Skip to content

Commit 6ea42f1

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 9279da8 commit 6ea42f1

File tree

49 files changed

+2393
-1
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+2393
-1
lines changed

‎advisories/unreviewed/2026/02/GHSA-3428-qfh5-9x74/GHSA-3428-qfh5-9x74.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3428-qfh5-9x74",
4+
"modified": "2026-02-19T00:30:31Z",
5+
"published": "2026-02-19T00:30:31Z",
6+
"aliases": [
7+
"CVE-2026-2684"
8+
],
9+
"details": "A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown function of the file /Archive/ErecordManage/uploadFile.html. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2684"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/luoye197-prog/ziguang-fileupload"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/luoye197-prog/ziguang-fileupload/blob/main/introduce%26poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.346475"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.346475"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.753973"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-284"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-19T00:16:21Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-36ph-wmrq-6hrj/GHSA-36ph-wmrq-6hrj.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-36ph-wmrq-6hrj",
4+
"modified": "2026-02-19T00:30:30Z",
5+
"published": "2026-02-19T00:30:30Z",
6+
"aliases": [
7+
"CVE-2026-2670"
8+
],
9+
"details": "A vulnerability was identified in Advantech WISE-6610 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2670"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/master-abc/cve/issues/37"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.346467"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.346467"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.753293"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.advantech.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-77"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-18T22:16:27Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-3r32-v4qm-6hph/GHSA-3r32-v4qm-6hph.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3r32-v4qm-6hph",
4+
"modified": "2026-02-19T00:30:28Z",
5+
"published": "2026-02-19T00:30:28Z",
6+
"aliases": [
7+
"CVE-2019-25353"
8+
],
9+
"details": "Foscam Video Management System 1.1.4.9 contains a denial of service vulnerability in the username input field that allows attackers to crash the application. Attackers can overwrite the username with a 520-byte buffer of repeated 'A' characters to trigger an application crash during device login.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25353"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/47671"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.foscam.es"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/foscam-video-management-system-username-denial-of-service"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-120"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-02-18T22:16:20Z"
47+
}
48+
}

‎advisories/unreviewed/2026/02/GHSA-43xr-qfv7-4j2q/GHSA-43xr-qfv7-4j2q.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-43xr-qfv7-4j2q",
4+
"modified": "2026-02-19T00:30:29Z",
5+
"published": "2026-02-19T00:30:29Z",
6+
"aliases": [
7+
"CVE-2019-25400"
8+
],
9+
"details": "IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp_name, remark, SRV_NAME, SRV_PORT, SRVGRP_NAME, SRVGRP_REMARK, and updatesrvgrp. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated users' browsers.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25400"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.exploit-db.com/exploits/46344"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.ipfire.org"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/ipfire-core-update-multiple-xss-via-fwhostscgi"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-18T22:16:23Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-4g6v-jhwq-9xjj/GHSA-4g6v-jhwq-9xjj.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4g6v-jhwq-9xjj",
4+
"modified": "2026-02-19T00:30:30Z",
5+
"published": "2026-02-19T00:30:30Z",
6+
"aliases": [
7+
"CVE-2026-2648"
8+
],
9+
"details": "Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. (Chromium security severity: High)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2648"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_18.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/477033835"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-122"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2026-02-18T22:16:26Z"
34+
}
35+
}

‎advisories/unreviewed/2026/02/GHSA-4vww-ch2x-c53p/GHSA-4vww-ch2x-c53p.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4vww-ch2x-c53p",
4+
"modified": "2026-02-19T00:30:29Z",
5+
"published": "2026-02-19T00:30:28Z",
6+
"aliases": [
7+
"CVE-2019-25358"
8+
],
9+
"details": "FileOptimizer 14.00.2524 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the FileOptimizer32.ini configuration file. Attackers can overwrite the TempDirectory parameter with a 5000-character buffer to cause the application to crash when opening options.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25358"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://sourceforge.net/projects/nikkhokkho"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://sourceforge.net/projects/nikkhokkho/files/FileOptimizer/14.00.2524/FileOptimizerSetup.exe/download"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.exploit-db.com/exploits/47586"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.vulncheck.com/advisories/fileoptimizer-denial-of-service"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-1282"
46+
],
47+
"severity": "HIGH",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-18T22:16:21Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-4wvv-g662-rjm9/GHSA-4wvv-g662-rjm9.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4wvv-g662-rjm9",
4+
"modified": "2026-02-19T00:30:30Z",
5+
"published": "2026-02-19T00:30:30Z",
6+
"aliases": [
7+
"CVE-2025-15581"
8+
],
9+
"details": "Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. \n\nSuccessful exploitation could result in Privilege Escalation, potentially allowing full administrative access.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15581"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-287"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-02-18T23:16:18Z"
43+
}
44+
}

0 commit comments

Comments
 (0)