diff --git a/advisories/unreviewed/2024/03/GHSA-2w55-9hqf-xw99/GHSA-2w55-9hqf-xw99.json b/advisories/unreviewed/2024/03/GHSA-2w55-9hqf-xw99/GHSA-2w55-9hqf-xw99.json index dc824490a57..d46238d9a2d 100644 --- a/advisories/unreviewed/2024/03/GHSA-2w55-9hqf-xw99/GHSA-2w55-9hqf-xw99.json +++ b/advisories/unreviewed/2024/03/GHSA-2w55-9hqf-xw99/GHSA-2w55-9hqf-xw99.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-2w55-9hqf-xw99", - "modified": "2024-03-15T18:30:36Z", + "modified": "2025-03-10T15:30:44Z", "published": "2024-03-15T18:30:36Z", "aliases": [ "CVE-2024-28403" ], "details": "TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-15T16:15:08Z" diff --git a/advisories/unreviewed/2024/03/GHSA-5h3h-5652-8xp5/GHSA-5h3h-5652-8xp5.json b/advisories/unreviewed/2024/03/GHSA-5h3h-5652-8xp5/GHSA-5h3h-5652-8xp5.json index b00f47260ed..dd0be02961d 100644 --- a/advisories/unreviewed/2024/03/GHSA-5h3h-5652-8xp5/GHSA-5h3h-5652-8xp5.json +++ b/advisories/unreviewed/2024/03/GHSA-5h3h-5652-8xp5/GHSA-5h3h-5652-8xp5.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-5h3h-5652-8xp5", - "modified": "2024-06-27T12:30:44Z", + "modified": "2025-03-10T15:30:45Z", "published": "2024-03-18T12:30:34Z", "aliases": [ "CVE-2023-52609" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix race between mmput() and do_exit()\n\nTask A calls binder_update_page_range() to allocate and insert pages on\na remote address space from Task B. For this, Task A pins the remote mm\nvia mmget_not_zero() first. This can race with Task B do_exit() and the\nfinal mmput() refcount decrement will come from Task A.\n\n Task A | Task B\n ------------------+------------------\n mmget_not_zero() |\n | do_exit()\n | exit_mm()\n | mmput()\n mmput() |\n exit_mmap() |\n remove_vma() |\n fput() |\n\nIn this case, the work of ____fput() from Task B is queued up in Task A\nas TWA_RESUME. So in theory, Task A returns to userspace and the cleanup\nwork gets executed. However, Task A instead sleep, waiting for a reply\nfrom Task B that never comes (it's dead).\n\nThis means the binder_deferred_release() is blocked until an unrelated\nbinder event forces Task A to go back to userspace. All the associated\ndeath notifications will also be delayed until then.\n\nIn order to fix this use mmput_async() that will schedule the work in\nthe corresponding mm->async_put_work WQ instead of Task A.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -56,8 +61,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-362" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-18T11:15:07Z" diff --git a/advisories/unreviewed/2024/03/GHSA-7pfr-rxmf-5m47/GHSA-7pfr-rxmf-5m47.json b/advisories/unreviewed/2024/03/GHSA-7pfr-rxmf-5m47/GHSA-7pfr-rxmf-5m47.json index 3c3017ed3c4..e3252b06322 100644 --- a/advisories/unreviewed/2024/03/GHSA-7pfr-rxmf-5m47/GHSA-7pfr-rxmf-5m47.json +++ b/advisories/unreviewed/2024/03/GHSA-7pfr-rxmf-5m47/GHSA-7pfr-rxmf-5m47.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7pfr-rxmf-5m47", - "modified": "2024-03-26T15:30:48Z", + "modified": "2025-03-10T15:30:45Z", "published": "2024-03-26T15:30:48Z", "aliases": [ "CVE-2023-52214" ], - "details": "Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.\n\n", + "details": "Missing Authorization vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder.This issue affects Void Contact Form 7 Widget For Elementor Page Builder: from n/a through 2.3.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/unreviewed/2024/03/GHSA-hwmm-q6w7-j593/GHSA-hwmm-q6w7-j593.json b/advisories/unreviewed/2024/03/GHSA-hwmm-q6w7-j593/GHSA-hwmm-q6w7-j593.json index b551019a1f1..304dcea6016 100644 --- a/advisories/unreviewed/2024/03/GHSA-hwmm-q6w7-j593/GHSA-hwmm-q6w7-j593.json +++ b/advisories/unreviewed/2024/03/GHSA-hwmm-q6w7-j593/GHSA-hwmm-q6w7-j593.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-hwmm-q6w7-j593", - "modified": "2024-03-15T18:30:38Z", + "modified": "2025-03-10T15:30:44Z", "published": "2024-03-15T18:30:38Z", "aliases": [ "CVE-2024-28401" ], "details": "TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-15T17:15:08Z" diff --git a/advisories/unreviewed/2025/02/GHSA-7q4p-93g6-4wf9/GHSA-7q4p-93g6-4wf9.json b/advisories/unreviewed/2025/02/GHSA-7q4p-93g6-4wf9/GHSA-7q4p-93g6-4wf9.json index f7aaf0d1b13..1415fb307b7 100644 --- a/advisories/unreviewed/2025/02/GHSA-7q4p-93g6-4wf9/GHSA-7q4p-93g6-4wf9.json +++ b/advisories/unreviewed/2025/02/GHSA-7q4p-93g6-4wf9/GHSA-7q4p-93g6-4wf9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7q4p-93g6-4wf9", - "modified": "2025-02-25T18:31:24Z", + "modified": "2025-03-10T15:30:46Z", "published": "2025-02-25T18:31:24Z", "aliases": [ "CVE-2025-26600" @@ -19,6 +19,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26600" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2500" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2502" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-26600" diff --git a/advisories/unreviewed/2025/02/GHSA-7qjx-378m-p8hm/GHSA-7qjx-378m-p8hm.json b/advisories/unreviewed/2025/02/GHSA-7qjx-378m-p8hm/GHSA-7qjx-378m-p8hm.json index 99473542908..5a8ff64aed1 100644 --- a/advisories/unreviewed/2025/02/GHSA-7qjx-378m-p8hm/GHSA-7qjx-378m-p8hm.json +++ b/advisories/unreviewed/2025/02/GHSA-7qjx-378m-p8hm/GHSA-7qjx-378m-p8hm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7qjx-378m-p8hm", - "modified": "2025-02-25T18:31:24Z", + "modified": "2025-03-10T15:30:45Z", "published": "2025-02-25T18:31:24Z", "aliases": [ "CVE-2025-26597" @@ -19,6 +19,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26597" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2500" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2502" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-26597" diff --git a/advisories/unreviewed/2025/02/GHSA-c28h-3w95-v6xg/GHSA-c28h-3w95-v6xg.json b/advisories/unreviewed/2025/02/GHSA-c28h-3w95-v6xg/GHSA-c28h-3w95-v6xg.json index e633a022d37..f4542967af8 100644 --- a/advisories/unreviewed/2025/02/GHSA-c28h-3w95-v6xg/GHSA-c28h-3w95-v6xg.json +++ b/advisories/unreviewed/2025/02/GHSA-c28h-3w95-v6xg/GHSA-c28h-3w95-v6xg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c28h-3w95-v6xg", - "modified": "2025-02-25T18:31:24Z", + "modified": "2025-03-10T15:30:45Z", "published": "2025-02-25T18:31:24Z", "aliases": [ "CVE-2025-26598" @@ -19,6 +19,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26598" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2500" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2502" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-26598" diff --git a/advisories/unreviewed/2025/02/GHSA-c52f-45m8-h2r6/GHSA-c52f-45m8-h2r6.json b/advisories/unreviewed/2025/02/GHSA-c52f-45m8-h2r6/GHSA-c52f-45m8-h2r6.json index a0352337d6a..3c6d8f5913d 100644 --- a/advisories/unreviewed/2025/02/GHSA-c52f-45m8-h2r6/GHSA-c52f-45m8-h2r6.json +++ b/advisories/unreviewed/2025/02/GHSA-c52f-45m8-h2r6/GHSA-c52f-45m8-h2r6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c52f-45m8-h2r6", - "modified": "2025-02-25T18:31:24Z", + "modified": "2025-03-10T15:30:45Z", "published": "2025-02-25T18:31:24Z", "aliases": [ "CVE-2025-26596" @@ -19,6 +19,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26596" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2500" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2502" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-26596" diff --git a/advisories/unreviewed/2025/02/GHSA-gc32-fmf5-c742/GHSA-gc32-fmf5-c742.json b/advisories/unreviewed/2025/02/GHSA-gc32-fmf5-c742/GHSA-gc32-fmf5-c742.json index 2edfd3c6500..3d71e6a24e7 100644 --- a/advisories/unreviewed/2025/02/GHSA-gc32-fmf5-c742/GHSA-gc32-fmf5-c742.json +++ b/advisories/unreviewed/2025/02/GHSA-gc32-fmf5-c742/GHSA-gc32-fmf5-c742.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-gc32-fmf5-c742", - "modified": "2025-02-25T18:31:24Z", + "modified": "2025-03-10T15:30:45Z", "published": "2025-02-25T18:31:24Z", "aliases": [ "CVE-2025-26594" @@ -19,6 +19,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26594" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2500" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2502" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-26594" diff --git a/advisories/unreviewed/2025/02/GHSA-gf8x-6jh7-3mjv/GHSA-gf8x-6jh7-3mjv.json b/advisories/unreviewed/2025/02/GHSA-gf8x-6jh7-3mjv/GHSA-gf8x-6jh7-3mjv.json index a091fcc3191..8f0badf5db0 100644 --- a/advisories/unreviewed/2025/02/GHSA-gf8x-6jh7-3mjv/GHSA-gf8x-6jh7-3mjv.json +++ b/advisories/unreviewed/2025/02/GHSA-gf8x-6jh7-3mjv/GHSA-gf8x-6jh7-3mjv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-gf8x-6jh7-3mjv", - "modified": "2025-02-25T18:31:24Z", + "modified": "2025-03-10T15:30:46Z", "published": "2025-02-25T18:31:24Z", "aliases": [ "CVE-2025-26601" @@ -19,6 +19,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26601" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2500" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2502" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-26601" diff --git a/advisories/unreviewed/2025/02/GHSA-hp9r-wcfh-72pr/GHSA-hp9r-wcfh-72pr.json b/advisories/unreviewed/2025/02/GHSA-hp9r-wcfh-72pr/GHSA-hp9r-wcfh-72pr.json index c380f0c5953..46eadb9d202 100644 --- a/advisories/unreviewed/2025/02/GHSA-hp9r-wcfh-72pr/GHSA-hp9r-wcfh-72pr.json +++ b/advisories/unreviewed/2025/02/GHSA-hp9r-wcfh-72pr/GHSA-hp9r-wcfh-72pr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hp9r-wcfh-72pr", - "modified": "2025-02-25T18:31:24Z", + "modified": "2025-03-10T15:30:45Z", "published": "2025-02-25T18:31:24Z", "aliases": [ "CVE-2025-26595" @@ -19,6 +19,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26595" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2500" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2502" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-26595" diff --git a/advisories/unreviewed/2025/02/GHSA-wv34-xcj8-f3mq/GHSA-wv34-xcj8-f3mq.json b/advisories/unreviewed/2025/02/GHSA-wv34-xcj8-f3mq/GHSA-wv34-xcj8-f3mq.json index 2eb8b3b8dbb..f3b0d93d705 100644 --- a/advisories/unreviewed/2025/02/GHSA-wv34-xcj8-f3mq/GHSA-wv34-xcj8-f3mq.json +++ b/advisories/unreviewed/2025/02/GHSA-wv34-xcj8-f3mq/GHSA-wv34-xcj8-f3mq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wv34-xcj8-f3mq", - "modified": "2025-02-25T18:31:24Z", + "modified": "2025-03-10T15:30:46Z", "published": "2025-02-25T18:31:24Z", "aliases": [ "CVE-2025-26599" @@ -19,6 +19,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26599" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2500" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:2502" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2025-26599" diff --git a/advisories/unreviewed/2025/03/GHSA-297j-p28c-w597/GHSA-297j-p28c-w597.json b/advisories/unreviewed/2025/03/GHSA-297j-p28c-w597/GHSA-297j-p28c-w597.json new file mode 100644 index 00000000000..573b4d7ff22 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-297j-p28c-w597/GHSA-297j-p28c-w597.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-297j-p28c-w597", + "modified": "2025-03-10T15:30:49Z", + "published": "2025-03-10T15:30:49Z", + "aliases": [ + "CVE-2025-26916" + ], + "details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in EPC Massive Dynamic. This issue affects Massive Dynamic: from n/a through 8.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26916" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/theme/massive-dynamic/vulnerability/wordpress-massive-dynamic-theme-8-2-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-98" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T15:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json b/advisories/unreviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json index 1f4a506ea1a..422741be9a8 100644 --- a/advisories/unreviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json +++ b/advisories/unreviewed/2025/03/GHSA-2c2h-2855-mf97/GHSA-2c2h-2855-mf97.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2c2h-2855-mf97", - "modified": "2025-03-09T21:30:53Z", + "modified": "2025-03-10T15:30:46Z", "published": "2025-03-09T15:31:19Z", "aliases": [ "CVE-2025-27636" @@ -14,6 +14,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27636" }, + { + "type": "WEB", + "url": "https://camel.apache.org/security/CVE-2025-27636.html" + }, { "type": "WEB", "url": "https://issues.apache.org/jira/browse/CAMEL-21828" diff --git a/advisories/unreviewed/2025/03/GHSA-2hmp-5wqg-f24h/GHSA-2hmp-5wqg-f24h.json b/advisories/unreviewed/2025/03/GHSA-2hmp-5wqg-f24h/GHSA-2hmp-5wqg-f24h.json new file mode 100644 index 00000000000..68d5dc133ef --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-2hmp-5wqg-f24h/GHSA-2hmp-5wqg-f24h.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2hmp-5wqg-f24h", + "modified": "2025-03-10T15:30:47Z", + "published": "2025-03-10T15:30:47Z", + "aliases": [ + "CVE-2025-1497" + ], + "details": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code.\nVendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1497" + }, + { + "type": "WEB", + "url": "https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fde" + }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2025/03/CVE-2025-1497" + }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2025/03/CVE-2025-1497" + }, + { + "type": "WEB", + "url": "https://github.com/mljar/plotai" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-38j2-f744-46qw/GHSA-38j2-f744-46qw.json b/advisories/unreviewed/2025/03/GHSA-38j2-f744-46qw/GHSA-38j2-f744-46qw.json new file mode 100644 index 00000000000..42c788cac4a --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-38j2-f744-46qw/GHSA-38j2-f744-46qw.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-38j2-f744-46qw", + "modified": "2025-03-10T15:30:48Z", + "published": "2025-03-10T15:30:48Z", + "aliases": [ + "CVE-2025-2152" + ], + "details": "A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2152" + }, + { + "type": "WEB", + "url": "https://github.com/assimp/assimp/issues/6027" + }, + { + "type": "WEB", + "url": "https://github.com/assimp/assimp/issues/6027#issue-2877629241" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299063" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299063" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.510818" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T14:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-3j25-3c73-vg7p/GHSA-3j25-3c73-vg7p.json b/advisories/unreviewed/2025/03/GHSA-3j25-3c73-vg7p/GHSA-3j25-3c73-vg7p.json new file mode 100644 index 00000000000..e4672924330 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-3j25-3c73-vg7p/GHSA-3j25-3c73-vg7p.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3j25-3c73-vg7p", + "modified": "2025-03-10T15:30:47Z", + "published": "2025-03-10T15:30:47Z", + "aliases": [ + "CVE-2025-25615" + ], + "details": "Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25615" + }, + { + "type": "WEB", + "url": "https://github.com/armaansidana2003/CVE-2025-25615" + }, + { + "type": "WEB", + "url": "https://github.com/changeweb/Unifiedtransform" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-3r92-3wmq-rmm2/GHSA-3r92-3wmq-rmm2.json b/advisories/unreviewed/2025/03/GHSA-3r92-3wmq-rmm2/GHSA-3r92-3wmq-rmm2.json index 32744d33a45..940bc8d99e6 100644 --- a/advisories/unreviewed/2025/03/GHSA-3r92-3wmq-rmm2/GHSA-3r92-3wmq-rmm2.json +++ b/advisories/unreviewed/2025/03/GHSA-3r92-3wmq-rmm2/GHSA-3r92-3wmq-rmm2.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-3r92-3wmq-rmm2", - "modified": "2025-03-09T06:31:42Z", + "modified": "2025-03-10T15:30:46Z", "published": "2025-03-09T06:31:42Z", "aliases": [ "CVE-2025-1382" ], "details": "The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-09T06:15:11Z" diff --git a/advisories/unreviewed/2025/03/GHSA-42rw-qp74-jqxj/GHSA-42rw-qp74-jqxj.json b/advisories/unreviewed/2025/03/GHSA-42rw-qp74-jqxj/GHSA-42rw-qp74-jqxj.json new file mode 100644 index 00000000000..905120a95ef --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-42rw-qp74-jqxj/GHSA-42rw-qp74-jqxj.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-42rw-qp74-jqxj", + "modified": "2025-03-10T15:30:47Z", + "published": "2025-03-10T15:30:47Z", + "aliases": [ + "CVE-2024-57492" + ], + "details": "An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the round_up_to_page funciton.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57492" + }, + { + "type": "WEB", + "url": "https://github.com/Marsman1996/pocs/blob/master/redox/CVE-2024-57492/README.md" + }, + { + "type": "WEB", + "url": "https://gitlab.redox-os.org/redox-os/relibc/-/issues/200" + }, + { + "type": "WEB", + "url": "https://gitlab.redox-os.org/redox-os/relibc/-/merge_requests/569" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T14:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-47j8-624h-5wf4/GHSA-47j8-624h-5wf4.json b/advisories/unreviewed/2025/03/GHSA-47j8-624h-5wf4/GHSA-47j8-624h-5wf4.json new file mode 100644 index 00000000000..aa561c9dab4 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-47j8-624h-5wf4/GHSA-47j8-624h-5wf4.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-47j8-624h-5wf4", + "modified": "2025-03-10T15:30:49Z", + "published": "2025-03-10T15:30:49Z", + "aliases": [ + "CVE-2025-25620" + ], + "details": "Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25620" + }, + { + "type": "WEB", + "url": "https://github.com/armaansidana2003/CVE-2025-25620" + }, + { + "type": "WEB", + "url": "https://github.com/changeweb/Unifiedtransform" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T15:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-48hh-v7xg-xpgq/GHSA-48hh-v7xg-xpgq.json b/advisories/unreviewed/2025/03/GHSA-48hh-v7xg-xpgq/GHSA-48hh-v7xg-xpgq.json new file mode 100644 index 00000000000..70fe1dfee39 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-48hh-v7xg-xpgq/GHSA-48hh-v7xg-xpgq.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-48hh-v7xg-xpgq", + "modified": "2025-03-10T15:30:48Z", + "published": "2025-03-10T15:30:47Z", + "aliases": [ + "CVE-2025-25616" + ], + "details": "Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam_rule_id=1.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25616" + }, + { + "type": "WEB", + "url": "https://github.com/armaansidana2003/CVE-2025-25616" + }, + { + "type": "WEB", + "url": "https://github.com/changeweb/Unifiedtransform" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T14:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-6m2c-8hh4-ffc7/GHSA-6m2c-8hh4-ffc7.json b/advisories/unreviewed/2025/03/GHSA-6m2c-8hh4-ffc7/GHSA-6m2c-8hh4-ffc7.json new file mode 100644 index 00000000000..d53795d1b8b --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-6m2c-8hh4-ffc7/GHSA-6m2c-8hh4-ffc7.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6m2c-8hh4-ffc7", + "modified": "2025-03-10T15:30:49Z", + "published": "2025-03-10T15:30:49Z", + "aliases": [ + "CVE-2025-25614" + ], + "details": "Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25614" + }, + { + "type": "WEB", + "url": "https://github.com/armaansidana2003/CVE-2025-25614" + }, + { + "type": "WEB", + "url": "https://github.com/changeweb/Unifiedtransform" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T15:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-6rg8-wqvx-ghg5/GHSA-6rg8-wqvx-ghg5.json b/advisories/unreviewed/2025/03/GHSA-6rg8-wqvx-ghg5/GHSA-6rg8-wqvx-ghg5.json new file mode 100644 index 00000000000..1f498f71d58 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-6rg8-wqvx-ghg5/GHSA-6rg8-wqvx-ghg5.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6rg8-wqvx-ghg5", + "modified": "2025-03-10T15:30:48Z", + "published": "2025-03-10T15:30:48Z", + "aliases": [ + "CVE-2024-12604" + ], + "details": "Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misuse.This issue affects Tap&Sign App: before V.1.025.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12604" + }, + { + "type": "WEB", + "url": "https://docs.tapandsign.com/tap-and-sign/tap-and-sign-v.1.025-surum-notlari" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-25-0063" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-526" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T15:15:36Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-7x43-2wrq-hv78/GHSA-7x43-2wrq-hv78.json b/advisories/unreviewed/2025/03/GHSA-7x43-2wrq-hv78/GHSA-7x43-2wrq-hv78.json index 7517fc2b5a8..10a86ffc178 100644 --- a/advisories/unreviewed/2025/03/GHSA-7x43-2wrq-hv78/GHSA-7x43-2wrq-hv78.json +++ b/advisories/unreviewed/2025/03/GHSA-7x43-2wrq-hv78/GHSA-7x43-2wrq-hv78.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7x43-2wrq-hv78", - "modified": "2025-03-10T00:30:51Z", + "modified": "2025-03-10T15:30:46Z", "published": "2025-03-10T00:30:51Z", "aliases": [ "CVE-2025-2130" @@ -23,6 +23,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2130" }, + { + "type": "WEB", + "url": "https://github.com/janssensjelle/published-pocs/blob/main/openxe-xss-ticket.md" + }, { "type": "WEB", "url": "https://vuldb.com/?ctiid.299050" diff --git a/advisories/unreviewed/2025/03/GHSA-93g2-pf5q-hqxr/GHSA-93g2-pf5q-hqxr.json b/advisories/unreviewed/2025/03/GHSA-93g2-pf5q-hqxr/GHSA-93g2-pf5q-hqxr.json new file mode 100644 index 00000000000..43413400422 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-93g2-pf5q-hqxr/GHSA-93g2-pf5q-hqxr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-93g2-pf5q-hqxr", + "modified": "2025-03-10T15:30:49Z", + "published": "2025-03-10T15:30:49Z", + "aliases": [ + "CVE-2025-26936" + ], + "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in NotFound Fresh Framework allows Code Injection. This issue affects Fresh Framework: from n/a through 1.70.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26936" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/fresh-framework/vulnerability/wordpress-fresh-framework-plugin-1-70-0-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T15:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-jfwf-rfmg-7f8m/GHSA-jfwf-rfmg-7f8m.json b/advisories/unreviewed/2025/03/GHSA-jfwf-rfmg-7f8m/GHSA-jfwf-rfmg-7f8m.json index da0fc6f04ac..1a4d179437f 100644 --- a/advisories/unreviewed/2025/03/GHSA-jfwf-rfmg-7f8m/GHSA-jfwf-rfmg-7f8m.json +++ b/advisories/unreviewed/2025/03/GHSA-jfwf-rfmg-7f8m/GHSA-jfwf-rfmg-7f8m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jfwf-rfmg-7f8m", - "modified": "2025-03-10T00:30:51Z", + "modified": "2025-03-10T15:30:46Z", "published": "2025-03-08T21:30:52Z", "aliases": [ "CVE-2025-27840" @@ -19,6 +19,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27840" }, + { + "type": "WEB", + "url": "https://cheriot.org/auditing/backdoor/2025/03/09/no-esp32-style-backdoor.html" + }, + { + "type": "WEB", + "url": "https://darkmentor.com/blog/esp32_non-backdoor" + }, { "type": "WEB", "url": "https://flyingpenguin.com/?p=67838" @@ -31,10 +39,22 @@ "type": "WEB", "url": "https://github.com/em0gi/CVE-2025-27840" }, + { + "type": "WEB", + "url": "https://github.com/esphome/esphome/discussions/8382" + }, { "type": "WEB", "url": "https://github.com/orgs/espruino/discussions/7699" }, + { + "type": "WEB", + "url": "https://news.ycombinator.com/item?id=43301369" + }, + { + "type": "WEB", + "url": "https://news.ycombinator.com/item?id=43308740" + }, { "type": "WEB", "url": "https://reg.rootedcon.com/cfp/schedule/talk/5" diff --git a/advisories/unreviewed/2025/03/GHSA-jqm9-2gmg-74hr/GHSA-jqm9-2gmg-74hr.json b/advisories/unreviewed/2025/03/GHSA-jqm9-2gmg-74hr/GHSA-jqm9-2gmg-74hr.json new file mode 100644 index 00000000000..bb83c868ff1 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-jqm9-2gmg-74hr/GHSA-jqm9-2gmg-74hr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jqm9-2gmg-74hr", + "modified": "2025-03-10T15:30:49Z", + "published": "2025-03-10T15:30:49Z", + "aliases": [ + "CVE-2025-26910" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit allows Stored XSS. This issue affects WPBookit: from n/a through 1.0.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26910" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wpbookit/vulnerability/wordpress-wpbookit-plugin-1-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T15:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-p9r8-xjx7-v86q/GHSA-p9r8-xjx7-v86q.json b/advisories/unreviewed/2025/03/GHSA-p9r8-xjx7-v86q/GHSA-p9r8-xjx7-v86q.json new file mode 100644 index 00000000000..00fe978bd56 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-p9r8-xjx7-v86q/GHSA-p9r8-xjx7-v86q.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p9r8-xjx7-v86q", + "modified": "2025-03-10T15:30:48Z", + "published": "2025-03-10T15:30:48Z", + "aliases": [ + "CVE-2025-26865" + ], + "details": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: from 18.12.17 before 18.12.18.  \n\nIt's a regression between 18.12.17 and 18.12.18.\nIn case you use something like that, which is not recommended!\nFor security, only official releases should be used.\n\nIn other words, if you use 18.12.17 you are still safe.\nThe version 18.12.17 is not a affected.\nBut something between 18.12.17 and 18.12.18 is.\n\nIn that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26865" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/OFBIZ-12594" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/prb48ztk01bflyyjbl6p56wlcc1n5sz7" + }, + { + "type": "WEB", + "url": "https://ofbiz.apache.org/download.html" + }, + { + "type": "WEB", + "url": "https://ofbiz.apache.org/security.html" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/03/07/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1336" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T14:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-q2jx-5x2v-8hrm/GHSA-q2jx-5x2v-8hrm.json b/advisories/unreviewed/2025/03/GHSA-q2jx-5x2v-8hrm/GHSA-q2jx-5x2v-8hrm.json new file mode 100644 index 00000000000..1dc9517d5e7 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-q2jx-5x2v-8hrm/GHSA-q2jx-5x2v-8hrm.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q2jx-5x2v-8hrm", + "modified": "2025-03-10T15:30:49Z", + "published": "2025-03-10T15:30:48Z", + "aliases": [ + "CVE-2025-2153" + ], + "details": "A vulnerability, which was classified as critical, was found in HDF5 1.14.6. Affected is the function H5SM_delete of the file H5SM.c of the component h5 File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2153" + }, + { + "type": "WEB", + "url": "https://github.com/HDFGroup/hdf5/issues/5329" + }, + { + "type": "WEB", + "url": "https://github.com/sae-as-me/Crashes/raw/refs/heads/main/hdf5/h5_extended_crash.h5" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299064" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299064" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.510819" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T14:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-rrc2-m8v6-jh7q/GHSA-rrc2-m8v6-jh7q.json b/advisories/unreviewed/2025/03/GHSA-rrc2-m8v6-jh7q/GHSA-rrc2-m8v6-jh7q.json new file mode 100644 index 00000000000..c06a80ced58 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-rrc2-m8v6-jh7q/GHSA-rrc2-m8v6-jh7q.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rrc2-m8v6-jh7q", + "modified": "2025-03-10T15:30:47Z", + "published": "2025-03-10T15:30:47Z", + "aliases": [ + "CVE-2025-2151" + ], + "details": "A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2151" + }, + { + "type": "WEB", + "url": "https://github.com/assimp/assimp/issues/6016" + }, + { + "type": "WEB", + "url": "https://github.com/assimp/assimp/issues/6026" + }, + { + "type": "WEB", + "url": "https://github.com/sae-as-me/Crashes/raw/refs/heads/main/assimp/assimp_crash_1" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299062" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299062" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.510582" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T13:15:36Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-wrxx-v2cm-rh9h/GHSA-wrxx-v2cm-rh9h.json b/advisories/unreviewed/2025/03/GHSA-wrxx-v2cm-rh9h/GHSA-wrxx-v2cm-rh9h.json index 23e4d3b0c0b..a7157d092c6 100644 --- a/advisories/unreviewed/2025/03/GHSA-wrxx-v2cm-rh9h/GHSA-wrxx-v2cm-rh9h.json +++ b/advisories/unreviewed/2025/03/GHSA-wrxx-v2cm-rh9h/GHSA-wrxx-v2cm-rh9h.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-wrxx-v2cm-rh9h", - "modified": "2025-03-10T06:30:32Z", + "modified": "2025-03-10T15:30:46Z", "published": "2025-03-10T06:30:32Z", "aliases": [ "CVE-2024-11638" ], "details": "The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-03-10T06:15:20Z" diff --git a/advisories/unreviewed/2025/03/GHSA-x3gm-94wq-g975/GHSA-x3gm-94wq-g975.json b/advisories/unreviewed/2025/03/GHSA-x3gm-94wq-g975/GHSA-x3gm-94wq-g975.json new file mode 100644 index 00000000000..75635f1d323 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-x3gm-94wq-g975/GHSA-x3gm-94wq-g975.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x3gm-94wq-g975", + "modified": "2025-03-10T15:30:47Z", + "published": "2025-03-10T15:30:47Z", + "aliases": [ + "CVE-2025-2149" + ], + "details": "A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initialization. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2149" + }, + { + "type": "WEB", + "url": "https://github.com/pytorch/pytorch/issues/147818" + }, + { + "type": "WEB", + "url": "https://github.com/pytorch/pytorch/issues/147818#issue-2877301660" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.299060" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.299060" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.506563" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-665" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T13:15:36Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-x6h9-j33j-2wpw/GHSA-x6h9-j33j-2wpw.json b/advisories/unreviewed/2025/03/GHSA-x6h9-j33j-2wpw/GHSA-x6h9-j33j-2wpw.json new file mode 100644 index 00000000000..1d2e1e2e8c4 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-x6h9-j33j-2wpw/GHSA-x6h9-j33j-2wpw.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x6h9-j33j-2wpw", + "modified": "2025-03-10T15:30:49Z", + "published": "2025-03-10T15:30:49Z", + "aliases": [ + "CVE-2025-26933" + ], + "details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment allows PHP Local File Inclusion. This issue affects WC Place Order Without Payment: from n/a through 2.6.7.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26933" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/wordpress/plugin/wc-place-order-without-payment/vulnerability/wordpress-place-order-without-payment-for-woocommerce-plugin-2-6-7-local-file-inclusion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-98" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-10T15:15:37Z" + } +} \ No newline at end of file