diff --git a/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json b/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json new file mode 100644 index 00000000000..1cd118d57ec --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json @@ -0,0 +1,330 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w3pj-wh35-fq8w", + "modified": "2025-02-05T15:32:03Z", + "published": "2025-02-05T15:32:02Z", + "aliases": [ + "CVE-2024-36404" + ], + "summary": "GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions", + "details": "### Summary\nRemote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input.\n\n### Details\nThe following methods pass XPath expressions to the `commons-jxpath` library which can execute arbitrary code and would be a security issue if the XPath expressions are provided by user input.\n\n* `org.geotools.appschema.util.XmlXpathUtilites.getXPathValues(NamespaceSupport, String, Document)`\n* `org.geotools.appschema.util.XmlXpathUtilites.countXPathNodes(NamespaceSupport, String, Document)`\n* `org.geotools.appschema.util.XmlXpathUtilites.getSingleXPathValue(NamespaceSupport, String, Document)`\n* `org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.get(Object, String, Class)`\n* `org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.set(Object, String, Object, Class)`\n* `org.geotools.data.complex.expression.MapPropertyAccessorFactory.new PropertyAccessor() {...}.get(Object, String, Class)`\n* `org.geotools.xsd.StreamingParser.StreamingParser(Configuration, InputStream, String)`\n\n### PoC\nThe following inputs to StreamingParser will delay the response by five seconds:\n```\n new org.geotools.xsd.StreamingParser(\n new org.geotools.filter.v1_0.OGCConfiguration(),\n new java.io.ByteArrayInputStream(\"\".getBytes()),\n \"java.lang.Thread.sleep(5000)\")\n .parse();\n```\n\n### Impact\n\nThis vulnerability can lead to executing arbitrary code.\n\n### Mitigation\n\nGeoTools can operate with reduced functionality by removing the `gt-complex` jar from your application. As an example of the impact application schema datastore would not function without the ability to use XPath expressions to query complex content.\n\nThe SourceForge download page lists drop-in-replacement jars for GeoTools: [31.1](https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1/), [30.3](https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download), [30.2](https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download), [29.2](https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download), [28.2](https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download), [27.5](https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download), [27.4](https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download), [26.7](https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download), [26.4](https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4/), [25.2](https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download), [24.0](https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download). These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.\n\n### References\nhttps://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv\nhttps://osgeo-org.atlassian.net/browse/GEOT-7587\nhttps://github.com/geotools/geotools/pull/4797\nhttps://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools:gt-app-schema" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "30.0" + }, + { + "fixed": "30.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools:gt-complex" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "30.0" + }, + { + "fixed": "30.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools.xsd:gt-xsd-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "30.0" + }, + { + "fixed": "30.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools:gt-app-schema" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "31.0" + }, + { + "fixed": "31.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools:gt-complex" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "31.0" + }, + { + "fixed": "31.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools.xsd:gt-xsd-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "31.0" + }, + { + "fixed": "31.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools:gt-app-schema" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "29.0" + }, + { + "fixed": "29.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools:gt-complex" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "29.0" + }, + { + "fixed": "29.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools.xsd:gt-xsd-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "29.0" + }, + { + "fixed": "29.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools:gt-app-schema" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "28.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools:gt-complex" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "28.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geotools.xsd:gt-xsd-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "28.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36404" + }, + { + "type": "WEB", + "url": "https://github.com/geotools/geotools/pull/4797" + }, + { + "type": "WEB", + "url": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download" + }, + { + "type": "WEB", + "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download" + }, + { + "type": "WEB", + "url": "https://osgeo-org.atlassian.net/browse/GEOT-7587" + }, + { + "type": "PACKAGE", + "url": "https://github.com/geotools/geotools" + }, + { + "type": "WEB", + "url": "https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-95" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-02-05T15:32:02Z", + "nvd_published_at": "2024-07-02T14:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xpjm-7phh-w9j8/GHSA-xpjm-7phh-w9j8.json b/advisories/unreviewed/2022/05/GHSA-xpjm-7phh-w9j8/GHSA-xpjm-7phh-w9j8.json index 1620021fb6a..4e30568c354 100644 --- a/advisories/unreviewed/2022/05/GHSA-xpjm-7phh-w9j8/GHSA-xpjm-7phh-w9j8.json +++ b/advisories/unreviewed/2022/05/GHSA-xpjm-7phh-w9j8/GHSA-xpjm-7phh-w9j8.json @@ -30,6 +30,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-121", "CWE-787" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2024/02/GHSA-p6cw-fvmc-r6vh/GHSA-p6cw-fvmc-r6vh.json b/advisories/unreviewed/2024/02/GHSA-p6cw-fvmc-r6vh/GHSA-p6cw-fvmc-r6vh.json index 0186bc2300c..3a9c32a9b44 100644 --- a/advisories/unreviewed/2024/02/GHSA-p6cw-fvmc-r6vh/GHSA-p6cw-fvmc-r6vh.json +++ b/advisories/unreviewed/2024/02/GHSA-p6cw-fvmc-r6vh/GHSA-p6cw-fvmc-r6vh.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-p6cw-fvmc-r6vh", - "modified": "2024-02-28T21:30:20Z", + "modified": "2025-02-05T15:32:18Z", "published": "2024-02-28T21:30:20Z", "aliases": [ "CVE-2023-51692" ], - "details": "Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.This issue affects Customer Reviews for WooCommerce: from n/a through 5.38.1.\n\n", + "details": "Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.This issue affects Customer Reviews for WooCommerce: from n/a through 5.38.1.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/unreviewed/2024/02/GHSA-phw2-9x34-48cx/GHSA-phw2-9x34-48cx.json b/advisories/unreviewed/2024/02/GHSA-phw2-9x34-48cx/GHSA-phw2-9x34-48cx.json index 0df55a1264e..f631b56b63e 100644 --- a/advisories/unreviewed/2024/02/GHSA-phw2-9x34-48cx/GHSA-phw2-9x34-48cx.json +++ b/advisories/unreviewed/2024/02/GHSA-phw2-9x34-48cx/GHSA-phw2-9x34-48cx.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-862" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/03/GHSA-q8qr-h4f9-2m78/GHSA-q8qr-h4f9-2m78.json b/advisories/unreviewed/2024/03/GHSA-q8qr-h4f9-2m78/GHSA-q8qr-h4f9-2m78.json index 2e8a7599944..912364f1bf6 100644 --- a/advisories/unreviewed/2024/03/GHSA-q8qr-h4f9-2m78/GHSA-q8qr-h4f9-2m78.json +++ b/advisories/unreviewed/2024/03/GHSA-q8qr-h4f9-2m78/GHSA-q8qr-h4f9-2m78.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q8qr-h4f9-2m78", - "modified": "2024-03-13T18:31:34Z", + "modified": "2025-02-05T15:32:18Z", "published": "2024-03-13T18:31:34Z", "aliases": [ "CVE-2024-1690" @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-862" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-8fp3-w5p8-ppf5/GHSA-8fp3-w5p8-ppf5.json b/advisories/unreviewed/2024/04/GHSA-8fp3-w5p8-ppf5/GHSA-8fp3-w5p8-ppf5.json index d3fb2db2fb4..9fde408bfad 100644 --- a/advisories/unreviewed/2024/04/GHSA-8fp3-w5p8-ppf5/GHSA-8fp3-w5p8-ppf5.json +++ b/advisories/unreviewed/2024/04/GHSA-8fp3-w5p8-ppf5/GHSA-8fp3-w5p8-ppf5.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-862" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-j5pj-g556-8w7q/GHSA-j5pj-g556-8w7q.json b/advisories/unreviewed/2024/04/GHSA-j5pj-g556-8w7q/GHSA-j5pj-g556-8w7q.json index ade3d129e7f..2f75d1177b3 100644 --- a/advisories/unreviewed/2024/04/GHSA-j5pj-g556-8w7q/GHSA-j5pj-g556-8w7q.json +++ b/advisories/unreviewed/2024/04/GHSA-j5pj-g556-8w7q/GHSA-j5pj-g556-8w7q.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-862" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-qg29-wgvq-qrjr/GHSA-qg29-wgvq-qrjr.json b/advisories/unreviewed/2024/04/GHSA-qg29-wgvq-qrjr/GHSA-qg29-wgvq-qrjr.json index 37b71e110bb..87c5d683662 100644 --- a/advisories/unreviewed/2024/04/GHSA-qg29-wgvq-qrjr/GHSA-qg29-wgvq-qrjr.json +++ b/advisories/unreviewed/2024/04/GHSA-qg29-wgvq-qrjr/GHSA-qg29-wgvq-qrjr.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/04/GHSA-rmrv-fwx3-pwq8/GHSA-rmrv-fwx3-pwq8.json b/advisories/unreviewed/2024/04/GHSA-rmrv-fwx3-pwq8/GHSA-rmrv-fwx3-pwq8.json index 7b903b7c1fc..19d5a0105f0 100644 --- a/advisories/unreviewed/2024/04/GHSA-rmrv-fwx3-pwq8/GHSA-rmrv-fwx3-pwq8.json +++ b/advisories/unreviewed/2024/04/GHSA-rmrv-fwx3-pwq8/GHSA-rmrv-fwx3-pwq8.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rmrv-fwx3-pwq8", - "modified": "2024-04-18T12:30:30Z", + "modified": "2025-02-05T15:32:18Z", "published": "2024-04-18T12:30:30Z", "aliases": [ "CVE-2024-32584" ], - "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StandaloneTech TeraWallet – For WooCommerce allows Stored XSS.This issue affects TeraWallet – For WooCommerce: from n/a through 1.5.0.\n\n", + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StandaloneTech TeraWallet – For WooCommerce allows Stored XSS.This issue affects TeraWallet – For WooCommerce: from n/a through 1.5.0.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/unreviewed/2024/05/GHSA-vhv4-rqjh-48r4/GHSA-vhv4-rqjh-48r4.json b/advisories/unreviewed/2024/05/GHSA-vhv4-rqjh-48r4/GHSA-vhv4-rqjh-48r4.json index 545f9a20698..687ef784073 100644 --- a/advisories/unreviewed/2024/05/GHSA-vhv4-rqjh-48r4/GHSA-vhv4-rqjh-48r4.json +++ b/advisories/unreviewed/2024/05/GHSA-vhv4-rqjh-48r4/GHSA-vhv4-rqjh-48r4.json @@ -37,7 +37,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/06/GHSA-3fc6-rfv9-rx3p/GHSA-3fc6-rfv9-rx3p.json b/advisories/unreviewed/2024/06/GHSA-3fc6-rfv9-rx3p/GHSA-3fc6-rfv9-rx3p.json index 78615d49f98..f9f92f13d1d 100644 --- a/advisories/unreviewed/2024/06/GHSA-3fc6-rfv9-rx3p/GHSA-3fc6-rfv9-rx3p.json +++ b/advisories/unreviewed/2024/06/GHSA-3fc6-rfv9-rx3p/GHSA-3fc6-rfv9-rx3p.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/06/GHSA-4hgh-53h4-32cw/GHSA-4hgh-53h4-32cw.json b/advisories/unreviewed/2024/06/GHSA-4hgh-53h4-32cw/GHSA-4hgh-53h4-32cw.json index eb1f26f00ff..10200d71061 100644 --- a/advisories/unreviewed/2024/06/GHSA-4hgh-53h4-32cw/GHSA-4hgh-53h4-32cw.json +++ b/advisories/unreviewed/2024/06/GHSA-4hgh-53h4-32cw/GHSA-4hgh-53h4-32cw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4hgh-53h4-32cw", - "modified": "2024-06-11T21:32:18Z", + "modified": "2025-02-05T15:32:19Z", "published": "2024-06-11T21:32:18Z", "aliases": [ "CVE-2024-5646" @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/06/GHSA-mxcr-f478-crp2/GHSA-mxcr-f478-crp2.json b/advisories/unreviewed/2024/06/GHSA-mxcr-f478-crp2/GHSA-mxcr-f478-crp2.json index b226d1f5976..881b850adc3 100644 --- a/advisories/unreviewed/2024/06/GHSA-mxcr-f478-crp2/GHSA-mxcr-f478-crp2.json +++ b/advisories/unreviewed/2024/06/GHSA-mxcr-f478-crp2/GHSA-mxcr-f478-crp2.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-640" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-m695-893g-ffg2/GHSA-m695-893g-ffg2.json b/advisories/unreviewed/2024/07/GHSA-m695-893g-ffg2/GHSA-m695-893g-ffg2.json index 1e74b45063e..cbd98ff651f 100644 --- a/advisories/unreviewed/2024/07/GHSA-m695-893g-ffg2/GHSA-m695-893g-ffg2.json +++ b/advisories/unreviewed/2024/07/GHSA-m695-893g-ffg2/GHSA-m695-893g-ffg2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m695-893g-ffg2", - "modified": "2024-07-31T12:31:47Z", + "modified": "2025-02-05T15:32:19Z", "published": "2024-07-31T12:31:47Z", "aliases": [ "CVE-2024-6725" diff --git a/advisories/unreviewed/2024/07/GHSA-wf2f-7965-9gx5/GHSA-wf2f-7965-9gx5.json b/advisories/unreviewed/2024/07/GHSA-wf2f-7965-9gx5/GHSA-wf2f-7965-9gx5.json index 85a8910bb6f..724499b4022 100644 --- a/advisories/unreviewed/2024/07/GHSA-wf2f-7965-9gx5/GHSA-wf2f-7965-9gx5.json +++ b/advisories/unreviewed/2024/07/GHSA-wf2f-7965-9gx5/GHSA-wf2f-7965-9gx5.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/08/GHSA-q46j-26g9-j9w4/GHSA-q46j-26g9-j9w4.json b/advisories/unreviewed/2024/08/GHSA-q46j-26g9-j9w4/GHSA-q46j-26g9-j9w4.json index 73eab3b9dab..4813854bd3d 100644 --- a/advisories/unreviewed/2024/08/GHSA-q46j-26g9-j9w4/GHSA-q46j-26g9-j9w4.json +++ b/advisories/unreviewed/2024/08/GHSA-q46j-26g9-j9w4/GHSA-q46j-26g9-j9w4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q46j-26g9-j9w4", - "modified": "2024-08-02T06:30:56Z", + "modified": "2025-02-05T15:32:19Z", "published": "2024-08-02T06:30:56Z", "aliases": [ "CVE-2024-7389" @@ -31,6 +31,10 @@ "type": "WEB", "url": "https://plugins.trac.wordpress.org/changeset/3047085/forminator/trunk/addons/pro/hubspot/lib/class-forminator-addon-hubspot-wp-api.php" }, + { + "type": "WEB", + "url": "https://www.vicarius.io/vsociety/posts/source-code-dive-to-hunt-for-secrets-in-forminator-code-cve-2024-7389" + }, { "type": "WEB", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=cve" diff --git a/advisories/unreviewed/2024/10/GHSA-3x48-c5fq-3p9x/GHSA-3x48-c5fq-3p9x.json b/advisories/unreviewed/2024/10/GHSA-3x48-c5fq-3p9x/GHSA-3x48-c5fq-3p9x.json index 9874a93fba8..cf583f417a5 100644 --- a/advisories/unreviewed/2024/10/GHSA-3x48-c5fq-3p9x/GHSA-3x48-c5fq-3p9x.json +++ b/advisories/unreviewed/2024/10/GHSA-3x48-c5fq-3p9x/GHSA-3x48-c5fq-3p9x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3x48-c5fq-3p9x", - "modified": "2024-10-26T12:30:43Z", + "modified": "2025-02-05T15:32:19Z", "published": "2024-10-26T12:30:43Z", "aliases": [ "CVE-2024-10402" diff --git a/advisories/unreviewed/2024/10/GHSA-g783-p3gp-4q89/GHSA-g783-p3gp-4q89.json b/advisories/unreviewed/2024/10/GHSA-g783-p3gp-4q89/GHSA-g783-p3gp-4q89.json index b01b47b16dc..220fa5882b3 100644 --- a/advisories/unreviewed/2024/10/GHSA-g783-p3gp-4q89/GHSA-g783-p3gp-4q89.json +++ b/advisories/unreviewed/2024/10/GHSA-g783-p3gp-4q89/GHSA-g783-p3gp-4q89.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-1336" + "CWE-1336", + "CWE-94" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-87m5-7j63-58f7/GHSA-87m5-7j63-58f7.json b/advisories/unreviewed/2024/11/GHSA-87m5-7j63-58f7/GHSA-87m5-7j63-58f7.json index 43395ae418f..db564253359 100644 --- a/advisories/unreviewed/2024/11/GHSA-87m5-7j63-58f7/GHSA-87m5-7j63-58f7.json +++ b/advisories/unreviewed/2024/11/GHSA-87m5-7j63-58f7/GHSA-87m5-7j63-58f7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-87m5-7j63-58f7", - "modified": "2024-11-07T15:31:52Z", + "modified": "2025-02-05T15:32:19Z", "published": "2024-11-07T15:31:52Z", "aliases": [ "CVE-2024-8442" diff --git a/advisories/unreviewed/2024/11/GHSA-cm4r-mgm8-xjxv/GHSA-cm4r-mgm8-xjxv.json b/advisories/unreviewed/2024/11/GHSA-cm4r-mgm8-xjxv/GHSA-cm4r-mgm8-xjxv.json index 9181271cb96..01d4ea195a5 100644 --- a/advisories/unreviewed/2024/11/GHSA-cm4r-mgm8-xjxv/GHSA-cm4r-mgm8-xjxv.json +++ b/advisories/unreviewed/2024/11/GHSA-cm4r-mgm8-xjxv/GHSA-cm4r-mgm8-xjxv.json @@ -38,6 +38,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-352", "CWE-862" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2024/12/GHSA-6wj8-68xj-h9xr/GHSA-6wj8-68xj-h9xr.json b/advisories/unreviewed/2024/12/GHSA-6wj8-68xj-h9xr/GHSA-6wj8-68xj-h9xr.json index bf3c6e3b033..fcd50733474 100644 --- a/advisories/unreviewed/2024/12/GHSA-6wj8-68xj-h9xr/GHSA-6wj8-68xj-h9xr.json +++ b/advisories/unreviewed/2024/12/GHSA-6wj8-68xj-h9xr/GHSA-6wj8-68xj-h9xr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6wj8-68xj-h9xr", - "modified": "2024-12-01T00:34:37Z", + "modified": "2025-02-05T15:32:20Z", "published": "2024-12-01T00:34:37Z", "aliases": [ "CVE-2024-53786" diff --git a/advisories/unreviewed/2024/12/GHSA-h2rw-3fh7-6vcc/GHSA-h2rw-3fh7-6vcc.json b/advisories/unreviewed/2024/12/GHSA-h2rw-3fh7-6vcc/GHSA-h2rw-3fh7-6vcc.json index 7b51ad7eba8..23f4cb56d46 100644 --- a/advisories/unreviewed/2024/12/GHSA-h2rw-3fh7-6vcc/GHSA-h2rw-3fh7-6vcc.json +++ b/advisories/unreviewed/2024/12/GHSA-h2rw-3fh7-6vcc/GHSA-h2rw-3fh7-6vcc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h2rw-3fh7-6vcc", - "modified": "2024-12-14T09:30:30Z", + "modified": "2025-02-05T15:32:20Z", "published": "2024-12-14T09:30:30Z", "aliases": [ "CVE-2024-11712" @@ -38,7 +38,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-359" + "CWE-359", + "CWE-862" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/01/GHSA-23f6-j7x4-jrjh/GHSA-23f6-j7x4-jrjh.json b/advisories/unreviewed/2025/01/GHSA-23f6-j7x4-jrjh/GHSA-23f6-j7x4-jrjh.json index dadae5b35ae..88df777328a 100644 --- a/advisories/unreviewed/2025/01/GHSA-23f6-j7x4-jrjh/GHSA-23f6-j7x4-jrjh.json +++ b/advisories/unreviewed/2025/01/GHSA-23f6-j7x4-jrjh/GHSA-23f6-j7x4-jrjh.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-23f6-j7x4-jrjh", - "modified": "2025-01-25T00:33:10Z", + "modified": "2025-02-05T15:32:21Z", "published": "2025-01-25T00:33:10Z", "aliases": [ "CVE-2024-50694" ], "details": "In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of the buffer that is used to store the message. This may lead to a stack-based buffer overflow.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-121" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-24T23:15:09Z" diff --git a/advisories/unreviewed/2025/01/GHSA-46pj-m82h-8px5/GHSA-46pj-m82h-8px5.json b/advisories/unreviewed/2025/01/GHSA-46pj-m82h-8px5/GHSA-46pj-m82h-8px5.json index 9ca34459b7b..6ce6254f3fe 100644 --- a/advisories/unreviewed/2025/01/GHSA-46pj-m82h-8px5/GHSA-46pj-m82h-8px5.json +++ b/advisories/unreviewed/2025/01/GHSA-46pj-m82h-8px5/GHSA-46pj-m82h-8px5.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-772" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/01/GHSA-j6w8-j3gw-86hg/GHSA-j6w8-j3gw-86hg.json b/advisories/unreviewed/2025/01/GHSA-j6w8-j3gw-86hg/GHSA-j6w8-j3gw-86hg.json index abb3dc34963..3749d928ad8 100644 --- a/advisories/unreviewed/2025/01/GHSA-j6w8-j3gw-86hg/GHSA-j6w8-j3gw-86hg.json +++ b/advisories/unreviewed/2025/01/GHSA-j6w8-j3gw-86hg/GHSA-j6w8-j3gw-86hg.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-829", "CWE-98" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2025/01/GHSA-jg2r-v58r-q7vh/GHSA-jg2r-v58r-q7vh.json b/advisories/unreviewed/2025/01/GHSA-jg2r-v58r-q7vh/GHSA-jg2r-v58r-q7vh.json index 78f1190880c..7ec2f030ab7 100644 --- a/advisories/unreviewed/2025/01/GHSA-jg2r-v58r-q7vh/GHSA-jg2r-v58r-q7vh.json +++ b/advisories/unreviewed/2025/01/GHSA-jg2r-v58r-q7vh/GHSA-jg2r-v58r-q7vh.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-jg2r-v58r-q7vh", - "modified": "2025-01-25T00:33:10Z", + "modified": "2025-02-05T15:32:21Z", "published": "2025-01-25T00:33:10Z", "aliases": [ "CVE-2024-50695" ], "details": "SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds checks.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-121" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-24T23:15:09Z" diff --git a/advisories/unreviewed/2025/01/GHSA-m3pc-rgm4-56jw/GHSA-m3pc-rgm4-56jw.json b/advisories/unreviewed/2025/01/GHSA-m3pc-rgm4-56jw/GHSA-m3pc-rgm4-56jw.json index e3b5ca2d706..846d88a6a27 100644 --- a/advisories/unreviewed/2025/01/GHSA-m3pc-rgm4-56jw/GHSA-m3pc-rgm4-56jw.json +++ b/advisories/unreviewed/2025/01/GHSA-m3pc-rgm4-56jw/GHSA-m3pc-rgm4-56jw.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-122", "CWE-787" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2025/01/GHSA-mc69-xrvc-fghx/GHSA-mc69-xrvc-fghx.json b/advisories/unreviewed/2025/01/GHSA-mc69-xrvc-fghx/GHSA-mc69-xrvc-fghx.json index 7510f2fc79b..de6e6ae51d5 100644 --- a/advisories/unreviewed/2025/01/GHSA-mc69-xrvc-fghx/GHSA-mc69-xrvc-fghx.json +++ b/advisories/unreviewed/2025/01/GHSA-mc69-xrvc-fghx/GHSA-mc69-xrvc-fghx.json @@ -53,7 +53,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-770" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/01/GHSA-p3qx-xphh-h4vv/GHSA-p3qx-xphh-h4vv.json b/advisories/unreviewed/2025/01/GHSA-p3qx-xphh-h4vv/GHSA-p3qx-xphh-h4vv.json index 375ebaf8f51..e9b5a37da7e 100644 --- a/advisories/unreviewed/2025/01/GHSA-p3qx-xphh-h4vv/GHSA-p3qx-xphh-h4vv.json +++ b/advisories/unreviewed/2025/01/GHSA-p3qx-xphh-h4vv/GHSA-p3qx-xphh-h4vv.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-1284" + ], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/01/GHSA-rj8h-6rc9-g7qx/GHSA-rj8h-6rc9-g7qx.json b/advisories/unreviewed/2025/01/GHSA-rj8h-6rc9-g7qx/GHSA-rj8h-6rc9-g7qx.json index 454b21d2d93..66252a491ac 100644 --- a/advisories/unreviewed/2025/01/GHSA-rj8h-6rc9-g7qx/GHSA-rj8h-6rc9-g7qx.json +++ b/advisories/unreviewed/2025/01/GHSA-rj8h-6rc9-g7qx/GHSA-rj8h-6rc9-g7qx.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-rj8h-6rc9-g7qx", - "modified": "2025-01-25T00:33:10Z", + "modified": "2025-02-05T15:32:21Z", "published": "2025-01-25T00:33:10Z", "aliases": [ "CVE-2024-50698" ], "details": "SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-122" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-24T23:15:09Z" diff --git a/advisories/unreviewed/2025/02/GHSA-3w7x-x254-3q76/GHSA-3w7x-x254-3q76.json b/advisories/unreviewed/2025/02/GHSA-3w7x-x254-3q76/GHSA-3w7x-x254-3q76.json index 548f1ff1713..10748fd7048 100644 --- a/advisories/unreviewed/2025/02/GHSA-3w7x-x254-3q76/GHSA-3w7x-x254-3q76.json +++ b/advisories/unreviewed/2025/02/GHSA-3w7x-x254-3q76/GHSA-3w7x-x254-3q76.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-125", "CWE-126" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2025/02/GHSA-72g2-5xcr-vjhp/GHSA-72g2-5xcr-vjhp.json b/advisories/unreviewed/2025/02/GHSA-72g2-5xcr-vjhp/GHSA-72g2-5xcr-vjhp.json index 75f7b546847..6e78519e26c 100644 --- a/advisories/unreviewed/2025/02/GHSA-72g2-5xcr-vjhp/GHSA-72g2-5xcr-vjhp.json +++ b/advisories/unreviewed/2025/02/GHSA-72g2-5xcr-vjhp/GHSA-72g2-5xcr-vjhp.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/02/GHSA-78m6-6g3f-hqw3/GHSA-78m6-6g3f-hqw3.json b/advisories/unreviewed/2025/02/GHSA-78m6-6g3f-hqw3/GHSA-78m6-6g3f-hqw3.json index 5b8a082a113..d5623ec8bb5 100644 --- a/advisories/unreviewed/2025/02/GHSA-78m6-6g3f-hqw3/GHSA-78m6-6g3f-hqw3.json +++ b/advisories/unreviewed/2025/02/GHSA-78m6-6g3f-hqw3/GHSA-78m6-6g3f-hqw3.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-125", "CWE-126" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2025/02/GHSA-994f-6382-qm9h/GHSA-994f-6382-qm9h.json b/advisories/unreviewed/2025/02/GHSA-994f-6382-qm9h/GHSA-994f-6382-qm9h.json index e3d4eb9f383..ce3639c08de 100644 --- a/advisories/unreviewed/2025/02/GHSA-994f-6382-qm9h/GHSA-994f-6382-qm9h.json +++ b/advisories/unreviewed/2025/02/GHSA-994f-6382-qm9h/GHSA-994f-6382-qm9h.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-125", "CWE-126" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2025/02/GHSA-c28f-6hfg-ffcc/GHSA-c28f-6hfg-ffcc.json b/advisories/unreviewed/2025/02/GHSA-c28f-6hfg-ffcc/GHSA-c28f-6hfg-ffcc.json index 229c7e634ba..948a587000b 100644 --- a/advisories/unreviewed/2025/02/GHSA-c28f-6hfg-ffcc/GHSA-c28f-6hfg-ffcc.json +++ b/advisories/unreviewed/2025/02/GHSA-c28f-6hfg-ffcc/GHSA-c28f-6hfg-ffcc.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-125", "CWE-126" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2025/02/GHSA-cc57-hgv8-p56r/GHSA-cc57-hgv8-p56r.json b/advisories/unreviewed/2025/02/GHSA-cc57-hgv8-p56r/GHSA-cc57-hgv8-p56r.json index 37fdb727bb9..3060c91ff42 100644 --- a/advisories/unreviewed/2025/02/GHSA-cc57-hgv8-p56r/GHSA-cc57-hgv8-p56r.json +++ b/advisories/unreviewed/2025/02/GHSA-cc57-hgv8-p56r/GHSA-cc57-hgv8-p56r.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-cc57-hgv8-p56r", - "modified": "2025-02-05T12:33:07Z", + "modified": "2025-02-05T15:32:25Z", "published": "2025-02-05T12:33:07Z", "aliases": [ "CVE-2025-0665" ], "details": "libcurl would wrongly close the same eventfd file descriptor twice when taking\ndown a connection channel after having completed a threaded name resolve.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -32,8 +37,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-1341" + ], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-05T10:15:22Z" diff --git a/advisories/unreviewed/2025/02/GHSA-cq9j-gc99-j3w6/GHSA-cq9j-gc99-j3w6.json b/advisories/unreviewed/2025/02/GHSA-cq9j-gc99-j3w6/GHSA-cq9j-gc99-j3w6.json index 19416e96920..ffae2078f43 100644 --- a/advisories/unreviewed/2025/02/GHSA-cq9j-gc99-j3w6/GHSA-cq9j-gc99-j3w6.json +++ b/advisories/unreviewed/2025/02/GHSA-cq9j-gc99-j3w6/GHSA-cq9j-gc99-j3w6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cq9j-gc99-j3w6", - "modified": "2025-02-04T09:31:07Z", + "modified": "2025-02-05T15:32:24Z", "published": "2025-02-04T09:31:07Z", "aliases": [ "CVE-2024-12597" diff --git a/advisories/unreviewed/2025/02/GHSA-fq8v-wjfj-2725/GHSA-fq8v-wjfj-2725.json b/advisories/unreviewed/2025/02/GHSA-fq8v-wjfj-2725/GHSA-fq8v-wjfj-2725.json new file mode 100644 index 00000000000..9d07c5e440e --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-fq8v-wjfj-2725/GHSA-fq8v-wjfj-2725.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fq8v-wjfj-2725", + "modified": "2025-02-05T15:32:24Z", + "published": "2025-02-05T15:32:24Z", + "aliases": [ + "CVE-2024-9097" + ], + "details": "ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9097" + }, + { + "type": "WEB", + "url": "https://www.manageengine.com/products/desktop-central/cve-2024-9097.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-05T13:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-g9j4-5rrw-7gvr/GHSA-g9j4-5rrw-7gvr.json b/advisories/unreviewed/2025/02/GHSA-g9j4-5rrw-7gvr/GHSA-g9j4-5rrw-7gvr.json index 48636a34690..2e9da225d2c 100644 --- a/advisories/unreviewed/2025/02/GHSA-g9j4-5rrw-7gvr/GHSA-g9j4-5rrw-7gvr.json +++ b/advisories/unreviewed/2025/02/GHSA-g9j4-5rrw-7gvr/GHSA-g9j4-5rrw-7gvr.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-126" + "CWE-126", + "CWE-416" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/02/GHSA-h34r-pgxj-xwh9/GHSA-h34r-pgxj-xwh9.json b/advisories/unreviewed/2025/02/GHSA-h34r-pgxj-xwh9/GHSA-h34r-pgxj-xwh9.json new file mode 100644 index 00000000000..1eead888812 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-h34r-pgxj-xwh9/GHSA-h34r-pgxj-xwh9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h34r-pgxj-xwh9", + "modified": "2025-02-05T15:32:24Z", + "published": "2025-02-05T15:32:24Z", + "aliases": [ + "CVE-2025-21117" + ], + "details": "Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vulnerability, leading to fully impersonating the user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21117" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000281275/dsa-2025-071-security-update-for-dell-avamar-for-multiple-component-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-672" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-05T14:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-j3rg-cj85-6mq6/GHSA-j3rg-cj85-6mq6.json b/advisories/unreviewed/2025/02/GHSA-j3rg-cj85-6mq6/GHSA-j3rg-cj85-6mq6.json new file mode 100644 index 00000000000..0f24bb55d83 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-j3rg-cj85-6mq6/GHSA-j3rg-cj85-6mq6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j3rg-cj85-6mq6", + "modified": "2025-02-05T15:32:24Z", + "published": "2025-02-05T15:32:24Z", + "aliases": [ + "CVE-2025-0858" + ], + "details": "A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in Poly Edge E devices. The firmware flaw does not properly prevent path traversal and could lead to information disclosure.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0858" + }, + { + "type": "WEB", + "url": "https://support.hp.com/us-en/document/ish_11926124-11926148-16/hpsbpy03996" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-35" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-05T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-m4hr-g8rp-8xv4/GHSA-m4hr-g8rp-8xv4.json b/advisories/unreviewed/2025/02/GHSA-m4hr-g8rp-8xv4/GHSA-m4hr-g8rp-8xv4.json index 5f9abfe4a4c..5bbbaa83502 100644 --- a/advisories/unreviewed/2025/02/GHSA-m4hr-g8rp-8xv4/GHSA-m4hr-g8rp-8xv4.json +++ b/advisories/unreviewed/2025/02/GHSA-m4hr-g8rp-8xv4/GHSA-m4hr-g8rp-8xv4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m4hr-g8rp-8xv4", - "modified": "2025-02-05T00:31:13Z", + "modified": "2025-02-05T15:32:24Z", "published": "2025-02-05T00:31:13Z", "aliases": [ "CVE-2024-11467" @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-269" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/02/GHSA-mx9x-fhqg-ggrp/GHSA-mx9x-fhqg-ggrp.json b/advisories/unreviewed/2025/02/GHSA-mx9x-fhqg-ggrp/GHSA-mx9x-fhqg-ggrp.json new file mode 100644 index 00000000000..922faefed1a --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-mx9x-fhqg-ggrp/GHSA-mx9x-fhqg-ggrp.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mx9x-fhqg-ggrp", + "modified": "2025-02-05T15:32:24Z", + "published": "2025-02-05T15:32:24Z", + "aliases": [ + "CVE-2024-2878" + ], + "details": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2878" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/2416356" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/451918" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-05T13:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-v3wg-jg3p-qcmh/GHSA-v3wg-jg3p-qcmh.json b/advisories/unreviewed/2025/02/GHSA-v3wg-jg3p-qcmh/GHSA-v3wg-jg3p-qcmh.json new file mode 100644 index 00000000000..42011040243 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-v3wg-jg3p-qcmh/GHSA-v3wg-jg3p-qcmh.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v3wg-jg3p-qcmh", + "modified": "2025-02-05T15:32:20Z", + "published": "2025-02-05T15:32:20Z", + "aliases": [ + "CVE-2024-10696" + ], + "details": "The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.8 via the show_template due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to expose the contents of draft, private, and pending posts.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10696" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/ultraaddons-elementor-lite/trunk/inc/wp/shortcode.php#L16" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/719de6e5-29c5-4303-981d-81840939a0b1?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-21T11:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-vvqh-cqpj-5537/GHSA-vvqh-cqpj-5537.json b/advisories/unreviewed/2025/02/GHSA-vvqh-cqpj-5537/GHSA-vvqh-cqpj-5537.json index 2d385486ccd..dadc3c96148 100644 --- a/advisories/unreviewed/2025/02/GHSA-vvqh-cqpj-5537/GHSA-vvqh-cqpj-5537.json +++ b/advisories/unreviewed/2025/02/GHSA-vvqh-cqpj-5537/GHSA-vvqh-cqpj-5537.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-vvqh-cqpj-5537", - "modified": "2025-02-05T12:33:07Z", + "modified": "2025-02-05T15:32:24Z", "published": "2025-02-05T12:33:07Z", "aliases": [ "CVE-2025-0725" ], "details": "When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], "affected": [], "references": [ { @@ -33,7 +38,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-02-05T10:15:22Z" diff --git a/advisories/unreviewed/2025/02/GHSA-ww43-j493-q3f2/GHSA-ww43-j493-q3f2.json b/advisories/unreviewed/2025/02/GHSA-ww43-j493-q3f2/GHSA-ww43-j493-q3f2.json index 7902c817ce6..2756dacf8e9 100644 --- a/advisories/unreviewed/2025/02/GHSA-ww43-j493-q3f2/GHSA-ww43-j493-q3f2.json +++ b/advisories/unreviewed/2025/02/GHSA-ww43-j493-q3f2/GHSA-ww43-j493-q3f2.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-787" ], "severity": "MODERATE", "github_reviewed": false,