netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-9hcv-xw76-m4h6
GHSA-h7mx-548v-cr9r
GHSA-4jh5-95f7-hf6w
GHSA-4xv4-mw36-x4rv
GHSA-cfcp-527j-53hf
GHSA-h94w-8qhg-3xmc
GHSA-p9pq-9xhx-6pgq
This commit is contained in:
advisory-database[bot]
2025-05-05 09:32:21 +00:00
parent a7f75d6dc2
commit ef8a1c9727
7 changed files with 336 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-9hcv-xw76-m4h6/GHSA-9hcv-xw76-m4h6.json
+59 -47
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9hcv-xw76-m4h6",
"modified": "2025-05-05T03:30:20Z",
"modified": "2025-05-05T09:31:09Z",
"published": "2025-03-14T09:34:06Z",
"aliases": [
"CVE-2024-8176"
@@ -25,51 +25,7 @@
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3531"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3734"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3913"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4048"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4447"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-8176"
},
{
"type": "WEB",
"url": "https://blog.hartwork.org/posts/expat-2-7-0-released"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310137"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1239618"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52"
},
{
"type": "WEB",
"url": "https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2024-8176"
"url": "https://ubuntu.com/security/CVE-2024-8176"
},
{
"type": "WEB",
@@ -77,7 +33,63 @@
},
{
"type": "WEB",
"url": "https://ubuntu.com/security/CVE-2024-8176"
"url": "https://security-tracker.debian.org/tracker/CVE-2024-8176"
},
{
"type": "WEB",
"url": "https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1239618"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310137"
},
{
"type": "WEB",
"url": "https://blog.hartwork.org/posts/expat-2-7-0-released"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-8176"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4449"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4448"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4447"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4446"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4048"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3913"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3734"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:3531"
},
{
"type": "WEB",
advisories/unreviewed/2025/04/GHSA-h7mx-548v-cr9r/GHSA-h7mx-548v-cr9r.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h7mx-548v-cr9r",
"modified": "2025-04-08T15:31:00Z",
"modified": "2025-05-05T09:31:09Z",
"published": "2025-04-03T15:31:19Z",
"aliases": [
"CVE-2025-3155"
@@ -19,6 +19,14 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3155"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4450"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4451"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-3155"
advisories/unreviewed/2025/05/GHSA-4jh5-95f7-hf6w/GHSA-4jh5-95f7-hf6w.json
+60
View File
@@ -0,0 +1,60 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jh5-95f7-hf6w",
"modified": "2025-05-05T09:31:09Z",
"published": "2025-05-05T09:31:09Z",
"aliases": [
"CVE-2025-4270"
],
"details": "A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The manipulation of the argument topicurl with the input getInitCfg/getSysStatusCfg leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4270"
},
{
"type": "WEB",
"url": "https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/getInitCfg.md"
},
{
"type": "WEB",
"url": "https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/getSysStatusCfg.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307374"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.307374"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.563442"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-05T08:15:15Z"
}
}
advisories/unreviewed/2025/05/GHSA-4xv4-mw36-x4rv/GHSA-4xv4-mw36-x4rv.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4xv4-mw36-x4rv",
"modified": "2025-05-05T09:31:09Z",
"published": "2025-05-05T09:31:09Z",
"aliases": [
"CVE-2025-4271"
],
"details": "A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4271"
},
{
"type": "WEB",
"url": "https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/showSyslog.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307375"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.307375"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.563444"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-05T08:15:15Z"
}
}
advisories/unreviewed/2025/05/GHSA-cfcp-527j-53hf/GHSA-cfcp-527j-53hf.json
+56
View File
@@ -0,0 +1,56 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cfcp-527j-53hf",
"modified": "2025-05-05T09:31:09Z",
"published": "2025-05-05T09:31:09Z",
"aliases": [
"CVE-2025-4268"
],
"details": "A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input RebootSystem leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4268"
},
{
"type": "WEB",
"url": "https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/RebootSystem.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307372"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.307372"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.563429"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-05T07:15:47Z"
}
}
advisories/unreviewed/2025/05/GHSA-h94w-8qhg-3xmc/GHSA-h94w-8qhg-3xmc.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h94w-8qhg-3xmc",
"modified": "2025-05-05T09:31:09Z",
"published": "2025-05-05T09:31:09Z",
"aliases": [
"CVE-2025-2905"
],
"details": "An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.\n\n\nThis vulnerability can be exploited by an unauthenticated remote attacker to read files from the server’s filesystem or perform denial-of-service (DoS) attacks.\n\n\n\n * \nOn systems running JDK 7 or early JDK 8, full file contents may be exposed.\n\n\n\n\n * \nOn later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.\n\n\n\n\n * \nDoS attacks such as \"Billion Laughs\" payloads can cause service disruption.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2905"
},
{
"type": "WEB",
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3993"
}
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-05T09:15:15Z"
}
}
advisories/unreviewed/2025/05/GHSA-p9pq-9xhx-6pgq/GHSA-p9pq-9xhx-6pgq.json
+60
View File
@@ -0,0 +1,60 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p9pq-9xhx-6pgq",
"modified": "2025-05-05T09:31:09Z",
"published": "2025-05-05T09:31:09Z",
"aliases": [
"CVE-2025-4269"
],
"details": "A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4269"
},
{
"type": "WEB",
"url": "https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/clearDiagnosisLog.md"
},
{
"type": "WEB",
"url": "https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/clearSyslog.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.307373"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.307373"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.563430"
},
{
"type": "WEB",
"url": "https://www.totolink.net"
}
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-05T07:15:48Z"
}
}