Skip to content

Commit 86b76ce

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 0731102 commit 86b76ce

54 files changed

Lines changed: 2135 additions & 19 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/unreviewed/2026/03/GHSA-2rvx-jpm5-g848/GHSA-2rvx-jpm5-g848.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2rvx-jpm5-g848",
4+
"modified": "2026-03-11T21:31:03Z",
5+
"published": "2026-03-11T21:31:03Z",
6+
"aliases": [
7+
"CVE-2026-3949"
8+
],
9+
"details": "A vulnerability was determined in strukturag libheif up to 1.21.2. This affects the function vvdec_push_data2 of the file libheif/plugins/decoder_vvdec.cc of the component HEIF File Parser. Executing a manipulation of the argument size can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called b97c8b5f198b27f375127cd597a35f2113544d03. It is advisable to implement a patch to correct this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3949"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/strukturag/libheif/issues/1712"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/strukturag/libheif/issues/1712#issuecomment-3947938531"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/strukturag/libheif/commit/b97c8b5f198b27f375127cd597a35f2113544d03"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/biniamf/pocs/tree/main/libheif_vvdec"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/strukturag/libheif"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?ctiid.350381"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?id.350381"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://vuldb.com/?submit.765979"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-119"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": false,
65+
"github_reviewed_at": null,
66+
"nvd_published_at": "2026-03-11T19:16:05Z"
67+
}
68+
}

‎advisories/unreviewed/2026/03/GHSA-34px-6wv4-79ch/GHSA-34px-6wv4-79ch.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34px-6wv4-79ch",
4+
"modified": "2026-03-11T21:31:04Z",
5+
"published": "2026-03-11T21:31:04Z",
6+
"aliases": [
7+
"CVE-2026-1717"
8+
],
9+
"details": "An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1717"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://iknow.lenovo.com.cn/detail/438815"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://support.lenovo.com/us/en/product_security/LEN-213044"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-88"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-11T21:16:15Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-36j3-r3wc-mhg7/GHSA-36j3-r3wc-mhg7.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-36j3-r3wc-mhg7",
4+
"modified": "2026-03-11T21:31:03Z",
5+
"published": "2026-03-11T21:31:03Z",
6+
"aliases": [
7+
"CVE-2025-70024"
8+
],
9+
"details": "An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benkeen generatedata 4.0.14.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70024"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://gist.github.com/zcxlighthouse/4983275f71824ff47b9bdca9de7cb36a"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/benkeen"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/benkeen/generatedata"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2026-03-11T21:16:13Z"
36+
}
37+
}

‎advisories/unreviewed/2026/03/GHSA-3grg-fgcc-7f3v/GHSA-3grg-fgcc-7f3v.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3grg-fgcc-7f3v",
4+
"modified": "2026-03-11T21:31:01Z",
5+
"published": "2026-03-11T21:31:01Z",
6+
"aliases": [
7+
"CVE-2019-25468"
8+
],
9+
"details": "NetGain EM Plus 10.1.68 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious parameters to the script_test.jsp endpoint. Attackers can send POST requests with shell commands embedded in the 'content' parameter to execute code and retrieve command output.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25468"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/47391"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/netgain-em-plus-remote-code-execution-via-script-testjsp"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "http://netgain-systems.com"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-94"
42+
],
43+
"severity": "CRITICAL",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-11T19:16:00Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-4753-7q6g-548g/GHSA-4753-7q6g-548g.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4753-7q6g-548g",
4-
"modified": "2026-03-05T06:30:22Z",
4+
"modified": "2026-03-11T21:30:58Z",
55
"published": "2026-03-05T03:31:26Z",
66
"aliases": [
77
"CVE-2026-29123"
88
],
99
"details": "A SUID root-owned binary in /home/xd/terminal/XDTerminal in International Data Casting (IDC) SFX2100 on Linux allows a local actor to potentially preform local privilege escalation depending on conditions of the system via execution of the affected SUID binary. This can be via PATH hijacking, symlink abuse or shared object hijacking.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2026/03/GHSA-48cq-3q6q-vxm7/GHSA-48cq-3q6q-vxm7.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-48cq-3q6q-vxm7",
4+
"modified": "2026-03-11T21:31:02Z",
5+
"published": "2026-03-11T21:31:02Z",
6+
"aliases": [
7+
"CVE-2019-25485"
8+
],
9+
"details": "R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the GUI Preferences language menu field that allows local attackers to bypass DEP and ASLR protections. Attackers can inject a crafted payload through the Language for menus preference to trigger a structured exception handler chain pivot and execute arbitrary shellcode with application privileges.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25485"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/47122"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/r-windows-x-buffer-overflow-seh-dep-aslr-bypass"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-787"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-11T19:16:02Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-4c84-63pp-c7rv/GHSA-4c84-63pp-c7rv.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4c84-63pp-c7rv",
4+
"modified": "2026-03-11T21:31:01Z",
5+
"published": "2026-03-11T21:31:01Z",
6+
"aliases": [
7+
"CVE-2019-25466"
8+
],
9+
"details": "Easy File Sharing Web Server 7.2 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by creating a malicious username. Attackers can craft a username with a payload containing 4059 bytes of padding followed by a nseh value and seh pointer to trigger the overflow when adding a new user account.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25466"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/47411"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/easy-file-sharing-web-server-local-seh-overflow"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-787"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-11T19:15:59Z"
43+
}
44+
}

‎advisories/unreviewed/2026/03/GHSA-4f4w-f6p4-xqj8/GHSA-4f4w-f6p4-xqj8.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4f4w-f6p4-xqj8",
4+
"modified": "2026-03-11T21:31:02Z",
5+
"published": "2026-03-11T21:31:02Z",
6+
"aliases": [
7+
"CVE-2026-24509"
8+
],
9+
"details": "Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24509"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.dell.com/support/kbdoc/en-us/000427573/dsa-2026-093"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-284"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-03-11T19:16:03Z"
35+
}
36+
}

‎advisories/unreviewed/2026/03/GHSA-4p8g-m95v-ggv9/GHSA-4p8g-m95v-ggv9.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4p8g-m95v-ggv9",
4+
"modified": "2026-03-11T21:31:02Z",
5+
"published": "2026-03-11T21:31:02Z",
6+
"aliases": [
7+
"CVE-2019-25477"
8+
],
9+
"details": "RAR Password Recovery 1.80 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload in the registration dialog. Attackers can craft a malicious input string exceeding 6000 bytes and paste it into the User Name and Registration Code field to trigger an application crash.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25477"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/47285"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/rar-password-recovery-denial-of-service-buffer-overflow"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-787"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-03-11T19:16:01Z"
43+
}
44+
}

0 commit comments

Comments
 (0)