Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-03-10 15:32:49 +00:00
parent 77e4c01733
commit f1af386a59
33 changed files with 830 additions and 31 deletions
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2w55-9hqf-xw99",
-  "modified": "2024-03-15T18:30:36Z",
+  "modified": "2025-03-10T15:30:44Z",
  "published": "2024-03-15T18:30:36Z",
  "aliases": [
    "CVE-2024-28403"
  ],
  "details": "TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -24,8 +29,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-15T16:15:08Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5h3h-5652-8xp5",
-  "modified": "2024-06-27T12:30:44Z",
+  "modified": "2025-03-10T15:30:45Z",
  "published": "2024-03-18T12:30:34Z",
  "aliases": [
    "CVE-2023-52609"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix race between mmput() and do_exit()\n\nTask A calls binder_update_page_range() to allocate and insert pages on\na remote address space from Task B. For this, Task A pins the remote mm\nvia mmget_not_zero() first. This can race with Task B do_exit() and the\nfinal mmput() refcount decrement will come from Task A.\n\n  Task A            | Task B\n  ------------------+------------------\n  mmget_not_zero()  |\n                    |  do_exit()\n                    |    exit_mm()\n                    |      mmput()\n  mmput()           |\n    exit_mmap()     |\n      remove_vma()  |\n        fput()      |\n\nIn this case, the work of ____fput() from Task B is queued up in Task A\nas TWA_RESUME. So in theory, Task A returns to userspace and the cleanup\nwork gets executed. However, Task A instead sleep, waiting for a reply\nfrom Task B that never comes (it's dead).\n\nThis means the binder_deferred_release() is blocked until an unrelated\nbinder event forces Task A to go back to userspace. All the associated\ndeath notifications will also be delayed until then.\n\nIn order to fix this use mmput_async() that will schedule the work in\nthe corresponding mm->async_put_work WQ instead of Task A.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -56,8 +61,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-362"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-18T11:15:07Z"
@@ -1,12 +1,12 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7pfr-rxmf-5m47",
-  "modified": "2024-03-26T15:30:48Z",
+  "modified": "2025-03-10T15:30:45Z",
  "published": "2024-03-26T15:30:48Z",
  "aliases": [
    "CVE-2023-52214"
  ],
-  "details": "Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.\n\n",
+  "details": "Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.",
  "severity": [
    {
      "type": "CVSS_V3",
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hwmm-q6w7-j593",
-  "modified": "2024-03-15T18:30:38Z",
+  "modified": "2025-03-10T15:30:44Z",
  "published": "2024-03-15T18:30:38Z",
  "aliases": [
    "CVE-2024-28401"
  ],
  "details": "TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -24,8 +29,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-15T17:15:08Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7q4p-93g6-4wf9",
-  "modified": "2025-02-25T18:31:24Z",
+  "modified": "2025-03-10T15:30:46Z",
  "published": "2025-02-25T18:31:24Z",
  "aliases": [
    "CVE-2025-26600"
@@ -19,6 +19,14 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26600"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2500"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2502"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-26600"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7qjx-378m-p8hm",
-  "modified": "2025-02-25T18:31:24Z",
+  "modified": "2025-03-10T15:30:45Z",
  "published": "2025-02-25T18:31:24Z",
  "aliases": [
    "CVE-2025-26597"
@@ -19,6 +19,14 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26597"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2500"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2502"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-26597"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c28h-3w95-v6xg",
-  "modified": "2025-02-25T18:31:24Z",
+  "modified": "2025-03-10T15:30:45Z",
  "published": "2025-02-25T18:31:24Z",
  "aliases": [
    "CVE-2025-26598"
@@ -19,6 +19,14 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26598"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2500"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2502"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-26598"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c52f-45m8-h2r6",
-  "modified": "2025-02-25T18:31:24Z",
+  "modified": "2025-03-10T15:30:45Z",
  "published": "2025-02-25T18:31:24Z",
  "aliases": [
    "CVE-2025-26596"
@@ -19,6 +19,14 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26596"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2500"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2502"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-26596"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-gc32-fmf5-c742",
-  "modified": "2025-02-25T18:31:24Z",
+  "modified": "2025-03-10T15:30:45Z",
  "published": "2025-02-25T18:31:24Z",
  "aliases": [
    "CVE-2025-26594"
@@ -19,6 +19,14 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26594"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2500"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2502"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-26594"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-gf8x-6jh7-3mjv",
-  "modified": "2025-02-25T18:31:24Z",
+  "modified": "2025-03-10T15:30:46Z",
  "published": "2025-02-25T18:31:24Z",
  "aliases": [
    "CVE-2025-26601"
@@ -19,6 +19,14 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26601"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2500"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2502"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-26601"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hp9r-wcfh-72pr",
-  "modified": "2025-02-25T18:31:24Z",
+  "modified": "2025-03-10T15:30:45Z",
  "published": "2025-02-25T18:31:24Z",
  "aliases": [
    "CVE-2025-26595"
@@ -19,6 +19,14 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26595"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2500"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2502"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-26595"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-wv34-xcj8-f3mq",
-  "modified": "2025-02-25T18:31:24Z",
+  "modified": "2025-03-10T15:30:46Z",
  "published": "2025-02-25T18:31:24Z",
  "aliases": [
    "CVE-2025-26599"
@@ -19,6 +19,14 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26599"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2500"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2502"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-26599"
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-297j-p28c-w597",
+  "modified": "2025-03-10T15:30:49Z",
+  "published": "2025-03-10T15:30:49Z",
+  "aliases": [
+    "CVE-2025-26916"
+  ],
+  "details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in EPC Massive Dynamic. This issue affects Massive Dynamic: from n/a through 8.2.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26916"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/wordpress/theme/massive-dynamic/vulnerability/wordpress-massive-dynamic-theme-8-2-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-98"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-10T15:15:37Z"
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2c2h-2855-mf97",
-  "modified": "2025-03-09T21:30:53Z",
+  "modified": "2025-03-10T15:30:46Z",
  "published": "2025-03-09T15:31:19Z",
  "aliases": [
    "CVE-2025-27636"
@@ -14,6 +14,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27636"
    },
+    {
+      "type": "WEB",
+      "url": "https://camel.apache.org/security/CVE-2025-27636.html"
+    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/CAMEL-21828"
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2hmp-5wqg-f24h",
+  "modified": "2025-03-10T15:30:47Z",
+  "published": "2025-03-10T15:30:47Z",
+  "aliases": [
+    "CVE-2025-1497"
+  ],
+  "details": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code.\nVendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1497"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fde"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cert.pl/en/posts/2025/03/CVE-2025-1497"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cert.pl/posts/2025/03/CVE-2025-1497"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mljar/plotai"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-77"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-10T14:15:24Z"
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-38j2-f744-46qw",
+  "modified": "2025-03-10T15:30:48Z",
+  "published": "2025-03-10T15:30:48Z",
+  "aliases": [
+    "CVE-2025-2152"
+  ],
+  "details": "A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2152"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/assimp/assimp/issues/6027"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/assimp/assimp/issues/6027#issue-2877629241"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.299063"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.299063"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.510818"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-10T14:15:26Z"
+  }
+}
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3j25-3c73-vg7p",
+  "modified": "2025-03-10T15:30:47Z",
+  "published": "2025-03-10T15:30:47Z",
+  "aliases": [
+    "CVE-2025-25615"
+  ],
+  "details": "Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25615"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/armaansidana2003/CVE-2025-25615"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/changeweb/Unifiedtransform"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-10T14:15:24Z"
+  }
+}
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3r92-3wmq-rmm2",
-  "modified": "2025-03-09T06:31:42Z",
+  "modified": "2025-03-10T15:30:46Z",
  "published": "2025-03-09T06:31:42Z",
  "aliases": [
    "CVE-2025-1382"
  ],
  "details": "The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -21,7 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-09T06:15:11Z"
@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-42rw-qp74-jqxj",
+  "modified": "2025-03-10T15:30:47Z",
+  "published": "2025-03-10T15:30:47Z",
+  "aliases": [
+    "CVE-2024-57492"
+  ],
+  "details": "An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the round_up_to_page funciton.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57492"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Marsman1996/pocs/blob/master/redox/CVE-2024-57492/README.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitlab.redox-os.org/redox-os/relibc/-/issues/200"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitlab.redox-os.org/redox-os/relibc/-/merge_requests/569"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-10T14:15:24Z"
+  }
+}
@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-47j8-624h-5wf4",
+  "modified": "2025-03-10T15:30:49Z",
+  "published": "2025-03-10T15:30:49Z",
+  "aliases": [
+    "CVE-2025-25620"
+  ],
+  "details": "Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25620"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/armaansidana2003/CVE-2025-25620"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/changeweb/Unifiedtransform"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-03-10T15:15:37Z"
+  }
+}
--- a/Show More
+++ b/Show More