Skip to content

Commit 69d1f67

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3v4j-cjvq-5p59 GHSA-4jfm-v5m9-v6gx GHSA-6qj6-gv54-xg63 GHSA-h6v4-7hpg-55pq GHSA-v825-mc9m-64qr GHSA-wxrx-6xjq-jfgp GHSA-xxgx-2q65-m342
1 parent f7c8768 commit 69d1f67

File tree

7 files changed

+315
-0
lines changed

7 files changed

+315
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-3v4j-cjvq-5p59/GHSA-3v4j-cjvq-5p59.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3v4j-cjvq-5p59",
4+
"modified": "2025-11-27T00:30:27Z",
5+
"published": "2025-11-27T00:30:27Z",
6+
"aliases": [
7+
"CVE-2020-36872"
8+
],
9+
"details": "BACnet Test Server versions up to and including 1.01 contains a remote denial of service vulnerability in its BACnet/IP BVLC packet handling. The server fails to properly validate the BVLC Length field in incoming UDP BVLC frames on the default BACnet port (47808/udp). A remote unauthenticated attacker can send a malformed BVLC Length value to trigger an access violation and crash the application, resulting in a denial of service.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36872"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cxsecurity.com/issue/WLB-2020100045"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://packetstormsecurity.com/files/159504"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.bac-test.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.exploit-db.com/exploits/48860"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/bacnet-test-server-malformed-bvlc-length-dos"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5597.php"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-400"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-26T23:15:47Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-4jfm-v5m9-v6gx/GHSA-4jfm-v5m9-v6gx.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4jfm-v5m9-v6gx",
4+
"modified": "2025-11-27T00:30:27Z",
5+
"published": "2025-11-27T00:30:27Z",
6+
"aliases": [
7+
"CVE-2020-36873"
8+
],
9+
"details": "Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that could facilitate further compromise of the camera or connected network.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36873"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://packetstorm.news/files/id/156532"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/astak-cm818t3-unauthenticated-config-disclosure"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-306"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-26T23:15:47Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-6qj6-gv54-xg63/GHSA-6qj6-gv54-xg63.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6qj6-gv54-xg63",
4+
"modified": "2025-11-27T00:30:26Z",
5+
"published": "2025-11-27T00:30:26Z",
6+
"aliases": [
7+
"CVE-2019-25227"
8+
],
9+
"details": "Tellion HN-2204AP routers contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/system_config_file management endpoint. The endpoint allows remote retrieval of a compressed configuration archive without requiring authentication or authorization. The exposed configuration may include administrative credentials, wireless keys, and other sensitive settings, enabling an unauthenticated attacker to obtain information that can facilitate further compromise of the device or network.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25227"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://packetstorm.news/files/id/154752"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://web.archive.org/web/20190525010559/https://www.tellion.com"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/tellion-hn2204ap-unauthenticated-config-disclosure"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-306"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-26T23:15:46Z"
43+
}
44+
}

‎advisories/unreviewed/2025/11/GHSA-h6v4-7hpg-55pq/GHSA-h6v4-7hpg-55pq.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h6v4-7hpg-55pq",
4+
"modified": "2025-11-27T00:30:27Z",
5+
"published": "2025-11-27T00:30:26Z",
6+
"aliases": [
7+
"CVE-2019-25226"
8+
],
9+
"details": "Dongyoung Media DM-AP240T/W wireless access points contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/sys_system_config management endpoint. The endpoint allows remote retrieval of a compressed configuration archive without requiring authentication or authorization. The exposed configuration may include administrative credentials and other sensitive settings, enabling an unauthenticated attacker to obtain information that can facilitate further compromise of the device or network.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25226"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cxsecurity.com/issue/WLB-2019100012"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://packetstorm.news/files/id/154719"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/dongyoung-media-dm-ap240tw-unauthenticated-config-disclosure"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "http://dongyoung.com"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-306"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-11-26T23:15:45Z"
47+
}
48+
}

‎advisories/unreviewed/2025/11/GHSA-v825-mc9m-64qr/GHSA-v825-mc9m-64qr.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v825-mc9m-64qr",
4+
"modified": "2025-11-27T00:30:27Z",
5+
"published": "2025-11-27T00:30:27Z",
6+
"aliases": [
7+
"CVE-2025-40934"
8+
],
9+
"details": "XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.\n\nAn attacker can remove the signature from the XML document to make it pass the verification check.\n\nXML-Sig is a Perl module to validate signatures on XML files.  An unsigned XML file should return an error message.  The affected versions return true when attempting to validate an XML file that contains no signatures.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40934"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/perl-net-saml2/perl-XML-Sig/issues/63"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/perl-net-saml2/perl-XML-Sig/pull/64"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-347"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2025-11-26T23:15:47Z"
34+
}
35+
}

‎advisories/unreviewed/2025/11/GHSA-wxrx-6xjq-jfgp/GHSA-wxrx-6xjq-jfgp.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wxrx-6xjq-jfgp",
4+
"modified": "2025-11-27T00:30:27Z",
5+
"published": "2025-11-27T00:30:27Z",
6+
"aliases": [
7+
"CVE-2020-36874"
8+
],
9+
"details": "ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that could facilitate further compromise of the camera or connected network.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36874"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://acesecurity.jp/support/top/wip_series/wip-90113"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://cxsecurity.com/issue/WLB-2020020137"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://packetstorm.news/files/id/156497"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/ace-security-wip90113-unauthenticated-config-disclosure"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-306"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-11-26T23:15:47Z"
47+
}
48+
}

‎advisories/unreviewed/2025/11/GHSA-xxgx-2q65-m342/GHSA-xxgx-2q65-m342.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xxgx-2q65-m342",
4+
"modified": "2025-11-27T00:30:27Z",
5+
"published": "2025-11-27T00:30:27Z",
6+
"aliases": [
7+
"CVE-2020-36871"
8+
],
9+
"details": "ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint allows remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup can include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that may facilitate further compromise of the camera or connected network.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36871"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://packetstorm.news/files/id/156492"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/48107"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/escam-qd900-unauthenticated-config-disclosure"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-306"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-26T23:15:47Z"
43+
}
44+
}

0 commit comments

Comments
 (0)