Skip to content

Commit 42fd2e8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3g9x-jmhv-45cr GHSA-5f36-8jq3-3xj6 GHSA-6w8x-jqxx-8qx3 GHSA-jc2r-6j78-38qm GHSA-rjqg-x84m-7844
1 parent 75f4b37 commit 42fd2e8

File tree

5 files changed

+246
-0
lines changed

5 files changed

+246
-0
lines changed

‎advisories/unreviewed/2025/07/GHSA-3g9x-jmhv-45cr/GHSA-3g9x-jmhv-45cr.json

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3g9x-jmhv-45cr",
4+
"modified": "2025-07-06T15:30:26Z",
5+
"published": "2025-07-06T15:30:26Z",
6+
"aliases": [
7+
"CVE-2025-7080"
8+
],
9+
"details": "A vulnerability, which was classified as problematic, was found in Done-0 Jank up to 322caebbad10568460364b9667aa62c3080bfc17. Affected is an unknown function of the file internal/utils/jwt_utils.go of the component JWT Token Handler. The manipulation of the argument accessSecret/refreshSecret with the input jank-blog-secret/jank-blog-refresh-secret leads to use of hard-coded password. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7080"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Done-0/Jank/issues/9"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.314994"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.314994"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.603746"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-07-06T14:15:28Z"
49+
}
50+
}

‎advisories/unreviewed/2025/07/GHSA-5f36-8jq3-3xj6/GHSA-5f36-8jq3-3xj6.json

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5f36-8jq3-3xj6",
4+
"modified": "2025-07-06T15:30:26Z",
5+
"published": "2025-07-06T15:30:26Z",
6+
"aliases": [
7+
"CVE-2025-7079"
8+
],
9+
"details": "A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plus leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7079"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/mao888/bluebell-plus/issues/35"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.314993"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.314993"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.603726"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-07-06T13:15:35Z"
49+
}
50+
}

‎advisories/unreviewed/2025/07/GHSA-6w8x-jqxx-8qx3/GHSA-6w8x-jqxx-8qx3.json

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6w8x-jqxx-8qx3",
4+
"modified": "2025-07-06T15:30:26Z",
5+
"published": "2025-07-06T15:30:26Z",
6+
"aliases": [
7+
"CVE-2025-7082"
8+
],
9+
"details": "A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/formBSSetSitesurvey of the component webs. The manipulation of the argument wan_ipaddr/wan_netmask/wan_gateway/wl_ssid is directly passed by the attacker/so we can control the wan_ipaddr/wan_netmask/wan_gateway/wl_ssid leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7082"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_2/2.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_2/2.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.314996"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.314996"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.603672"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-07-06T14:15:28Z"
55+
}
56+
}

‎advisories/unreviewed/2025/07/GHSA-jc2r-6j78-38qm/GHSA-jc2r-6j78-38qm.json

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jc2r-6j78-38qm",
4+
"modified": "2025-07-06T15:30:26Z",
5+
"published": "2025-07-06T15:30:26Z",
6+
"aliases": [
7+
"CVE-2025-7081"
8+
],
9+
"details": "A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this vulnerability is the function formSetWanStatic of the file /goform/formSetWanStatic of the component webs. The manipulation of the argument m_wan_ipaddr/m_wan_netmask/m_wan_gateway/m_wan_staticdns1/m_wan_staticdns2 is directly passed by the attacker/so we can control the m_wan_ipaddr/m_wan_netmask/m_wan_gateway/m_wan_staticdns1/m_wan_staticdns2 leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7081"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_1/1.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_1/1.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.314995"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.314995"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.603669"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-07-06T14:15:28Z"
55+
}
56+
}

‎advisories/unreviewed/2025/07/GHSA-rjqg-x84m-7844/GHSA-rjqg-x84m-7844.json

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rjqg-x84m-7844",
4+
"modified": "2025-07-06T15:30:26Z",
5+
"published": "2025-07-06T15:30:26Z",
6+
"aliases": [
7+
"CVE-2025-5333"
8+
],
9+
"details": "Remote attackers can execute arbitrary code in the context of the vulnerable service process.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:I/V:C/RE:L/U:Red"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5333"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35903"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "CRITICAL",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-07-06T14:15:27Z"
33+
}
34+
}

0 commit comments

Comments
 (0)