Publish Advisories

GHSA-fh88-2p7h-7g9h GHSA-3vvh-6qrh-25vg GHSA-67h2-pfm2-j5q5 GHSA-9qvj-ffh9-wpg4 GHSA-39m5-v8xj-6c9r GHSA-g5qj-pfmg-p3jp GHSA-555q-7wq3-w6ch GHSA-75x9-5mr4-583v GHSA-7xmr-c34w-p9w7 GHSA-9pmh-gp9r-2wrj GHSA-c9fq-7ph4-v5cv GHSA-cj9r-cvpx-fx3h GHSA-gf34-2fpp-vmc4 GHSA-gpj5-h9pc-v6jc GHSA-h7h9-grcq-c72m GHSA-mq7g-cwjx-j964 GHSA-pm9m-75p4-7h69 GHSA-pw24-qqc3-7vpx GHSA-qw73-x9xv-6cch GHSA-vc27-49rw-f322 GHSA-vcqr-f63g-v876 GHSA-vxf4-hr69-67w5 GHSA-w8w2-83mf-6cp5 GHSA-wwmx-66w6-2p5v
2026-05-22 18:04:22 -07:00 · 2025-01-30 00:32:06 +00:00
parent 17822aa917
commit ed4c15dc5f
24 changed files with 633 additions and 8 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fh88-2p7h-7g9h",
-  "modified": "2023-08-08T15:31:37Z",
+  "modified": "2025-01-30T00:31:03Z",
  "published": "2022-02-10T00:00:32Z",
  "aliases": [
    "CVE-2022-24682"
@@ -42,6 +42,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-116",
      "CWE-79"
    ],
    "severity": "MODERATE",
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-922"
+    ],
    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-67h2-pfm2-j5q5",
-  "modified": "2024-05-17T00:31:00Z",
+  "modified": "2025-01-30T00:31:03Z",
  "published": "2024-05-17T00:31:00Z",
  "aliases": [
    "CVE-2024-3134"
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -37,7 +37,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-39m5-v8xj-6c9r",
-  "modified": "2024-07-25T18:32:36Z",
+  "modified": "2025-01-30T00:31:03Z",
  "published": "2024-07-24T18:31:17Z",
  "aliases": [
    "CVE-2024-40422"
@@ -30,6 +30,10 @@
    {
      "type": "WEB",
      "url": "https://github.com/stitionai/devika"
+    },
+    {
+      "type": "WEB",
+      "url": "https://medium.com/@alpernae/uncovering-path-traversal-in-devika-v1-a-deep-dive-into-cve-2024-40422-f8ce81398b99"
    }
  ],
  "database_specific": {
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g5qj-pfmg-p3jp",
-  "modified": "2024-09-11T18:31:02Z",
+  "modified": "2025-01-30T00:31:03Z",
  "published": "2024-07-02T21:32:15Z",
  "aliases": [
    "CVE-2024-39894"
@@ -35,6 +35,10 @@
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240712-0004"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-25:01.openssh.asc"
+    },
    {
      "type": "WEB",
      "url": "https://www.openssh.com/txt/release-9.8"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-555q-7wq3-w6ch",
-  "modified": "2025-01-29T21:31:24Z",
+  "modified": "2025-01-30T00:31:03Z",
  "published": "2025-01-28T18:31:28Z",
  "aliases": [
    "CVE-2025-0781"
@@ -34,6 +34,10 @@
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00028.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00029.html"
    }
  ],
  "database_specific": {
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-75x9-5mr4-583v",
+  "modified": "2025-01-30T00:31:04Z",
+  "published": "2025-01-30T00:31:04Z",
+  "aliases": [
+    "CVE-2024-57665"
+  ],
+  "details": "JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is controllable and is concatenated directly into filterSql without filtering.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57665"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Nbccccc/vulnerability_discovery/blob/main/JFinalCMS/JFinalCms%20SQL%20Injection.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T23:15:22Z"
+  }
+}
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7xmr-c34w-p9w7",
+  "modified": "2025-01-30T00:31:04Z",
+  "published": "2025-01-30T00:31:03Z",
+  "aliases": [
+    "CVE-2024-54851"
+  ],
+  "details": "Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54851"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54851/README.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T22:15:29Z"
+  }
+}
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9pmh-gp9r-2wrj",
+  "modified": "2025-01-30T00:31:03Z",
+  "published": "2025-01-30T00:31:03Z",
+  "aliases": [
+    "CVE-2024-51182"
+  ],
+  "details": "HTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary HTML code via the \"erro\" parameter.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51182"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-51182"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T22:15:29Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c9fq-7ph4-v5cv",
+  "modified": "2025-01-30T00:31:05Z",
+  "published": "2025-01-30T00:31:05Z",
+  "aliases": [
+    "CVE-2025-0844"
+  ],
+  "details": "A vulnerability was found in needyamin Library Card System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file signup.php of the component Registration Page. The manipulation of the argument firstname/lastname/email/borrow/user_address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0844"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.294001"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.294001"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.485558"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.websecurityinsights.my.id/2025/01/library-card-system-stored-cross-site.html?m=1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T00:15:41Z"
+  }
+}
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cj9r-cvpx-fx3h",
+  "modified": "2025-01-30T00:31:04Z",
+  "published": "2025-01-30T00:31:04Z",
+  "aliases": [
+    "CVE-2024-57510"
+  ],
+  "details": "Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57510"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/axiomatic-systems/Bento4/issues/989"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/G2FUZZ/91a1cc3b8f2b0720e984353d59023b24"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T22:15:29Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gf34-2fpp-vmc4",
+  "modified": "2025-01-30T00:31:03Z",
+  "published": "2025-01-30T00:31:03Z",
+  "aliases": [
+    "CVE-2024-12705"
+  ],
+  "details": "Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12705"
+    },
+    {
+      "type": "WEB",
+      "url": "https://kb.isc.org/docs/cve-2024-12705"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-770"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T22:15:28Z"
+  }
+}
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gpj5-h9pc-v6jc",
+  "modified": "2025-01-30T00:31:03Z",
+  "published": "2025-01-30T00:31:03Z",
+  "aliases": [
+    "CVE-2024-48761"
+  ],
+  "details": "The specific component in Celk Saude 3.1.252.1 that processes user input and returns error messages to the client is vulnerable due to improper validation or sanitization of the \"erro\" parameter. This parameter appears as a response when incorrect credentials are entered during login. The lack of proper validation or sanitization makes the component susceptible to injection attacks, potentially allowing attackers to manipulate the input and exploit the system.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48761"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-48761"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T22:15:29Z"
+  }
+}
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h7h9-grcq-c72m",
+  "modified": "2025-01-30T00:31:04Z",
+  "published": "2025-01-30T00:31:04Z",
+  "aliases": [
+    "CVE-2024-57509"
+  ],
+  "details": "Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_File::ParseStream and related functions.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57509"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/axiomatic-systems/Bento4/issues/989"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/G2FUZZ/91a1cc3b8f2b0720e984353d59023b24"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T22:15:29Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mq7g-cwjx-j964",
+  "modified": "2025-01-30T00:31:04Z",
+  "published": "2025-01-30T00:31:04Z",
+  "aliases": [
+    "CVE-2025-0843"
+  ],
+  "details": "A vulnerability was found in needyamin Library Card System 1.0. It has been classified as critical. Affected is an unknown function of the file admindashboard.php of the component Admin Panel. The manipulation of the argument email/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0843"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.294000"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.294000"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.485553"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.websecurityinsights.my.id/2025/01/library-card-system-admin-login-bypass.html?m=1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T23:15:23Z"
+  }
+}
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pm9m-75p4-7h69",
+  "modified": "2025-01-30T00:31:04Z",
+  "published": "2025-01-30T00:31:04Z",
+  "aliases": [
+    "CVE-2024-54852"
+  ],
+  "details": "When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54852"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T22:15:29Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pw24-qqc3-7vpx",
+  "modified": "2025-01-30T00:31:04Z",
+  "published": "2025-01-30T00:31:04Z",
+  "aliases": [
+    "CVE-2025-21415"
+  ],
+  "details": "Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21415"
+    },
+    {
+      "type": "WEB",
+      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21415"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-290"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T23:15:33Z"
+  }
+}
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qw73-x9xv-6cch",
+  "modified": "2025-01-30T00:31:04Z",
+  "published": "2025-01-30T00:31:04Z",
+  "aliases": [
+    "CVE-2024-57395"
+  ],
+  "details": "Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain sensitive information via the password and account number parameters.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57395"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/qtxz54/Vul/blob/main/WeakPasswd/Safety-production-process-management-system.md"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.hzzcka.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T22:15:29Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vc27-49rw-f322",
+  "modified": "2025-01-30T00:31:04Z",
+  "published": "2025-01-30T00:31:04Z",
+  "aliases": [
+    "CVE-2025-0842"
+  ],
+  "details": "A vulnerability was found in needyamin Library Card System 1.0 and classified as critical. This issue affects some unknown processing of the file admin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0842"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.293999"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.293999"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.485540"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.websecurityinsights.my.id/2025/01/library-card-system-admin-login-bypass.html?m=1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-29T22:15:30Z"
+  }
+}
--- a/Show More
+++ b/Show More