Publish Advisories

GHSA-7g7f-62cf-q66h GHSA-g249-p996-qcgj GHSA-j588-583p-8qwm GHSA-mhw9-x46c-v6q4 GHSA-p44g-m5w8-gwhm
github · Feb 16, 2025 · 0a6eac8 · 0a6eac8
1 parent f991c27
commit 0a6eac8
Show file tree

Hide file tree

Showing 5 changed files with 197 additions and 1 deletion.
diff --git a/advisories/unreviewed/2025/02/GHSA-7g7f-62cf-q66h/GHSA-7g7f-62cf-q66h.json b/advisories/unreviewed/2025/02/GHSA-7g7f-62cf-q66h/GHSA-7g7f-62cf-q66h.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7g7f-62cf-q66h",
+  "modified": "2025-02-16T21:31:43Z",
+  "published": "2025-02-16T21:31:43Z",
+  "aliases": [
+    "CVE-2025-1359"
+  ],
+  "details": "A vulnerability, which was classified as problematic, has been found in SIAM Industria de Automação e Monitoramento SIAM 2.0. This issue affects some unknown processing of the file /qrcode.jsp. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1359"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.295967"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.295967"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.496171"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-16T20:15:08Z"
+  }
+}
diff --git a/advisories/unreviewed/2025/02/GHSA-g249-p996-qcgj/GHSA-g249-p996-qcgj.json b/advisories/unreviewed/2025/02/GHSA-g249-p996-qcgj/GHSA-g249-p996-qcgj.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g249-p996-qcgj",
+  "modified": "2025-02-16T21:31:43Z",
+  "published": "2025-02-16T21:31:43Z",
+  "aliases": [
+    "CVE-2025-1357"
+  ],
+  "details": "A vulnerability classified as problematic has been found in Seventh D-Guard up to 20250206. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1357"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.295965"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.295965"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.496137"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-16T19:15:09Z"
+  }
+}
diff --git a/advisories/unreviewed/2025/02/GHSA-j588-583p-8qwm/GHSA-j588-583p-8qwm.json b/advisories/unreviewed/2025/02/GHSA-j588-583p-8qwm/GHSA-j588-583p-8qwm.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j588-583p-8qwm",
+  "modified": "2025-02-16T21:31:43Z",
+  "published": "2025-02-16T21:31:43Z",
+  "aliases": [
+    "CVE-2025-1360"
+  ],
+  "details": "A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msg_to leads to cross site scripting. It is possible to launch the attack remotely. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1360"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.295968"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.295968"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.496469"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-16T21:15:09Z"
+  }
+}
diff --git a/advisories/unreviewed/2025/02/GHSA-mhw9-x46c-v6q4/GHSA-mhw9-x46c-v6q4.json b/advisories/unreviewed/2025/02/GHSA-mhw9-x46c-v6q4/GHSA-mhw9-x46c-v6q4.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mhw9-x46c-v6q4",
-  "modified": "2025-02-14T00:30:44Z",
+  "modified": "2025-02-16T21:31:43Z",
   "published": "2025-02-13T15:31:25Z",
   "aliases": [
     "CVE-2025-1094"
@@ -26,6 +26,10 @@
     {
       "type": "WEB",
       "url": "https://www.postgresql.org/support/security/CVE-2025-1094"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2025/02/16/3"
     }
   ],
   "database_specific": {

diff --git a/advisories/unreviewed/2025/02/GHSA-p44g-m5w8-gwhm/GHSA-p44g-m5w8-gwhm.json b/advisories/unreviewed/2025/02/GHSA-p44g-m5w8-gwhm/GHSA-p44g-m5w8-gwhm.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-p44g-m5w8-gwhm",
+  "modified": "2025-02-16T21:31:43Z",
+  "published": "2025-02-16T21:31:43Z",
+  "aliases": [
+    "CVE-2025-1358"
+  ],
+  "details": "A vulnerability classified as problematic was found in Pix Software Vivaz 6.0.10. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1358"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.295966"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.295966"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.496141"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-16T20:15:07Z"
+  }
+}