Skip to content

Commit fe34388

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent e0f0e6d commit fe34388

File tree

87 files changed

+1253
-245
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

87 files changed

+1253
-245
lines changed

‎advisories/github-reviewed/2025/12/GHSA-2m4f-cg75-76w2/GHSA-2m4f-cg75-76w2.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2m4f-cg75-76w2",
4+
"modified": "2025-12-08T21:30:39Z",
5+
"published": "2025-12-08T21:30:39Z",
6+
"aliases": [
7+
"CVE-2025-66470"
8+
],
9+
"summary": "NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content",
10+
"details": "### Summary\nA Cross-Site Scripting (XSS) vulnerability exists in the `ui.interactive_image` component of NiceGUI (v3.3.1 and earlier). The component renders SVG content using Vue's `v-html` directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG `<foreignObject>` tag.\n\n### Details\nThe vulnerability is located in `nicegui/elements/interactive_image.js`.\nThe component uses the following code to render content:\n```javascript\n<g v-html=\"content\"></g>\n```\nVue's v-html directive renders raw HTML strings into the DOM. If an application allows user-controlled input to be passed to the content property of an interactive image, an attacker can embed a <foreignObject> tag containing malicious scripts, bypassing typical image restrictions.\n\n### PoC\n```python\nfrom nicegui import ui\n\[email protected]('/')\ndef main():\n ui.label('NiceGUI SVG XSS PoC')\n \n # Standard image loading\n img = ui.interactive_image('[https://picsum.photos/640/360](https://picsum.photos/640/360)')\n \n # Payload: Embeds raw HTML execution inside SVG\n # This executes immediately when the image component is rendered\n img.content = (\n '<foreignObject>'\n '<body xmlns=\"[http://www.w3.org/1999/xhtml](http://www.w3.org/1999/xhtml)\">'\n '<img src=x onerror=alert(\"XSS-SVG\")>'\n '</body>'\n '</foreignObject>'\n )\n\nui.run()\n```\n\n### Impact\n- Type: Reflected / Stored XSS (depending on data source)\n\n- Severity: Moderate\n\n- Impact: Attackers can inject malicious scripts that execute whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "nicegui"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.4.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.3.1"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-2m4f-cg75-76w2"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/zauberzeug/nicegui/commit/58ad0b36e19922de16bbc79ea3ddd29851b1a3e3"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/zauberzeug/nicegui"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-79"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2025-12-08T21:30:39Z",
62+
"nvd_published_at": null
63+
}
64+
}

‎advisories/github-reviewed/2025/12/GHSA-72qc-wxch-74mg/GHSA-72qc-wxch-74mg.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-72qc-wxch-74mg",
4+
"modified": "2025-12-08T21:30:20Z",
5+
"published": "2025-12-08T21:30:20Z",
6+
"aliases": [
7+
"CVE-2025-66469"
8+
],
9+
"summary": "NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection",
10+
"details": "### Summary\nA Cross-Site Scripting (XSS) vulnerability exists in `ui.add_css`, `ui.add_scss`, and `ui.add_sass` functions in NiceGUI (v3.3.1 and earlier).\n\nThese functions allow developers to inject styles dynamically. However, they lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended `<style>` or `<script>` tags by injecting closing tags (e.g., `</style>` or `</script>`), allowing for the execution of arbitrary JavaScript.\n\n### Details\nThe vulnerability stems from how these functions inject content into the DOM using `client.run_javascript` (or `add_head_html` internally) without sufficient escaping for the transport layer.\n\n* **`ui.add_css`**: Injects content into a `<style>` tag. Input containing `</style>` closes the tag prematurely, allowing subsequent HTML/JS injection.\n* **`ui.add_scss` / `ui.add_sass`**: These rely on client-side compilation within `<script>` tags. Input containing `</script>` breaks the execution context, allowing XSS.\n\n### PoC\n**Scenario:** A developer allows users to customize a theme color via a URL parameter.\n\n```python\nfrom nicegui import ui\n\[email protected]('/')\ndef main(color: str = 'blue'):\n # Vulnerable implementation of dynamic theming\n ui.add_css(f'.q-btn {{ background-color: {color} !important; }}')\n ui.button('Click Me')\n\nui.run(port=8082)\n```\n**Attack Vector:**\nAccessing the following URL executes arbitrary JavaScript:\n`http://localhost:8082/?color=red;}</style><img src=x onerror=alert(document.domain)><style>`\n\n### Impact\n* **Type:** Reflected XSS\n* **Severity:** Moderate \n* **Affected Components:** Applications using `ui.add_css`, `ui.add_scss`, or `ui.add_sass` with untrusted input (e.g., dynamic theming based on user input).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "nicegui"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.4.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.3.1"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-72qc-wxch-74mg"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/zauberzeug/nicegui/commit/a8fd25b7d5e23afb1952d0f60a1940e18b5f1ca8"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/zauberzeug/nicegui"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-79"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2025-12-08T21:30:20Z",
62+
"nvd_published_at": null
63+
}
64+
}

‎advisories/github-reviewed/2025/12/GHSA-9v8j-x534-2fx3/GHSA-9v8j-x534-2fx3.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9v8j-x534-2fx3",
4+
"modified": "2025-12-08T21:30:56Z",
5+
"published": "2025-12-08T21:30:56Z",
6+
"aliases": [
7+
"CVE-2025-66567"
8+
],
9+
"summary": "Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)",
10+
"details": "### Summary\n\nRuby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. The vulnerability does not affect the version 1.18.0.\n\n### Impact\nThat allows an attacker to be able to execute a Signature Wrapping attack and bypass the authentication",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "ruby-saml"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.18.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/SAML-Toolkits/ruby-saml"
50+
},
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://github.com/advisories/GHSA-754f-8gm6-c4r2"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-347"
59+
],
60+
"severity": "CRITICAL",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-12-08T21:30:56Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2025/12/GHSA-wpqc-h9wp-chmq/GHSA-wpqc-h9wp-chmq.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wpqc-h9wp-chmq",
4+
"modified": "2025-12-08T21:30:07Z",
5+
"published": "2025-12-08T21:30:07Z",
6+
"aliases": [
7+
"CVE-2025-65964"
8+
],
9+
"summary": "n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook",
10+
"details": "### Impact\n\nThe n8n Git node allows workflows to set arbitrary Git configuration values through the _Add Config_ operation. When an attacker-controlled workflow sets `core.hooksPath` to a directory within the cloned repository containing a Git hook such as `pre-commit`, Git executes that hook during subsequent Git operations. Because Git hooks run as local system commands, this behavior can lead to **arbitrary command execution** on the underlying n8n host.\n\nSuccessful exploitation requires the ability to create or modify an n8n workflow that uses the Git node.\n\nAffected versions: **≥ 0.123.1 and < 1.119.2**\n\n### Patches\n\nThis issue has been patched in **n8n version 1.119.2**.\n\nAll users running affected versions should upgrade to **1.119.2 or later**.\n\n### Workarounds\n\nIf upgrading is not immediately possible, the following mitigations can reduce exposure:\n\n- Exclude the Git node ([Docs](https://n8n-docs.teamlab.info/hosting/securing/blocking-nodes/#exclude-nodes)).\n- Avoid cloning or interacting with untrusted repositories using the Git Node.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "n8n"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0.123.1"
29+
},
30+
{
31+
"fixed": "1.119.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-wpqc-h9wp-chmq"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/n8n-io/n8n/commit/d5a1171f95f75def5c3ac577707ab913e22aef04"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/n8n-io/n8n"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-829"
55+
],
56+
"severity": "CRITICAL",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-12-08T21:30:07Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/unreviewed/2022/08/GHSA-45v7-mh84-5f9p/GHSA-45v7-mh84-5f9p.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-45v7-mh84-5f9p",
4-
"modified": "2025-01-06T15:30:58Z",
4+
"modified": "2025-12-08T21:30:17Z",
55
"published": "2022-08-29T00:00:33Z",
66
"aliases": [
77
"CVE-2022-37055"
@@ -27,9 +27,17 @@
2727
"type": "WEB",
2828
"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37055"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://www.dlink.com/en/security-bulletin"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.fortiguard.com/outbreak-alert/d-link-multiple-devices-attack"
3341
}
3442
],
3543
"database_specific": {

‎advisories/unreviewed/2024/11/GHSA-5x56-3552-fggh/GHSA-5x56-3552-fggh.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5x56-3552-fggh",
4-
"modified": "2024-11-22T21:32:15Z",
4+
"modified": "2025-12-08T21:30:17Z",
55
"published": "2024-11-22T21:32:15Z",
66
"aliases": [
77
"CVE-2024-38647"
88
],
99
"details": "An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nQNAP AI Core 3.4.1 and later",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2024/11/GHSA-7r8m-5c4m-7j6c/GHSA-7r8m-5c4m-7j6c.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7r8m-5c4m-7j6c",
4-
"modified": "2024-11-22T21:32:15Z",
4+
"modified": "2025-12-08T21:30:17Z",
55
"published": "2024-11-22T21:32:15Z",
66
"aliases": [
77
"CVE-2024-50395"
88
],
99
"details": "An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow local network attackers to gain privilege.\n\nWe have already fixed the vulnerability in the following version:\nMedia Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2024/11/GHSA-9xq2-9jc3-2mjw/GHSA-9xq2-9jc3-2mjw.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9xq2-9jc3-2mjw",
4-
"modified": "2024-11-22T21:32:15Z",
4+
"modified": "2025-12-08T21:30:17Z",
55
"published": "2024-11-22T21:32:15Z",
66
"aliases": [
77
"CVE-2024-48862"
88
],
99
"details": "A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files.\n\nWe have already fixed the vulnerability in the following versions:\nQuLog Center 1.7.0.831 ( 2024/10/15 ) and later\nQuLog Center 1.8.0.888 ( 2024/10/15 ) and later",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/01/GHSA-6x53-588x-53g2/GHSA-6x53-588x-53g2.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6x53-588x-53g2",
4-
"modified": "2025-11-03T21:32:04Z",
4+
"modified": "2025-12-08T21:30:18Z",
55
"published": "2025-01-07T12:31:02Z",
66
"aliases": [
77
"CVE-2024-12425"
88
],
99
"details": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.\n\n\n\n\nAn attacker can write to arbitrary locations, albeit suffixed with \".ttf\", by supplying a file in a format that supports embedded font files.\n\n\nThis issue affects LibreOffice: from 24.8 before < 24.8.4.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/01/GHSA-x7m8-vrfv-272v/GHSA-x7m8-vrfv-272v.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-x7m8-vrfv-272v",
4-
"modified": "2025-11-03T21:32:04Z",
4+
"modified": "2025-12-08T21:30:18Z",
55
"published": "2025-01-07T15:31:46Z",
66
"aliases": [
77
"CVE-2024-12426"
88
],
99
"details": "Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice.\n\n\n\n\nURLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.\n\n\nThis issue affects LibreOffice: from 24.8 before < 24.8.4.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

0 commit comments

Comments
 (0)