Skip to content

Commit 8faca16

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6w2p-cgh8-m9q9 GHSA-v2q6-5m4m-pr58 GHSA-g3x6-r9w9-mcxx GHSA-fcj3-9fc8-9489 GHSA-2wh3-fp99-rprg GHSA-683j-3v25-h2qg GHSA-6hw8-whvq-hmwp GHSA-7525-4vpp-3gq2 GHSA-grg9-576x-5279 GHSA-h9mg-jc7j-2rr2 GHSA-jjg2-f6h2-x2p6 GHSA-p4f9-mqjc-2hrf GHSA-qppv-c8jg-w628 GHSA-r448-hfqj-rxrc GHSA-rwr4-qw9c-fjxm GHSA-w5m4-587r-x2v2
1 parent 6382a69 commit 8faca16

File tree

16 files changed

+580
-4
lines changed

16 files changed

+580
-4
lines changed

‎advisories/unreviewed/2023/02/GHSA-6w2p-cgh8-m9q9/GHSA-6w2p-cgh8-m9q9.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6w2p-cgh8-m9q9",
4-
"modified": "2024-03-21T03:34:45Z",
4+
"modified": "2025-06-19T00:31:02Z",
55
"published": "2023-02-13T21:31:04Z",
66
"aliases": [
77
"CVE-2023-25718"
@@ -23,6 +23,10 @@
2323
"type": "WEB",
2424
"url": "https://cybir.com/2022/cve/connectwise-control-dns-spoofing-poc"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://m.youtube.com/watch?v=fbNVUgmstSc&pp=0gcJCf0Ao7VqN5tD"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://www.connectwise.com"

‎advisories/unreviewed/2023/02/GHSA-v2q6-5m4m-pr58/GHSA-v2q6-5m4m-pr58.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v2q6-5m4m-pr58",
4-
"modified": "2025-03-21T15:31:09Z",
4+
"modified": "2025-06-19T00:31:03Z",
55
"published": "2023-02-13T21:31:04Z",
66
"aliases": [
77
"CVE-2023-25719"
@@ -23,6 +23,10 @@
2323
"type": "WEB",
2424
"url": "https://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://m.youtube.com/watch?v=fbNVUgmstSc&pp=0gcJCf0Ao7VqN5tD"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://www.connectwise.com"

‎advisories/unreviewed/2025/04/GHSA-g3x6-r9w9-mcxx/GHSA-g3x6-r9w9-mcxx.json

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g3x6-r9w9-mcxx",
4-
"modified": "2025-04-18T00:30:44Z",
4+
"modified": "2025-06-19T00:31:04Z",
55
"published": "2025-04-18T00:30:44Z",
66
"aliases": [
77
"CVE-2025-3509"
@@ -23,17 +23,37 @@
2323
"type": "WEB",
2424
"url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.14"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.16"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.11"
2933
},
34+
{
35+
"type": "WEB",
36+
"url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.13"
37+
},
3038
{
3139
"type": "WEB",
3240
"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.6"
3341
},
42+
{
43+
"type": "WEB",
44+
"url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.8"
45+
},
3446
{
3547
"type": "WEB",
3648
"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.2"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.4"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.1"
3757
}
3858
],
3959
"database_specific": {

‎advisories/unreviewed/2025/05/GHSA-fcj3-9fc8-9489/GHSA-fcj3-9fc8-9489.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fcj3-9fc8-9489",
4-
"modified": "2025-05-27T21:32:17Z",
4+
"modified": "2025-06-19T00:31:04Z",
55
"published": "2025-05-27T21:32:17Z",
66
"aliases": [
77
"CVE-2025-5198"

‎advisories/unreviewed/2025/06/GHSA-2wh3-fp99-rprg/GHSA-2wh3-fp99-rprg.json

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2wh3-fp99-rprg",
4+
"modified": "2025-06-19T00:31:05Z",
5+
"published": "2025-06-19T00:31:05Z",
6+
"aliases": [
7+
"CVE-2025-23121"
8+
],
9+
"details": "A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23121"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.veeam.com/kb4743"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "CRITICAL",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-06-19T00:15:21Z"
33+
}
34+
}

‎advisories/unreviewed/2025/06/GHSA-683j-3v25-h2qg/GHSA-683j-3v25-h2qg.json

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-683j-3v25-h2qg",
4+
"modified": "2025-06-19T00:31:06Z",
5+
"published": "2025-06-19T00:31:06Z",
6+
"aliases": [
7+
"CVE-2025-23172"
8+
],
9+
"details": "The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the \"Add Webhook\" and \"Test Webhook\" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution. \n \nExploitation Status: \n\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \n\nWorkarounds or Mitigation: \n\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23172"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security-portal.versa-networks.com/emailbulletins/68526e7bdc94d6b9f2faf71b"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "HIGH",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-06-19T00:15:21Z"
49+
}
50+
}

‎advisories/unreviewed/2025/06/GHSA-6hw8-whvq-hmwp/GHSA-6hw8-whvq-hmwp.json

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6hw8-whvq-hmwp",
4+
"modified": "2025-06-19T00:31:06Z",
5+
"published": "2025-06-19T00:31:06Z",
6+
"aliases": [
7+
"CVE-2025-23170"
8+
],
9+
"details": "The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. \n\nExploitation Status: \n\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \n\nWorkarounds or Mitigation: \n\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23170"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security-portal.versa-networks.com/emailbulletins/68526bc7dc94d6b9f2faf717"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-06-19T00:15:21Z"
49+
}
50+
}

‎advisories/unreviewed/2025/06/GHSA-7525-4vpp-3gq2/GHSA-7525-4vpp-3gq2.json

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7525-4vpp-3gq2",
4+
"modified": "2025-06-19T00:31:07Z",
5+
"published": "2025-06-19T00:31:07Z",
6+
"aliases": [
7+
"CVE-2025-24287"
8+
],
9+
"details": "A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24287"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.veeam.com/kb4743"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "MODERATE",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-06-19T00:15:22Z"
33+
}
34+
}

‎advisories/unreviewed/2025/06/GHSA-grg9-576x-5279/GHSA-grg9-576x-5279.json

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-grg9-576x-5279",
4+
"modified": "2025-06-19T00:31:05Z",
5+
"published": "2025-06-19T00:31:05Z",
6+
"aliases": [
7+
"CVE-2025-23169"
8+
],
9+
"details": "The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. \n\nExploitation Status: \n\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \n\nWorkarounds or Mitigation: \n\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23169"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security-portal.versa-networks.com/emailbulletins/68526a08dc94d6b9f2faf716"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-06-19T00:15:21Z"
49+
}
50+
}

‎advisories/unreviewed/2025/06/GHSA-h9mg-jc7j-2rr2/GHSA-h9mg-jc7j-2rr2.json

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h9mg-jc7j-2rr2",
4+
"modified": "2025-06-19T00:31:05Z",
5+
"published": "2025-06-19T00:31:05Z",
6+
"aliases": [
7+
"CVE-2024-45208"
8+
],
9+
"details": "The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide.\n\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45208"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Harden_Port_4566"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://security-portal.versa-networks.com/emailbulletins/68526c3cdc94d6b9f2faf718"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://support.versa-networks.com/support/solutions/articles/23000026724-versa-director-ha-port-exploit-discovery-remediation"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [],
53+
"severity": "CRITICAL",
54+
"github_reviewed": false,
55+
"github_reviewed_at": null,
56+
"nvd_published_at": "2025-06-19T00:15:21Z"
57+
}
58+
}

0 commit comments

Comments
 (0)