netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-9mvw-93v8-wr2v
GHSA-22ww-35pw-64c4
GHSA-26r5-4hm4-gr66
GHSA-3q79-qjgh-rgjv
GHSA-536f-wq7f-mx95
GHSA-58fq-ff4j-wj4q
GHSA-64qp-c23v-9qx7
GHSA-6pc6-7fmg-34vv
GHSA-8hvg-x32p-2j7j
GHSA-cqj4-fp95-jqxq
GHSA-cwp8-xjvj-w9x6
GHSA-g73p-89xv-8q58
GHSA-q2fm-836c-3p32
GHSA-r4wq-76x5-pwj9
GHSA-rq4h-cqfg-pj23
This commit is contained in:
advisory-database[bot]
2025-02-22 00:35:17 +00:00
parent 5306edb4f1
commit ef36b41464
15 changed files with 193 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/01/GHSA-9mvw-93v8-wr2v/GHSA-9mvw-93v8-wr2v.json
+2 -1
View File
@@ -46,7 +46,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-74"
"CWE-74",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2025/02/GHSA-22ww-35pw-64c4/GHSA-22ww-35pw-64c4.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-22ww-35pw-64c4",
"modified": "2025-02-20T18:31:24Z",
"modified": "2025-02-22T00:33:50Z",
"published": "2025-02-20T18:31:24Z",
"aliases": [
"CVE-2024-54959"
],
"details": "Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS).",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T18:15:25Z"
advisories/unreviewed/2025/02/GHSA-26r5-4hm4-gr66/GHSA-26r5-4hm4-gr66.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-26r5-4hm4-gr66",
"modified": "2025-02-21T18:31:15Z",
"modified": "2025-02-22T00:33:51Z",
"published": "2025-02-21T18:31:15Z",
"aliases": [
"CVE-2025-25878"
],
"details": "A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /del.php. The attack can use SQL injection to obtain sensitive data.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-21T18:16:13Z"
advisories/unreviewed/2025/02/GHSA-3q79-qjgh-rgjv/GHSA-3q79-qjgh-rgjv.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3q79-qjgh-rgjv",
"modified": "2025-02-20T18:31:24Z",
"modified": "2025-02-22T00:33:50Z",
"published": "2025-02-20T18:31:24Z",
"aliases": [
"CVE-2024-54958"
],
"details": "Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to inject malicious scripts into the Tools interface, which are then stored and executed in the context of other users accessing the page.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T18:15:25Z"
advisories/unreviewed/2025/02/GHSA-536f-wq7f-mx95/GHSA-536f-wq7f-mx95.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-536f-wq7f-mx95",
"modified": "2025-02-22T00:33:51Z",
"published": "2025-02-22T00:33:51Z",
"aliases": [
"CVE-2024-45674"
],
"details": "IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 \n\nstores potentially sensitive information in log files that could be read by a local user.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45674"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7183801"
}
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-22T00:15:18Z"
}
}
advisories/unreviewed/2025/02/GHSA-58fq-ff4j-wj4q/GHSA-58fq-ff4j-wj4q.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-58fq-ff4j-wj4q",
"modified": "2025-02-20T21:30:53Z",
"modified": "2025-02-22T00:33:50Z",
"published": "2025-02-20T21:30:53Z",
"aliases": [
"CVE-2023-51338"
],
"details": "PHPJabbers Meeting Room Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the \"title, name\" parameters of index.php page.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T19:15:11Z"
advisories/unreviewed/2025/02/GHSA-64qp-c23v-9qx7/GHSA-64qp-c23v-9qx7.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-64qp-c23v-9qx7",
"modified": "2025-02-21T18:31:15Z",
"modified": "2025-02-22T00:33:51Z",
"published": "2025-02-21T18:31:15Z",
"aliases": [
"CVE-2025-25877"
],
"details": "A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attack can use SQL injection to obtain sensitive data.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-21T18:16:13Z"
advisories/unreviewed/2025/02/GHSA-6pc6-7fmg-34vv/GHSA-6pc6-7fmg-34vv.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6pc6-7fmg-34vv",
"modified": "2025-02-20T18:31:24Z",
"modified": "2025-02-22T00:33:50Z",
"published": "2025-02-20T18:31:24Z",
"aliases": [
"CVE-2023-51333"
],
"details": "PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-1236"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T18:15:24Z"
advisories/unreviewed/2025/02/GHSA-8hvg-x32p-2j7j/GHSA-8hvg-x32p-2j7j.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8hvg-x32p-2j7j",
"modified": "2025-02-21T00:31:09Z",
"modified": "2025-02-22T00:33:50Z",
"published": "2025-02-21T00:31:09Z",
"aliases": [
"CVE-2024-54756"
],
"details": "A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code via supplying a crafted PK3 file containing a malicious ZScript source file.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T23:15:10Z"
advisories/unreviewed/2025/02/GHSA-cqj4-fp95-jqxq/GHSA-cqj4-fp95-jqxq.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cqj4-fp95-jqxq",
"modified": "2025-02-10T18:30:46Z",
"modified": "2025-02-22T00:33:50Z",
"published": "2025-02-10T18:30:46Z",
"aliases": [
"CVE-2024-12243"
@@ -30,6 +30,10 @@
{
"type": "WEB",
"url": "https://gitlab.com/gnutls/libtasn1/-/issues/52"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00027.html"
}
],
"database_specific": {
advisories/unreviewed/2025/02/GHSA-cwp8-xjvj-w9x6/GHSA-cwp8-xjvj-w9x6.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cwp8-xjvj-w9x6",
"modified": "2025-02-21T00:31:09Z",
"modified": "2025-02-22T00:33:50Z",
"published": "2025-02-21T00:31:09Z",
"aliases": [
"CVE-2025-25960"
],
"details": "Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T22:15:31Z"
advisories/unreviewed/2025/02/GHSA-g73p-89xv-8q58/GHSA-g73p-89xv-8q58.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g73p-89xv-8q58",
"modified": "2025-02-20T21:30:53Z",
"modified": "2025-02-22T00:33:50Z",
"published": "2025-02-20T21:30:52Z",
"aliases": [
"CVE-2023-51336"
],
"details": "PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-1236"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T19:15:11Z"
advisories/unreviewed/2025/02/GHSA-q2fm-836c-3p32/GHSA-q2fm-836c-3p32.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q2fm-836c-3p32",
"modified": "2025-02-20T21:30:53Z",
"modified": "2025-02-22T00:33:50Z",
"published": "2025-02-20T21:30:53Z",
"aliases": [
"CVE-2023-51337"
],
"details": "PHPJabbers Event Ticketing System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in \"lid\" parameter in index.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T19:15:11Z"
advisories/unreviewed/2025/02/GHSA-r4wq-76x5-pwj9/GHSA-r4wq-76x5-pwj9.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r4wq-76x5-pwj9",
"modified": "2025-02-21T21:32:08Z",
"modified": "2025-02-22T00:33:51Z",
"published": "2025-02-21T21:32:08Z",
"aliases": [
"CVE-2025-25772"
],
"details": "A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-21T19:15:14Z"
advisories/unreviewed/2025/02/GHSA-rq4h-cqfg-pj23/GHSA-rq4h-cqfg-pj23.json
+29
View File
@@ -0,0 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rq4h-cqfg-pj23",
"modified": "2025-02-22T00:33:51Z",
"published": "2025-02-22T00:33:51Z",
"aliases": [
"CVE-2019-8900"
],
"details": "A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon booting those devices. This vulnerability allows arbitrary code to be executed on the device. Exploiting the vulnerability requires physical access to the device: the device must be plugged in to a computer upon booting, and it must be put into Device Firmware Update (DFU) mode. The exploit is not persistent; rebooting the device overrides any changes to the device's software that were made during an exploited session on the device. Additionally, unless an attacker has access to the device's unlock PIN or fingerprint, an attacker cannot gain access to information protected by Apple's Secure Enclave or Touch ID features.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8900"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/941987"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-21T22:15:10Z"
}
}