diff --git a/advisories/unreviewed/2025/01/GHSA-9mvw-93v8-wr2v/GHSA-9mvw-93v8-wr2v.json b/advisories/unreviewed/2025/01/GHSA-9mvw-93v8-wr2v/GHSA-9mvw-93v8-wr2v.json index c826a187418..3da0aa88d8a 100644 --- a/advisories/unreviewed/2025/01/GHSA-9mvw-93v8-wr2v/GHSA-9mvw-93v8-wr2v.json +++ b/advisories/unreviewed/2025/01/GHSA-9mvw-93v8-wr2v/GHSA-9mvw-93v8-wr2v.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/02/GHSA-22ww-35pw-64c4/GHSA-22ww-35pw-64c4.json b/advisories/unreviewed/2025/02/GHSA-22ww-35pw-64c4/GHSA-22ww-35pw-64c4.json index 201a0f79e08..e5583ad128f 100644 --- a/advisories/unreviewed/2025/02/GHSA-22ww-35pw-64c4/GHSA-22ww-35pw-64c4.json +++ b/advisories/unreviewed/2025/02/GHSA-22ww-35pw-64c4/GHSA-22ww-35pw-64c4.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-22ww-35pw-64c4", - "modified": "2025-02-20T18:31:24Z", + "modified": "2025-02-22T00:33:50Z", "published": "2025-02-20T18:31:24Z", "aliases": [ "CVE-2024-54959" ], "details": "Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS).", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-20T18:15:25Z" diff --git a/advisories/unreviewed/2025/02/GHSA-26r5-4hm4-gr66/GHSA-26r5-4hm4-gr66.json b/advisories/unreviewed/2025/02/GHSA-26r5-4hm4-gr66/GHSA-26r5-4hm4-gr66.json index 9b33c519ad5..e5f82e7a069 100644 --- a/advisories/unreviewed/2025/02/GHSA-26r5-4hm4-gr66/GHSA-26r5-4hm4-gr66.json +++ b/advisories/unreviewed/2025/02/GHSA-26r5-4hm4-gr66/GHSA-26r5-4hm4-gr66.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-26r5-4hm4-gr66", - "modified": "2025-02-21T18:31:15Z", + "modified": "2025-02-22T00:33:51Z", "published": "2025-02-21T18:31:15Z", "aliases": [ "CVE-2025-25878" ], "details": "A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /del.php. The attack can use SQL injection to obtain sensitive data.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-89" + ], + "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-21T18:16:13Z" diff --git a/advisories/unreviewed/2025/02/GHSA-3q79-qjgh-rgjv/GHSA-3q79-qjgh-rgjv.json b/advisories/unreviewed/2025/02/GHSA-3q79-qjgh-rgjv/GHSA-3q79-qjgh-rgjv.json index 83b2ebeb36c..49e74ae91bd 100644 --- a/advisories/unreviewed/2025/02/GHSA-3q79-qjgh-rgjv/GHSA-3q79-qjgh-rgjv.json +++ b/advisories/unreviewed/2025/02/GHSA-3q79-qjgh-rgjv/GHSA-3q79-qjgh-rgjv.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-3q79-qjgh-rgjv", - "modified": "2025-02-20T18:31:24Z", + "modified": "2025-02-22T00:33:50Z", "published": "2025-02-20T18:31:24Z", "aliases": [ "CVE-2024-54958" ], "details": "Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to inject malicious scripts into the Tools interface, which are then stored and executed in the context of other users accessing the page.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-20T18:15:25Z" diff --git a/advisories/unreviewed/2025/02/GHSA-536f-wq7f-mx95/GHSA-536f-wq7f-mx95.json b/advisories/unreviewed/2025/02/GHSA-536f-wq7f-mx95/GHSA-536f-wq7f-mx95.json new file mode 100644 index 00000000000..97e309c626d --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-536f-wq7f-mx95/GHSA-536f-wq7f-mx95.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-536f-wq7f-mx95", + "modified": "2025-02-22T00:33:51Z", + "published": "2025-02-22T00:33:51Z", + "aliases": [ + "CVE-2024-45674" + ], + "details": "IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 \n\nstores potentially sensitive information in log files that could be read by a local user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45674" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7183801" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-22T00:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-58fq-ff4j-wj4q/GHSA-58fq-ff4j-wj4q.json b/advisories/unreviewed/2025/02/GHSA-58fq-ff4j-wj4q/GHSA-58fq-ff4j-wj4q.json index 27c495a4533..2478aaec522 100644 --- a/advisories/unreviewed/2025/02/GHSA-58fq-ff4j-wj4q/GHSA-58fq-ff4j-wj4q.json +++ b/advisories/unreviewed/2025/02/GHSA-58fq-ff4j-wj4q/GHSA-58fq-ff4j-wj4q.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-58fq-ff4j-wj4q", - "modified": "2025-02-20T21:30:53Z", + "modified": "2025-02-22T00:33:50Z", "published": "2025-02-20T21:30:53Z", "aliases": [ "CVE-2023-51338" ], "details": "PHPJabbers Meeting Room Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the \"title, name\" parameters of index.php page.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-20T19:15:11Z" diff --git a/advisories/unreviewed/2025/02/GHSA-64qp-c23v-9qx7/GHSA-64qp-c23v-9qx7.json b/advisories/unreviewed/2025/02/GHSA-64qp-c23v-9qx7/GHSA-64qp-c23v-9qx7.json index 8350c9859dc..e33e42d2e95 100644 --- a/advisories/unreviewed/2025/02/GHSA-64qp-c23v-9qx7/GHSA-64qp-c23v-9qx7.json +++ b/advisories/unreviewed/2025/02/GHSA-64qp-c23v-9qx7/GHSA-64qp-c23v-9qx7.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-64qp-c23v-9qx7", - "modified": "2025-02-21T18:31:15Z", + "modified": "2025-02-22T00:33:51Z", "published": "2025-02-21T18:31:15Z", "aliases": [ "CVE-2025-25877" ], "details": "A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attack can use SQL injection to obtain sensitive data.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-89" + ], + "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-21T18:16:13Z" diff --git a/advisories/unreviewed/2025/02/GHSA-6pc6-7fmg-34vv/GHSA-6pc6-7fmg-34vv.json b/advisories/unreviewed/2025/02/GHSA-6pc6-7fmg-34vv/GHSA-6pc6-7fmg-34vv.json index c30d4136649..8007bbaa7c7 100644 --- a/advisories/unreviewed/2025/02/GHSA-6pc6-7fmg-34vv/GHSA-6pc6-7fmg-34vv.json +++ b/advisories/unreviewed/2025/02/GHSA-6pc6-7fmg-34vv/GHSA-6pc6-7fmg-34vv.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-6pc6-7fmg-34vv", - "modified": "2025-02-20T18:31:24Z", + "modified": "2025-02-22T00:33:50Z", "published": "2025-02-20T18:31:24Z", "aliases": [ "CVE-2023-51333" ], "details": "PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-1236" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-20T18:15:24Z" diff --git a/advisories/unreviewed/2025/02/GHSA-8hvg-x32p-2j7j/GHSA-8hvg-x32p-2j7j.json b/advisories/unreviewed/2025/02/GHSA-8hvg-x32p-2j7j/GHSA-8hvg-x32p-2j7j.json index d8cc90bfeb8..b8ca7e70dc3 100644 --- a/advisories/unreviewed/2025/02/GHSA-8hvg-x32p-2j7j/GHSA-8hvg-x32p-2j7j.json +++ b/advisories/unreviewed/2025/02/GHSA-8hvg-x32p-2j7j/GHSA-8hvg-x32p-2j7j.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8hvg-x32p-2j7j", - "modified": "2025-02-21T00:31:09Z", + "modified": "2025-02-22T00:33:50Z", "published": "2025-02-21T00:31:09Z", "aliases": [ "CVE-2024-54756" ], "details": "A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code via supplying a crafted PK3 file containing a malicious ZScript source file.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -28,8 +33,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-20T23:15:10Z" diff --git a/advisories/unreviewed/2025/02/GHSA-cqj4-fp95-jqxq/GHSA-cqj4-fp95-jqxq.json b/advisories/unreviewed/2025/02/GHSA-cqj4-fp95-jqxq/GHSA-cqj4-fp95-jqxq.json index 615c121495d..f9c6b358980 100644 --- a/advisories/unreviewed/2025/02/GHSA-cqj4-fp95-jqxq/GHSA-cqj4-fp95-jqxq.json +++ b/advisories/unreviewed/2025/02/GHSA-cqj4-fp95-jqxq/GHSA-cqj4-fp95-jqxq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cqj4-fp95-jqxq", - "modified": "2025-02-10T18:30:46Z", + "modified": "2025-02-22T00:33:50Z", "published": "2025-02-10T18:30:46Z", "aliases": [ "CVE-2024-12243" @@ -30,6 +30,10 @@ { "type": "WEB", "url": "https://gitlab.com/gnutls/libtasn1/-/issues/52" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00027.html" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/02/GHSA-cwp8-xjvj-w9x6/GHSA-cwp8-xjvj-w9x6.json b/advisories/unreviewed/2025/02/GHSA-cwp8-xjvj-w9x6/GHSA-cwp8-xjvj-w9x6.json index 6183b804c42..55921b34ad9 100644 --- a/advisories/unreviewed/2025/02/GHSA-cwp8-xjvj-w9x6/GHSA-cwp8-xjvj-w9x6.json +++ b/advisories/unreviewed/2025/02/GHSA-cwp8-xjvj-w9x6/GHSA-cwp8-xjvj-w9x6.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-cwp8-xjvj-w9x6", - "modified": "2025-02-21T00:31:09Z", + "modified": "2025-02-22T00:33:50Z", "published": "2025-02-21T00:31:09Z", "aliases": [ "CVE-2025-25960" ], "details": "Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-20T22:15:31Z" diff --git a/advisories/unreviewed/2025/02/GHSA-g73p-89xv-8q58/GHSA-g73p-89xv-8q58.json b/advisories/unreviewed/2025/02/GHSA-g73p-89xv-8q58/GHSA-g73p-89xv-8q58.json index 750643aec6c..2a23e87c645 100644 --- a/advisories/unreviewed/2025/02/GHSA-g73p-89xv-8q58/GHSA-g73p-89xv-8q58.json +++ b/advisories/unreviewed/2025/02/GHSA-g73p-89xv-8q58/GHSA-g73p-89xv-8q58.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-g73p-89xv-8q58", - "modified": "2025-02-20T21:30:53Z", + "modified": "2025-02-22T00:33:50Z", "published": "2025-02-20T21:30:52Z", "aliases": [ "CVE-2023-51336" ], "details": "PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-1236" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-20T19:15:11Z" diff --git a/advisories/unreviewed/2025/02/GHSA-q2fm-836c-3p32/GHSA-q2fm-836c-3p32.json b/advisories/unreviewed/2025/02/GHSA-q2fm-836c-3p32/GHSA-q2fm-836c-3p32.json index cb8fd9d6dfa..ef29ddedc74 100644 --- a/advisories/unreviewed/2025/02/GHSA-q2fm-836c-3p32/GHSA-q2fm-836c-3p32.json +++ b/advisories/unreviewed/2025/02/GHSA-q2fm-836c-3p32/GHSA-q2fm-836c-3p32.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-q2fm-836c-3p32", - "modified": "2025-02-20T21:30:53Z", + "modified": "2025-02-22T00:33:50Z", "published": "2025-02-20T21:30:53Z", "aliases": [ "CVE-2023-51337" ], "details": "PHPJabbers Event Ticketing System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in \"lid\" parameter in index.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-20T19:15:11Z" diff --git a/advisories/unreviewed/2025/02/GHSA-r4wq-76x5-pwj9/GHSA-r4wq-76x5-pwj9.json b/advisories/unreviewed/2025/02/GHSA-r4wq-76x5-pwj9/GHSA-r4wq-76x5-pwj9.json index de85d3ec662..38f45f6f3fc 100644 --- a/advisories/unreviewed/2025/02/GHSA-r4wq-76x5-pwj9/GHSA-r4wq-76x5-pwj9.json +++ b/advisories/unreviewed/2025/02/GHSA-r4wq-76x5-pwj9/GHSA-r4wq-76x5-pwj9.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-r4wq-76x5-pwj9", - "modified": "2025-02-21T21:32:08Z", + "modified": "2025-02-22T00:33:51Z", "published": "2025-02-21T21:32:08Z", "aliases": [ "CVE-2025-25772" ], "details": "A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-21T19:15:14Z" diff --git a/advisories/unreviewed/2025/02/GHSA-rq4h-cqfg-pj23/GHSA-rq4h-cqfg-pj23.json b/advisories/unreviewed/2025/02/GHSA-rq4h-cqfg-pj23/GHSA-rq4h-cqfg-pj23.json new file mode 100644 index 00000000000..7d291c20fc4 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-rq4h-cqfg-pj23/GHSA-rq4h-cqfg-pj23.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rq4h-cqfg-pj23", + "modified": "2025-02-22T00:33:51Z", + "published": "2025-02-22T00:33:51Z", + "aliases": [ + "CVE-2019-8900" + ], + "details": "A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon booting those devices. This vulnerability allows arbitrary code to be executed on the device. Exploiting the vulnerability requires physical access to the device: the device must be plugged in to a computer upon booting, and it must be put into Device Firmware Update (DFU) mode. The exploit is not persistent; rebooting the device overrides any changes to the device's software that were made during an exploited session on the device. Additionally, unless an attacker has access to the device's unlock PIN or fingerprint, an attacker cannot gain access to information protected by Apple's Secure Enclave or Touch ID features.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8900" + }, + { + "type": "WEB", + "url": "https://www.kb.cert.org/vuls/id/941987" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-21T22:15:10Z" + } +} \ No newline at end of file