diff --git a/advisories/unreviewed/2024/01/GHSA-8223-5qc2-w3gf/GHSA-8223-5qc2-w3gf.json b/advisories/unreviewed/2024/01/GHSA-8223-5qc2-w3gf/GHSA-8223-5qc2-w3gf.json index 545f61ef428..b412192c66e 100644 --- a/advisories/unreviewed/2024/01/GHSA-8223-5qc2-w3gf/GHSA-8223-5qc2-w3gf.json +++ b/advisories/unreviewed/2024/01/GHSA-8223-5qc2-w3gf/GHSA-8223-5qc2-w3gf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8223-5qc2-w3gf", - "modified": "2024-01-18T15:30:36Z", + "modified": "2025-06-06T21:30:24Z", "published": "2024-01-11T03:30:29Z", "aliases": [ "CVE-2023-51073" diff --git a/advisories/unreviewed/2024/02/GHSA-5ppc-gr6c-jgcj/GHSA-5ppc-gr6c-jgcj.json b/advisories/unreviewed/2024/02/GHSA-5ppc-gr6c-jgcj/GHSA-5ppc-gr6c-jgcj.json index 761c3bed34a..e5766a74934 100644 --- a/advisories/unreviewed/2024/02/GHSA-5ppc-gr6c-jgcj/GHSA-5ppc-gr6c-jgcj.json +++ b/advisories/unreviewed/2024/02/GHSA-5ppc-gr6c-jgcj/GHSA-5ppc-gr6c-jgcj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5ppc-gr6c-jgcj", - "modified": "2024-02-07T18:30:27Z", + "modified": "2025-06-06T21:30:24Z", "published": "2024-02-02T03:30:32Z", "aliases": [ "CVE-2024-22900" diff --git a/advisories/unreviewed/2024/07/GHSA-jjrp-3hrg-cj26/GHSA-jjrp-3hrg-cj26.json b/advisories/unreviewed/2024/07/GHSA-jjrp-3hrg-cj26/GHSA-jjrp-3hrg-cj26.json index 4b8b0b44dba..6c65f2e737a 100644 --- a/advisories/unreviewed/2024/07/GHSA-jjrp-3hrg-cj26/GHSA-jjrp-3hrg-cj26.json +++ b/advisories/unreviewed/2024/07/GHSA-jjrp-3hrg-cj26/GHSA-jjrp-3hrg-cj26.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jjrp-3hrg-cj26", - "modified": "2024-08-01T15:31:55Z", + "modified": "2025-06-06T21:30:25Z", "published": "2024-07-10T21:30:39Z", "aliases": [ "CVE-2024-6236" ], "details": "Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2025/06/GHSA-23w7-3gw5-5jqr/GHSA-23w7-3gw5-5jqr.json b/advisories/unreviewed/2025/06/GHSA-23w7-3gw5-5jqr/GHSA-23w7-3gw5-5jqr.json new file mode 100644 index 00000000000..7f46f158026 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-23w7-3gw5-5jqr/GHSA-23w7-3gw5-5jqr.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-23w7-3gw5-5jqr", + "modified": "2025-06-06T21:30:27Z", + "published": "2025-06-06T21:30:27Z", + "aliases": [ + "CVE-2025-5473" + ], + "details": "GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26752.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5473" + }, + { + "type": "WEB", + "url": "https://www.gimp.org/news/2025/05/18/gimp-3-0-4-released/#general-bugfixes" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-321" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-2gpq-3p2h-4848/GHSA-2gpq-3p2h-4848.json b/advisories/unreviewed/2025/06/GHSA-2gpq-3p2h-4848/GHSA-2gpq-3p2h-4848.json new file mode 100644 index 00000000000..c23cf940150 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-2gpq-3p2h-4848/GHSA-2gpq-3p2h-4848.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2gpq-3p2h-4848", + "modified": "2025-06-06T21:30:28Z", + "published": "2025-06-06T21:30:27Z", + "aliases": [ + "CVE-2025-5474" + ], + "details": "2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of 2BrightSparks SyncBackFree. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. User interaction on the part of an administrator is also required.\n\nThe specific flaw exists within the Mirror functionality. By creating a junction, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26962.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5474" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-322" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-59" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-4ggm-6pw7-9w49/GHSA-4ggm-6pw7-9w49.json b/advisories/unreviewed/2025/06/GHSA-4ggm-6pw7-9w49/GHSA-4ggm-6pw7-9w49.json index 8821559764a..99bd50d9535 100644 --- a/advisories/unreviewed/2025/06/GHSA-4ggm-6pw7-9w49/GHSA-4ggm-6pw7-9w49.json +++ b/advisories/unreviewed/2025/06/GHSA-4ggm-6pw7-9w49/GHSA-4ggm-6pw7-9w49.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-6h2g-7w8f-c35g/GHSA-6h2g-7w8f-c35g.json b/advisories/unreviewed/2025/06/GHSA-6h2g-7w8f-c35g/GHSA-6h2g-7w8f-c35g.json index 9c4d6519b78..8ff5a5e29fb 100644 --- a/advisories/unreviewed/2025/06/GHSA-6h2g-7w8f-c35g/GHSA-6h2g-7w8f-c35g.json +++ b/advisories/unreviewed/2025/06/GHSA-6h2g-7w8f-c35g/GHSA-6h2g-7w8f-c35g.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-6q88-jj95-59m6/GHSA-6q88-jj95-59m6.json b/advisories/unreviewed/2025/06/GHSA-6q88-jj95-59m6/GHSA-6q88-jj95-59m6.json new file mode 100644 index 00000000000..b7b88cec298 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-6q88-jj95-59m6/GHSA-6q88-jj95-59m6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6q88-jj95-59m6", + "modified": "2025-06-06T21:30:28Z", + "published": "2025-06-06T21:30:28Z", + "aliases": [ + "CVE-2025-5481" + ], + "details": "Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26168.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5481" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-324" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-7478-8pwj-vcwr/GHSA-7478-8pwj-vcwr.json b/advisories/unreviewed/2025/06/GHSA-7478-8pwj-vcwr/GHSA-7478-8pwj-vcwr.json new file mode 100644 index 00000000000..8a10a319bd7 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-7478-8pwj-vcwr/GHSA-7478-8pwj-vcwr.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7478-8pwj-vcwr", + "modified": "2025-06-06T21:30:27Z", + "published": "2025-06-06T21:30:27Z", + "aliases": [ + "CVE-2025-2766" + ], + "details": "70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of 70mai A510. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the default configuration of user accounts. The configuration contains default password. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the root. Was ZDI-CAN-24996.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2766" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-180" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1393" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-766x-w9p6-xvv5/GHSA-766x-w9p6-xvv5.json b/advisories/unreviewed/2025/06/GHSA-766x-w9p6-xvv5/GHSA-766x-w9p6-xvv5.json index 0c6e772b170..7672d9cf848 100644 --- a/advisories/unreviewed/2025/06/GHSA-766x-w9p6-xvv5/GHSA-766x-w9p6-xvv5.json +++ b/advisories/unreviewed/2025/06/GHSA-766x-w9p6-xvv5/GHSA-766x-w9p6-xvv5.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-8xvg-mg9p-8gj5/GHSA-8xvg-mg9p-8gj5.json b/advisories/unreviewed/2025/06/GHSA-8xvg-mg9p-8gj5/GHSA-8xvg-mg9p-8gj5.json new file mode 100644 index 00000000000..9036b86ed89 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-8xvg-mg9p-8gj5/GHSA-8xvg-mg9p-8gj5.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8xvg-mg9p-8gj5", + "modified": "2025-06-06T21:30:28Z", + "published": "2025-06-06T21:30:28Z", + "aliases": [ + "CVE-2025-5796" + ], + "details": "A vulnerability has been found in code-projects Laundry System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /data/edit_type.php. The manipulation of the argument Type leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5796" + }, + { + "type": "WEB", + "url": "https://github.com/tuooo/CVE/issues/8" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311350" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311350" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.591267" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-96cw-54gr-f4q9/GHSA-96cw-54gr-f4q9.json b/advisories/unreviewed/2025/06/GHSA-96cw-54gr-f4q9/GHSA-96cw-54gr-f4q9.json index 498611b254d..1d8f51d1e30 100644 --- a/advisories/unreviewed/2025/06/GHSA-96cw-54gr-f4q9/GHSA-96cw-54gr-f4q9.json +++ b/advisories/unreviewed/2025/06/GHSA-96cw-54gr-f4q9/GHSA-96cw-54gr-f4q9.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-77" + "CWE-77", + "CWE-78" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-c45x-4cr6-92hc/GHSA-c45x-4cr6-92hc.json b/advisories/unreviewed/2025/06/GHSA-c45x-4cr6-92hc/GHSA-c45x-4cr6-92hc.json new file mode 100644 index 00000000000..0fa43f2772f --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-c45x-4cr6-92hc/GHSA-c45x-4cr6-92hc.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c45x-4cr6-92hc", + "modified": "2025-06-06T21:30:29Z", + "published": "2025-06-06T21:30:28Z", + "aliases": [ + "CVE-2025-5798" + ], + "details": "A vulnerability was found in Tenda AC8 16.03.34.09. It has been classified as critical. Affected is the function fromSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument timeType leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5798" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/Tenda-AC8-fromSetSysTime-20a53a41781f807b9489fff42f262e11?source=copy_link" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311352" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311352" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.591266" + }, + { + "type": "WEB", + "url": "https://www.tenda.com.cn" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T20:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-cp34-r5vc-7cw6/GHSA-cp34-r5vc-7cw6.json b/advisories/unreviewed/2025/06/GHSA-cp34-r5vc-7cw6/GHSA-cp34-r5vc-7cw6.json index db3068fbfa7..81412850af2 100644 --- a/advisories/unreviewed/2025/06/GHSA-cp34-r5vc-7cw6/GHSA-cp34-r5vc-7cw6.json +++ b/advisories/unreviewed/2025/06/GHSA-cp34-r5vc-7cw6/GHSA-cp34-r5vc-7cw6.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-119" + "CWE-119", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-cvrx-7jm4-3pg5/GHSA-cvrx-7jm4-3pg5.json b/advisories/unreviewed/2025/06/GHSA-cvrx-7jm4-3pg5/GHSA-cvrx-7jm4-3pg5.json index 13fa643f4a0..bbb16c35b07 100644 --- a/advisories/unreviewed/2025/06/GHSA-cvrx-7jm4-3pg5/GHSA-cvrx-7jm4-3pg5.json +++ b/advisories/unreviewed/2025/06/GHSA-cvrx-7jm4-3pg5/GHSA-cvrx-7jm4-3pg5.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-f35w-jcp9-579f/GHSA-f35w-jcp9-579f.json b/advisories/unreviewed/2025/06/GHSA-f35w-jcp9-579f/GHSA-f35w-jcp9-579f.json new file mode 100644 index 00000000000..edb27e93a69 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-f35w-jcp9-579f/GHSA-f35w-jcp9-579f.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f35w-jcp9-579f", + "modified": "2025-06-06T21:30:28Z", + "published": "2025-06-06T21:30:28Z", + "aliases": [ + "CVE-2025-5795" + ], + "details": "A vulnerability, which was classified as critical, was found in Tenda AC5 1.0/15.03.06.47. This affects the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5795" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/Tenda-AC5-fromadvsetlanip-20a53a41781f805389dcd51fa04bc530?source=copy_link" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311349" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311349" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.591224" + }, + { + "type": "WEB", + "url": "https://www.tenda.com.cn" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-fv7p-hwfv-6f8q/GHSA-fv7p-hwfv-6f8q.json b/advisories/unreviewed/2025/06/GHSA-fv7p-hwfv-6f8q/GHSA-fv7p-hwfv-6f8q.json new file mode 100644 index 00000000000..6baad6f3398 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-fv7p-hwfv-6f8q/GHSA-fv7p-hwfv-6f8q.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fv7p-hwfv-6f8q", + "modified": "2025-06-06T21:30:28Z", + "published": "2025-06-06T21:30:28Z", + "aliases": [ + "CVE-2025-5797" + ], + "details": "A vulnerability was found in code-projects Laundry System 1.0 and classified as problematic. This issue affects some unknown processing of the file /data/insert_type.php. The manipulation of the argument Type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5797" + }, + { + "type": "WEB", + "url": "https://github.com/tuooo/CVE/issues/9" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311351" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311351" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.591315" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-ggmv-5gc5-hf2v/GHSA-ggmv-5gc5-hf2v.json b/advisories/unreviewed/2025/06/GHSA-ggmv-5gc5-hf2v/GHSA-ggmv-5gc5-hf2v.json new file mode 100644 index 00000000000..bbe65c053ef --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-ggmv-5gc5-hf2v/GHSA-ggmv-5gc5-hf2v.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ggmv-5gc5-hf2v", + "modified": "2025-06-06T21:30:27Z", + "published": "2025-06-06T21:30:27Z", + "aliases": [ + "CVE-2025-5480" + ], + "details": "Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Action1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26767.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5480" + }, + { + "type": "WEB", + "url": "https://www.action1.com/blog/acknowledging-zdi-can-26767-high-severity-vulnerability-in-action1-agent" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-323" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-ghrm-9c9c-3r5v/GHSA-ghrm-9c9c-3r5v.json b/advisories/unreviewed/2025/06/GHSA-ghrm-9c9c-3r5v/GHSA-ghrm-9c9c-3r5v.json index 321b5a2beb2..c3dba22c781 100644 --- a/advisories/unreviewed/2025/06/GHSA-ghrm-9c9c-3r5v/GHSA-ghrm-9c9c-3r5v.json +++ b/advisories/unreviewed/2025/06/GHSA-ghrm-9c9c-3r5v/GHSA-ghrm-9c9c-3r5v.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-j94f-r4m9-43wp/GHSA-j94f-r4m9-43wp.json b/advisories/unreviewed/2025/06/GHSA-j94f-r4m9-43wp/GHSA-j94f-r4m9-43wp.json index 5d2a1aec511..6e9f46b2658 100644 --- a/advisories/unreviewed/2025/06/GHSA-j94f-r4m9-43wp/GHSA-j94f-r4m9-43wp.json +++ b/advisories/unreviewed/2025/06/GHSA-j94f-r4m9-43wp/GHSA-j94f-r4m9-43wp.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-jm27-r34j-pr59/GHSA-jm27-r34j-pr59.json b/advisories/unreviewed/2025/06/GHSA-jm27-r34j-pr59/GHSA-jm27-r34j-pr59.json index 694b988c150..f1288c7d46f 100644 --- a/advisories/unreviewed/2025/06/GHSA-jm27-r34j-pr59/GHSA-jm27-r34j-pr59.json +++ b/advisories/unreviewed/2025/06/GHSA-jm27-r34j-pr59/GHSA-jm27-r34j-pr59.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-pg7c-c62x-457c/GHSA-pg7c-c62x-457c.json b/advisories/unreviewed/2025/06/GHSA-pg7c-c62x-457c/GHSA-pg7c-c62x-457c.json index 2346c1c46d6..ea813ff5916 100644 --- a/advisories/unreviewed/2025/06/GHSA-pg7c-c62x-457c/GHSA-pg7c-c62x-457c.json +++ b/advisories/unreviewed/2025/06/GHSA-pg7c-c62x-457c/GHSA-pg7c-c62x-457c.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-qv9v-4gh7-4qhp/GHSA-qv9v-4gh7-4qhp.json b/advisories/unreviewed/2025/06/GHSA-qv9v-4gh7-4qhp/GHSA-qv9v-4gh7-4qhp.json new file mode 100644 index 00000000000..7840bac9eb3 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-qv9v-4gh7-4qhp/GHSA-qv9v-4gh7-4qhp.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qv9v-4gh7-4qhp", + "modified": "2025-06-06T21:30:28Z", + "published": "2025-06-06T21:30:28Z", + "aliases": [ + "CVE-2025-5794" + ], + "details": "A vulnerability, which was classified as critical, has been found in Tenda AC5 15.03.06.47. Affected by this issue is the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5794" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/Tenda-AC5-formSetPPTPUserList-20a53a41781f806faf61cef61ed929c0?source=copy_link" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311348" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311348" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.591223" + }, + { + "type": "WEB", + "url": "https://www.tenda.com.cn" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-qvvf-8j8m-qq3w/GHSA-qvvf-8j8m-qq3w.json b/advisories/unreviewed/2025/06/GHSA-qvvf-8j8m-qq3w/GHSA-qvvf-8j8m-qq3w.json index 2b3a78aef8b..4dbbceaa564 100644 --- a/advisories/unreviewed/2025/06/GHSA-qvvf-8j8m-qq3w/GHSA-qvvf-8j8m-qq3w.json +++ b/advisories/unreviewed/2025/06/GHSA-qvvf-8j8m-qq3w/GHSA-qvvf-8j8m-qq3w.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-119" + "CWE-119", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-rpwp-653m-8vhf/GHSA-rpwp-653m-8vhf.json b/advisories/unreviewed/2025/06/GHSA-rpwp-653m-8vhf/GHSA-rpwp-653m-8vhf.json new file mode 100644 index 00000000000..7f64bc8a8f3 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-rpwp-653m-8vhf/GHSA-rpwp-653m-8vhf.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rpwp-653m-8vhf", + "modified": "2025-06-06T21:30:29Z", + "published": "2025-06-06T21:30:29Z", + "aliases": [ + "CVE-2025-5799" + ], + "details": "A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. Affected by this vulnerability is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5799" + }, + { + "type": "WEB", + "url": "https://lavender-bicycle-a5a.notion.site/Tenda-AC8-fromSetWirelessRepeat-20a53a41781f803d9156f0babaf94fca?source=copy_link" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.311353" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.311353" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.591270" + }, + { + "type": "WEB", + "url": "https://www.tenda.com.cn" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T20:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-rvhr-6hhp-7p92/GHSA-rvhr-6hhp-7p92.json b/advisories/unreviewed/2025/06/GHSA-rvhr-6hhp-7p92/GHSA-rvhr-6hhp-7p92.json index 4b3c963c537..7a5da97c2b1 100644 --- a/advisories/unreviewed/2025/06/GHSA-rvhr-6hhp-7p92/GHSA-rvhr-6hhp-7p92.json +++ b/advisories/unreviewed/2025/06/GHSA-rvhr-6hhp-7p92/GHSA-rvhr-6hhp-7p92.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-vhq3-h89q-3rqx/GHSA-vhq3-h89q-3rqx.json b/advisories/unreviewed/2025/06/GHSA-vhq3-h89q-3rqx/GHSA-vhq3-h89q-3rqx.json index 47f639cbf88..cd045db6c61 100644 --- a/advisories/unreviewed/2025/06/GHSA-vhq3-h89q-3rqx/GHSA-vhq3-h89q-3rqx.json +++ b/advisories/unreviewed/2025/06/GHSA-vhq3-h89q-3rqx/GHSA-vhq3-h89q-3rqx.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-vmfp-2wcq-pwmg/GHSA-vmfp-2wcq-pwmg.json b/advisories/unreviewed/2025/06/GHSA-vmfp-2wcq-pwmg/GHSA-vmfp-2wcq-pwmg.json index 4453e8e2017..b98b611df97 100644 --- a/advisories/unreviewed/2025/06/GHSA-vmfp-2wcq-pwmg/GHSA-vmfp-2wcq-pwmg.json +++ b/advisories/unreviewed/2025/06/GHSA-vmfp-2wcq-pwmg/GHSA-vmfp-2wcq-pwmg.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-w2hq-6wrg-qrh6/GHSA-w2hq-6wrg-qrh6.json b/advisories/unreviewed/2025/06/GHSA-w2hq-6wrg-qrh6/GHSA-w2hq-6wrg-qrh6.json new file mode 100644 index 00000000000..ea347d692f2 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-w2hq-6wrg-qrh6/GHSA-w2hq-6wrg-qrh6.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w2hq-6wrg-qrh6", + "modified": "2025-06-06T21:30:27Z", + "published": "2025-06-06T21:30:27Z", + "aliases": [ + "CVE-2025-3485" + ], + "details": "Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the extractFileFromZip method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26524.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3485" + }, + { + "type": "WEB", + "url": "https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-2" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-254" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-06T19:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-w864-966p-qw8j/GHSA-w864-966p-qw8j.json b/advisories/unreviewed/2025/06/GHSA-w864-966p-qw8j/GHSA-w864-966p-qw8j.json index 6c81bd92b8c..d4e3516dd55 100644 --- a/advisories/unreviewed/2025/06/GHSA-w864-966p-qw8j/GHSA-w864-966p-qw8j.json +++ b/advisories/unreviewed/2025/06/GHSA-w864-966p-qw8j/GHSA-w864-966p-qw8j.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-x94v-5rvp-vf9c/GHSA-x94v-5rvp-vf9c.json b/advisories/unreviewed/2025/06/GHSA-x94v-5rvp-vf9c/GHSA-x94v-5rvp-vf9c.json index ce8c0a95794..790bf5f26eb 100644 --- a/advisories/unreviewed/2025/06/GHSA-x94v-5rvp-vf9c/GHSA-x94v-5rvp-vf9c.json +++ b/advisories/unreviewed/2025/06/GHSA-x94v-5rvp-vf9c/GHSA-x94v-5rvp-vf9c.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/06/GHSA-xqh6-qrw4-qhwj/GHSA-xqh6-qrw4-qhwj.json b/advisories/unreviewed/2025/06/GHSA-xqh6-qrw4-qhwj/GHSA-xqh6-qrw4-qhwj.json index 2f2aa08e677..5eef36f1150 100644 --- a/advisories/unreviewed/2025/06/GHSA-xqh6-qrw4-qhwj/GHSA-xqh6-qrw4-qhwj.json +++ b/advisories/unreviewed/2025/06/GHSA-xqh6-qrw4-qhwj/GHSA-xqh6-qrw4-qhwj.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false,