA-fg38-pgj3-5w5f.json index 81e014d92b6..6e0dabdc42e 100644 --- a/advisories/unreviewed/2025/02/GHSA-fg38-pgj3-5w5f/GHSA-fg38-pgj3-5w5f.json +++ b/advisories/unreviewed/2025/02/GHSA-fg38-pgj3-5w5f/GHSA-fg38-pgj3-5w5f.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fg38-pgj3-5w5f", - "modified": "2025-02-18T15:31:07Z", + "modified": "2025-04-26T21:31:26Z", "published": "2025-02-14T21:31:05Z", "aliases": [ "CVE-2024-31144" @@ -26,6 +26,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/07/16/4" + }, + { + "type": "WEB", + "url": "http://xenbits.xen.org/xsa/advisory-459.html" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/04/GHSA-4r7r-xfq3-2r3v/GHSA-4r7r-xfq3-2r3v.json b/advisories/unreviewed/2025/04/GHSA-4r7r-xfq3-2r3v/GHSA-4r7r-xfq3-2r3v.json new file mode 100644 index 00000000000..21659ec87b1 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-4r7r-xfq3-2r3v/GHSA-4r7r-xfq3-2r3v.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4r7r-xfq3-2r3v", + "modified": "2025-04-26T21:31:26Z", + "published": "2025-04-26T21:31:26Z", + "aliases": [ + "CVE-2025-46654" + ], + "details": "CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46654" + }, + { + "type": "WEB", + "url": "https://github.com/hackmdio/codimd/issues/1910" + }, + { + "type": "WEB", + "url": "https://github.com/zast-ai/vulnerability-reports/blob/main/formidable/file_upload/report.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-424" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-26T21:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-64gv-p96g-gqxj/GHSA-64gv-p96g-gqxj.json b/advisories/unreviewed/2025/04/GHSA-64gv-p96g-gqxj/GHSA-64gv-p96g-gqxj.json new file mode 100644 index 00000000000..8f3760a9605 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-64gv-p96g-gqxj/GHSA-64gv-p96g-gqxj.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-64gv-p96g-gqxj", + "modified": "2025-04-26T21:31:26Z", + "published": "2025-04-26T21:31:26Z", + "aliases": [ + "CVE-2025-46655" + ], + "details": "CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted JavaScript content, but the selected architecture within AWS does not have components that are able to insert Content-Security-Policy headers.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46655" + }, + { + "type": "WEB", + "url": "https://github.com/hackmdio/codimd/issues/1910" + }, + { + "type": "WEB", + "url": "https://github.com/zast-ai/vulnerability-reports/blob/main/formidable/file_upload/report.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-424" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-26T21:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-75v8-2h7p-7m2m/GHSA-75v8-2h7p-7m2m.json b/advisories/unreviewed/2025/04/GHSA-75v8-2h7p-7m2m/GHSA-75v8-2h7p-7m2m.json new file mode 100644 index 00000000000..7e9210d1fbe --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-75v8-2h7p-7m2m/GHSA-75v8-2h7p-7m2m.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-75v8-2h7p-7m2m", + "modified": "2025-04-26T21:31:26Z", + "published": "2025-04-26T21:31:26Z", + "aliases": [ + "CVE-2025-46653" + ], + "details": "Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not \"cryptographically secure.\" (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but this is not often relevant.) NOTE: this does not imply that, in a typical use case, attackers will be able to exploit any hexoid behavior to upload and execute their own content.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46653" + }, + { + "type": "WEB", + "url": "https://github.com/node-formidable/formidable/commit/022c2c5577dfe14d2947f10909d81b03b6070bf5" + }, + { + "type": "WEB", + "url": "https://github.com/node-formidable/formidable/blob/d0fbec13edc8add54a1afb9ce1a8d3db803f8d47/CHANGELOG.md?plain=1#L10" + }, + { + "type": "WEB", + "url": "https://github.com/zast-ai/vulnerability-reports/blob/main/formidable/file_upload/report.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-338" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-26T21:15:14Z" + } +} \ No newline at end of file