diff --git a/advisories/unreviewed/2022/02/GHSA-fh88-2p7h-7g9h/GHSA-fh88-2p7h-7g9h.json b/advisories/unreviewed/2022/02/GHSA-fh88-2p7h-7g9h/GHSA-fh88-2p7h-7g9h.json index a523bb58be0..0804eeeb2aa 100644 --- a/advisories/unreviewed/2022/02/GHSA-fh88-2p7h-7g9h/GHSA-fh88-2p7h-7g9h.json +++ b/advisories/unreviewed/2022/02/GHSA-fh88-2p7h-7g9h/GHSA-fh88-2p7h-7g9h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fh88-2p7h-7g9h", - "modified": "2023-08-08T15:31:37Z", + "modified": "2025-01-30T00:31:03Z", "published": "2022-02-10T00:00:32Z", "aliases": [ "CVE-2022-24682" @@ -42,6 +42,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-116", "CWE-79" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2022/11/GHSA-3vvh-6qrh-25vg/GHSA-3vvh-6qrh-25vg.json b/advisories/unreviewed/2022/11/GHSA-3vvh-6qrh-25vg/GHSA-3vvh-6qrh-25vg.json index d61d8ee3785..5174c7fc477 100644 --- a/advisories/unreviewed/2022/11/GHSA-3vvh-6qrh-25vg/GHSA-3vvh-6qrh-25vg.json +++ b/advisories/unreviewed/2022/11/GHSA-3vvh-6qrh-25vg/GHSA-3vvh-6qrh-25vg.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-922" + ], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/05/GHSA-67h2-pfm2-j5q5/GHSA-67h2-pfm2-j5q5.json b/advisories/unreviewed/2024/05/GHSA-67h2-pfm2-j5q5/GHSA-67h2-pfm2-j5q5.json index 96728a44a13..ff0928b8cce 100644 --- a/advisories/unreviewed/2024/05/GHSA-67h2-pfm2-j5q5/GHSA-67h2-pfm2-j5q5.json +++ b/advisories/unreviewed/2024/05/GHSA-67h2-pfm2-j5q5/GHSA-67h2-pfm2-j5q5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-67h2-pfm2-j5q5", - "modified": "2024-05-17T00:31:00Z", + "modified": "2025-01-30T00:31:03Z", "published": "2024-05-17T00:31:00Z", "aliases": [ "CVE-2024-3134" @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/05/GHSA-9qvj-ffh9-wpg4/GHSA-9qvj-ffh9-wpg4.json b/advisories/unreviewed/2024/05/GHSA-9qvj-ffh9-wpg4/GHSA-9qvj-ffh9-wpg4.json index 8c365a378a8..7df1e352f50 100644 --- a/advisories/unreviewed/2024/05/GHSA-9qvj-ffh9-wpg4/GHSA-9qvj-ffh9-wpg4.json +++ b/advisories/unreviewed/2024/05/GHSA-9qvj-ffh9-wpg4/GHSA-9qvj-ffh9-wpg4.json @@ -37,7 +37,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-39m5-v8xj-6c9r/GHSA-39m5-v8xj-6c9r.json b/advisories/unreviewed/2024/07/GHSA-39m5-v8xj-6c9r/GHSA-39m5-v8xj-6c9r.json index df25a6e25b5..3aba9944d56 100644 --- a/advisories/unreviewed/2024/07/GHSA-39m5-v8xj-6c9r/GHSA-39m5-v8xj-6c9r.json +++ b/advisories/unreviewed/2024/07/GHSA-39m5-v8xj-6c9r/GHSA-39m5-v8xj-6c9r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-39m5-v8xj-6c9r", - "modified": "2024-07-25T18:32:36Z", + "modified": "2025-01-30T00:31:03Z", "published": "2024-07-24T18:31:17Z", "aliases": [ "CVE-2024-40422" @@ -30,6 +30,10 @@ { "type": "WEB", "url": "https://github.com/stitionai/devika" + }, + { + "type": "WEB", + "url": "https://medium.com/@alpernae/uncovering-path-traversal-in-devika-v1-a-deep-dive-into-cve-2024-40422-f8ce81398b99" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/07/GHSA-g5qj-pfmg-p3jp/GHSA-g5qj-pfmg-p3jp.json b/advisories/unreviewed/2024/07/GHSA-g5qj-pfmg-p3jp/GHSA-g5qj-pfmg-p3jp.json index 4e3291d1576..18f1f25acbb 100644 --- a/advisories/unreviewed/2024/07/GHSA-g5qj-pfmg-p3jp/GHSA-g5qj-pfmg-p3jp.json +++ b/advisories/unreviewed/2024/07/GHSA-g5qj-pfmg-p3jp/GHSA-g5qj-pfmg-p3jp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g5qj-pfmg-p3jp", - "modified": "2024-09-11T18:31:02Z", + "modified": "2025-01-30T00:31:03Z", "published": "2024-07-02T21:32:15Z", "aliases": [ "CVE-2024-39894" @@ -35,6 +35,10 @@ "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20240712-0004" }, + { + "type": "WEB", + "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-25:01.openssh.asc" + }, { "type": "WEB", "url": "https://www.openssh.com/txt/release-9.8" diff --git a/advisories/unreviewed/2025/01/GHSA-555q-7wq3-w6ch/GHSA-555q-7wq3-w6ch.json b/advisories/unreviewed/2025/01/GHSA-555q-7wq3-w6ch/GHSA-555q-7wq3-w6ch.json index e4c929c756b..4d528a2b15c 100644 --- a/advisories/unreviewed/2025/01/GHSA-555q-7wq3-w6ch/GHSA-555q-7wq3-w6ch.json +++ b/advisories/unreviewed/2025/01/GHSA-555q-7wq3-w6ch/GHSA-555q-7wq3-w6ch.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-555q-7wq3-w6ch", - "modified": "2025-01-29T21:31:24Z", + "modified": "2025-01-30T00:31:03Z", "published": "2025-01-28T18:31:28Z", "aliases": [ "CVE-2025-0781" @@ -34,6 +34,10 @@ { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00028.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00029.html" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/01/GHSA-75x9-5mr4-583v/GHSA-75x9-5mr4-583v.json b/advisories/unreviewed/2025/01/GHSA-75x9-5mr4-583v/GHSA-75x9-5mr4-583v.json new file mode 100644 index 00000000000..e704ce7395d --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-75x9-5mr4-583v/GHSA-75x9-5mr4-583v.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-75x9-5mr4-583v", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2024-57665" + ], + "details": "JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is controllable and is concatenated directly into filterSql without filtering.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57665" + }, + { + "type": "WEB", + "url": "https://github.com/Nbccccc/vulnerability_discovery/blob/main/JFinalCMS/JFinalCms%20SQL%20Injection.md" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T23:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-7xmr-c34w-p9w7/GHSA-7xmr-c34w-p9w7.json b/advisories/unreviewed/2025/01/GHSA-7xmr-c34w-p9w7/GHSA-7xmr-c34w-p9w7.json new file mode 100644 index 00000000000..bb2a692a356 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-7xmr-c34w-p9w7/GHSA-7xmr-c34w-p9w7.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7xmr-c34w-p9w7", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:03Z", + "aliases": [ + "CVE-2024-54851" + ], + "details": "Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54851" + }, + { + "type": "WEB", + "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54851/README.md" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-9pmh-gp9r-2wrj/GHSA-9pmh-gp9r-2wrj.json b/advisories/unreviewed/2025/01/GHSA-9pmh-gp9r-2wrj/GHSA-9pmh-gp9r-2wrj.json new file mode 100644 index 00000000000..c52b24d2c96 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-9pmh-gp9r-2wrj/GHSA-9pmh-gp9r-2wrj.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9pmh-gp9r-2wrj", + "modified": "2025-01-30T00:31:03Z", + "published": "2025-01-30T00:31:03Z", + "aliases": [ + "CVE-2024-51182" + ], + "details": "HTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary HTML code via the \"erro\" parameter.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51182" + }, + { + "type": "WEB", + "url": "https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-51182" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-c9fq-7ph4-v5cv/GHSA-c9fq-7ph4-v5cv.json b/advisories/unreviewed/2025/01/GHSA-c9fq-7ph4-v5cv/GHSA-c9fq-7ph4-v5cv.json new file mode 100644 index 00000000000..ee43913275e --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-c9fq-7ph4-v5cv/GHSA-c9fq-7ph4-v5cv.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c9fq-7ph4-v5cv", + "modified": "2025-01-30T00:31:05Z", + "published": "2025-01-30T00:31:05Z", + "aliases": [ + "CVE-2025-0844" + ], + "details": "A vulnerability was found in needyamin Library Card System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file signup.php of the component Registration Page. The manipulation of the argument firstname/lastname/email/borrow/user_address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0844" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.294001" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.294001" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.485558" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/01/library-card-system-stored-cross-site.html?m=1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-30T00:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-cj9r-cvpx-fx3h/GHSA-cj9r-cvpx-fx3h.json b/advisories/unreviewed/2025/01/GHSA-cj9r-cvpx-fx3h/GHSA-cj9r-cvpx-fx3h.json new file mode 100644 index 00000000000..4337090421d --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-cj9r-cvpx-fx3h/GHSA-cj9r-cvpx-fx3h.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cj9r-cvpx-fx3h", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2024-57510" + ], + "details": "Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57510" + }, + { + "type": "WEB", + "url": "https://github.com/axiomatic-systems/Bento4/issues/989" + }, + { + "type": "WEB", + "url": "https://gist.github.com/G2FUZZ/91a1cc3b8f2b0720e984353d59023b24" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-gf34-2fpp-vmc4/GHSA-gf34-2fpp-vmc4.json b/advisories/unreviewed/2025/01/GHSA-gf34-2fpp-vmc4/GHSA-gf34-2fpp-vmc4.json new file mode 100644 index 00000000000..31d472f6372 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-gf34-2fpp-vmc4/GHSA-gf34-2fpp-vmc4.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gf34-2fpp-vmc4", + "modified": "2025-01-30T00:31:03Z", + "published": "2025-01-30T00:31:03Z", + "aliases": [ + "CVE-2024-12705" + ], + "details": "Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12705" + }, + { + "type": "WEB", + "url": "https://kb.isc.org/docs/cve-2024-12705" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-gpj5-h9pc-v6jc/GHSA-gpj5-h9pc-v6jc.json b/advisories/unreviewed/2025/01/GHSA-gpj5-h9pc-v6jc/GHSA-gpj5-h9pc-v6jc.json new file mode 100644 index 00000000000..e193bbeb494 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-gpj5-h9pc-v6jc/GHSA-gpj5-h9pc-v6jc.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gpj5-h9pc-v6jc", + "modified": "2025-01-30T00:31:03Z", + "published": "2025-01-30T00:31:03Z", + "aliases": [ + "CVE-2024-48761" + ], + "details": "The specific component in Celk Saude 3.1.252.1 that processes user input and returns error messages to the client is vulnerable due to improper validation or sanitization of the \"erro\" parameter. This parameter appears as a response when incorrect credentials are entered during login. The lack of proper validation or sanitization makes the component susceptible to injection attacks, potentially allowing attackers to manipulate the input and exploit the system.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48761" + }, + { + "type": "WEB", + "url": "https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-48761" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-h7h9-grcq-c72m/GHSA-h7h9-grcq-c72m.json b/advisories/unreviewed/2025/01/GHSA-h7h9-grcq-c72m/GHSA-h7h9-grcq-c72m.json new file mode 100644 index 00000000000..99949d170af --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-h7h9-grcq-c72m/GHSA-h7h9-grcq-c72m.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h7h9-grcq-c72m", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2024-57509" + ], + "details": "Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code via the AP4_File::ParseStream and related functions.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57509" + }, + { + "type": "WEB", + "url": "https://github.com/axiomatic-systems/Bento4/issues/989" + }, + { + "type": "WEB", + "url": "https://gist.github.com/G2FUZZ/91a1cc3b8f2b0720e984353d59023b24" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-mq7g-cwjx-j964/GHSA-mq7g-cwjx-j964.json b/advisories/unreviewed/2025/01/GHSA-mq7g-cwjx-j964/GHSA-mq7g-cwjx-j964.json new file mode 100644 index 00000000000..18345cda250 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-mq7g-cwjx-j964/GHSA-mq7g-cwjx-j964.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mq7g-cwjx-j964", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2025-0843" + ], + "details": "A vulnerability was found in needyamin Library Card System 1.0. It has been classified as critical. Affected is an unknown function of the file admindashboard.php of the component Admin Panel. The manipulation of the argument email/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0843" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.294000" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.294000" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.485553" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/01/library-card-system-admin-login-bypass.html?m=1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T23:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-pm9m-75p4-7h69/GHSA-pm9m-75p4-7h69.json b/advisories/unreviewed/2025/01/GHSA-pm9m-75p4-7h69/GHSA-pm9m-75p4-7h69.json new file mode 100644 index 00000000000..511e75ea937 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-pm9m-75p4-7h69/GHSA-pm9m-75p4-7h69.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pm9m-75p4-7h69", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2024-54852" + ], + "details": "When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54852" + }, + { + "type": "WEB", + "url": "https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54852/README.md" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-pw24-qqc3-7vpx/GHSA-pw24-qqc3-7vpx.json b/advisories/unreviewed/2025/01/GHSA-pw24-qqc3-7vpx/GHSA-pw24-qqc3-7vpx.json new file mode 100644 index 00000000000..aaeb0762b79 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-pw24-qqc3-7vpx/GHSA-pw24-qqc3-7vpx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pw24-qqc3-7vpx", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2025-21415" + ], + "details": "Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21415" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21415" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-290" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T23:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-qw73-x9xv-6cch/GHSA-qw73-x9xv-6cch.json b/advisories/unreviewed/2025/01/GHSA-qw73-x9xv-6cch/GHSA-qw73-x9xv-6cch.json new file mode 100644 index 00000000000..049ed5e5e8b --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-qw73-x9xv-6cch/GHSA-qw73-x9xv-6cch.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qw73-x9xv-6cch", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2024-57395" + ], + "details": "Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain sensitive information via the password and account number parameters.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57395" + }, + { + "type": "WEB", + "url": "https://github.com/qtxz54/Vul/blob/main/WeakPasswd/Safety-production-process-management-system.md" + }, + { + "type": "WEB", + "url": "http://www.hzzcka.com" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-vc27-49rw-f322/GHSA-vc27-49rw-f322.json b/advisories/unreviewed/2025/01/GHSA-vc27-49rw-f322/GHSA-vc27-49rw-f322.json new file mode 100644 index 00000000000..5e264dbf1d3 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-vc27-49rw-f322/GHSA-vc27-49rw-f322.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vc27-49rw-f322", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2025-0842" + ], + "details": "A vulnerability was found in needyamin Library Card System 1.0 and classified as critical. This issue affects some unknown processing of the file admin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0842" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.293999" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.293999" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.485540" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/01/library-card-system-admin-login-bypass.html?m=1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-vcqr-f63g-v876/GHSA-vcqr-f63g-v876.json b/advisories/unreviewed/2025/01/GHSA-vcqr-f63g-v876/GHSA-vcqr-f63g-v876.json new file mode 100644 index 00000000000..81382c02f61 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-vcqr-f63g-v876/GHSA-vcqr-f63g-v876.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vcqr-f63g-v876", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2025-21396" + ], + "details": "Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21396" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21396" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T23:15:32Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-vxf4-hr69-67w5/GHSA-vxf4-hr69-67w5.json b/advisories/unreviewed/2025/01/GHSA-vxf4-hr69-67w5/GHSA-vxf4-hr69-67w5.json new file mode 100644 index 00000000000..233e7ad4d2d --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-vxf4-hr69-67w5/GHSA-vxf4-hr69-67w5.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vxf4-hr69-67w5", + "modified": "2025-01-30T00:31:03Z", + "published": "2025-01-30T00:31:03Z", + "aliases": [ + "CVE-2024-23733" + ], + "details": "The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23733" + }, + { + "type": "WEB", + "url": "https://github.com/ekcrsm/CVE-2024-23733/tree/main" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-w8w2-83mf-6cp5/GHSA-w8w2-83mf-6cp5.json b/advisories/unreviewed/2025/01/GHSA-w8w2-83mf-6cp5/GHSA-w8w2-83mf-6cp5.json new file mode 100644 index 00000000000..22839455523 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-w8w2-83mf-6cp5/GHSA-w8w2-83mf-6cp5.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w8w2-83mf-6cp5", + "modified": "2025-01-30T00:31:03Z", + "published": "2025-01-30T00:31:03Z", + "aliases": [ + "CVE-2024-11187" + ], + "details": "It is possible to construct a zone such that some queries to it will generate responses containing numerous records in the Additional section. An attacker sending many such queries can cause either the authoritative server itself or an independent resolver to use disproportionate resources processing the queries. Zones will usually need to have been deliberately crafted to attack this exposure.\nThis issue affects BIND 9 versions 9.11.0 through 9.11.37, 9.16.0 through 9.16.50, 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.50-S1, and 9.18.11-S1 through 9.18.32-S1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11187" + }, + { + "type": "WEB", + "url": "https://kb.isc.org/docs/cve-2024-11187" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-405" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-wwmx-66w6-2p5v/GHSA-wwmx-66w6-2p5v.json b/advisories/unreviewed/2025/01/GHSA-wwmx-66w6-2p5v/GHSA-wwmx-66w6-2p5v.json new file mode 100644 index 00000000000..48259833c43 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-wwmx-66w6-2p5v/GHSA-wwmx-66w6-2p5v.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wwmx-66w6-2p5v", + "modified": "2025-01-30T00:31:04Z", + "published": "2025-01-30T00:31:04Z", + "aliases": [ + "CVE-2024-57513" + ], + "details": "A floating-point exception (FPE) vulnerability exists in the AP4_TfraAtom::AP4_TfraAtom function in Bento4.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57513" + }, + { + "type": "WEB", + "url": "https://github.com/axiomatic-systems/Bento4/issues/990" + }, + { + "type": "WEB", + "url": "https://gist.github.com/G2FUZZ/91a1cc3b8f2b0720e984353d59023b24" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T22:15:30Z" + } +} \ No newline at end of file