Skip to content

Commit 5fd90fa

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7wwm-57j8-wx2j GHSA-63hr-jqx6-r6hw GHSA-7vx5-gmqw-3wfc GHSA-8hx5-5mh4-xhjv GHSA-8w5g-q885-39xw GHSA-9888-65w8-vw6m GHSA-9q78-jg46-rwj6 GHSA-cc6v-6w77-q59h GHSA-h2f3-9263-mhpx GHSA-h78x-26f7-7h7h GHSA-hqp6-q766-2qrf GHSA-q3cq-6xv8-j4p3 GHSA-rfmc-2hwr-mm4p GHSA-w62p-cm3c-7rfc GHSA-x255-qvfv-83jw
1 parent e4304e0 commit 5fd90fa

File tree

15 files changed

+355
-16
lines changed

15 files changed

+355
-16
lines changed

‎advisories/unreviewed/2023/09/GHSA-7wwm-57j8-wx2j/GHSA-7wwm-57j8-wx2j.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7wwm-57j8-wx2j",
4-
"modified": "2023-11-16T18:30:23Z",
4+
"modified": "2025-05-23T21:31:11Z",
55
"published": "2023-09-29T06:30:29Z",
66
"aliases": [
77
"CVE-2023-44466"

‎advisories/unreviewed/2025/05/GHSA-63hr-jqx6-r6hw/GHSA-63hr-jqx6-r6hw.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-7vx5-gmqw-3wfc/GHSA-7vx5-gmqw-3wfc.json

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7vx5-gmqw-3wfc",
4-
"modified": "2025-05-22T15:34:51Z",
4+
"modified": "2025-05-23T21:31:12Z",
55
"published": "2025-05-22T15:34:51Z",
66
"aliases": [
77
"CVE-2024-54188"
88
],
99
"details": "Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-200"
30+
],
31+
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2025-05-22T15:16:03Z"

‎advisories/unreviewed/2025/05/GHSA-8hx5-5mh4-xhjv/GHSA-8hx5-5mh4-xhjv.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8hx5-5mh4-xhjv",
4+
"modified": "2025-05-23T21:31:12Z",
5+
"published": "2025-05-23T21:31:12Z",
6+
"aliases": [
7+
"CVE-2025-48738"
8+
],
9+
"details": "An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows unauthenticated remote attackers to use the password reset feature without limits. This can lead to several consequences, including mailbox storage exhaustion for targeted users, reputation damage to the SMTP server, potentially causing it to be blacklisted, and overload of the SMTP server's outbound mail queue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48738"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEC-ADV-2025-003.md"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-770"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-05-23T20:15:25Z"
35+
}
36+
}

‎advisories/unreviewed/2025/05/GHSA-8w5g-q885-39xw/GHSA-8w5g-q885-39xw.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8w5g-q885-39xw",
4+
"modified": "2025-05-23T21:31:12Z",
5+
"published": "2025-05-23T21:31:12Z",
6+
"aliases": [
7+
"CVE-2025-48735"
8+
],
9+
"details": "A SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219 before 21.45.8.2.3_230220 allows remote attackers to obtain sensitive information from the database via crafted input in the request body.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48735"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://bositaly.it/wp-content/uploads/2025/04/CAMERA-VULNERABILITY-REPORT-SQL-INJECTION.pdf"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-05-23T20:15:25Z"
35+
}
36+
}

‎advisories/unreviewed/2025/05/GHSA-9888-65w8-vw6m/GHSA-9888-65w8-vw6m.json

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9888-65w8-vw6m",
4-
"modified": "2025-05-22T15:34:51Z",
4+
"modified": "2025-05-23T21:31:12Z",
55
"published": "2025-05-22T15:34:51Z",
66
"aliases": [
77
"CVE-2025-32813"
88
],
99
"details": "An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-77"
30+
],
31+
"severity": "HIGH",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2025-05-22T15:16:04Z"

‎advisories/unreviewed/2025/05/GHSA-9q78-jg46-rwj6/GHSA-9q78-jg46-rwj6.json

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9q78-jg46-rwj6",
4+
"modified": "2025-05-23T21:31:13Z",
5+
"published": "2025-05-23T21:31:13Z",
6+
"aliases": [
7+
"CVE-2025-5119"
8+
],
9+
"details": "A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_controller.php. The manipulation of the argument tag leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5119"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/404heihei/CVE/issues/5"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.310198"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.310198"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.555822"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-05-23T21:15:21Z"
51+
}
52+
}

‎advisories/unreviewed/2025/05/GHSA-cc6v-6w77-q59h/GHSA-cc6v-6w77-q59h.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cc6v-6w77-q59h",
4+
"modified": "2025-05-23T21:31:12Z",
5+
"published": "2025-05-23T21:31:12Z",
6+
"aliases": [
7+
"CVE-2025-48740"
8+
],
9+
"details": "A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows a remote attacker to trigger requests on their victim's behalf, if the attacker lures a privileged user, authenticated with basic authentication.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48740"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEC-ADV-2025-001.md"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-05-23T20:15:25Z"
35+
}
36+
}

‎advisories/unreviewed/2025/05/GHSA-h2f3-9263-mhpx/GHSA-h2f3-9263-mhpx.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-h78x-26f7-7h7h/GHSA-h78x-26f7-7h7h.json

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h78x-26f7-7h7h",
4+
"modified": "2025-05-23T21:31:12Z",
5+
"published": "2025-05-23T21:31:12Z",
6+
"aliases": [
7+
"CVE-2025-44998"
8+
],
9+
"details": "A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScript or HTML via injecting a crafted payload into the js-theme-3 parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-44998"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/l8BL/CVE-2025-44998"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/prasathmani/tinyfilemanager"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-05-23T19:15:22Z"
39+
}
40+
}

‎advisories/unreviewed/2025/05/GHSA-hqp6-q766-2qrf/GHSA-hqp6-q766-2qrf.json

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hqp6-q766-2qrf",
4+
"modified": "2025-05-23T21:31:12Z",
5+
"published": "2025-05-23T21:31:12Z",
6+
"aliases": [
7+
"CVE-2025-46176"
8+
],
9+
"details": "Hardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR-816L v2.06B01 allow attackers to remotely execute arbitrary commands via firmware analysis.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46176"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/namberino/cve/tree/main/CVE-2025-46176"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.dlink.com/en/security-bulletin"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-77"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-05-23T19:15:22Z"
39+
}
40+
}

‎advisories/unreviewed/2025/05/GHSA-q3cq-6xv8-j4p3/GHSA-q3cq-6xv8-j4p3.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-rfmc-2hwr-mm4p/GHSA-rfmc-2hwr-mm4p.json

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rfmc-2hwr-mm4p",
4-
"modified": "2025-05-23T18:32:13Z",
4+
"modified": "2025-05-23T21:31:12Z",
55
"published": "2025-05-23T18:32:13Z",
66
"aliases": [
77
"CVE-2024-51102"
88
],
99
"details": "PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/login.php via the username and password parameters.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2025-05-23T18:15:36Z"

0 commit comments

Comments
 (0)