Skip to content

Commit 01e4cd2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7pq9-rf9p-wcrf GHSA-g99p-47x7-mq88 GHSA-3qcp-9v8c-6jp7 GHSA-xcg2-9pp4-j82x
1 parent 91c3f8e commit 01e4cd2

File tree

4 files changed

+144
-10
lines changed

4 files changed

+144
-10
lines changed

‎advisories/github-reviewed/2025/09/GHSA-7pq9-rf9p-wcrf/GHSA-7pq9-rf9p-wcrf.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7pq9-rf9p-wcrf",
4-
"modified": "2025-09-30T15:16:03Z",
4+
"modified": "2025-10-23T20:32:35Z",
55
"published": "2025-09-29T20:40:02Z",
66
"aliases": [
77
"CVE-2025-59941"
@@ -51,6 +51,10 @@
5151
{
5252
"type": "PACKAGE",
5353
"url": "https://github.com/filecoin-project/go-f3"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://pkg.go.dev/vuln/GO-2025-3989"
5458
}
5559
],
5660
"database_specific": {

‎advisories/github-reviewed/2025/09/GHSA-g99p-47x7-mq88/GHSA-g99p-47x7-mq88.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g99p-47x7-mq88",
4-
"modified": "2025-09-30T15:16:09Z",
4+
"modified": "2025-10-23T20:32:56Z",
55
"published": "2025-09-29T20:40:08Z",
66
"aliases": [
77
"CVE-2025-59942"
@@ -47,6 +47,10 @@
4747
{
4848
"type": "PACKAGE",
4949
"url": "https://github.com/filecoin-project/go-f3"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://pkg.go.dev/vuln/GO-2025-3990"
5054
}
5155
],
5256
"database_specific": {

advisories/unreviewed/2025/10/GHSA-3qcp-9v8c-6jp7/GHSA-3qcp-9v8c-6jp7.json renamed to advisories/github-reviewed/2025/10/GHSA-3qcp-9v8c-6jp7/GHSA-3qcp-9v8c-6jp7.json

Lines changed: 36 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,47 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3qcp-9v8c-6jp7",
4-
"modified": "2025-10-23T18:31:15Z",
4+
"modified": "2025-10-23T20:31:36Z",
55
"published": "2025-10-23T18:31:15Z",
66
"aliases": [
77
"CVE-2025-61413"
88
],
9+
"summary": "Piranha CMS vulnerable to stored cross-site scripting (XSS)",
910
"details": "A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.",
10-
"severity": [],
11-
"affected": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "NuGet",
21+
"name": "Piranha"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "12.0.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
1541
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61413"
1642
},
1743
{
18-
"type": "WEB",
44+
"type": "PACKAGE",
1945
"url": "https://github.com/PiranhaCMS/piranha.core"
2046
},
2147
{
@@ -28,10 +54,12 @@
2854
}
2955
],
3056
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
33-
"github_reviewed": false,
34-
"github_reviewed_at": null,
57+
"cwe_ids": [
58+
"CWE-79"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-10-23T20:31:36Z",
3563
"nvd_published_at": "2025-10-23T18:16:23Z"
3664
}
3765
}

‎advisories/github-reviewed/2025/10/GHSA-xcg2-9pp4-j82x/GHSA-xcg2-9pp4-j82x.json‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xcg2-9pp4-j82x",
4+
"modified": "2025-10-23T20:31:31Z",
5+
"published": "2025-10-23T20:31:30Z",
6+
"aliases": [
7+
"CVE-2025-62517"
8+
],
9+
"summary": "rollbar vulnerable to Prototype Pollution in merge()",
10+
"details": "### Impact\n\nPrototype pollution vulnerability in merge(). If application code calls `rollbar.configure()` with untrusted input, prototype pollution is possible.\n\n### Patches\n\nFixed in 2.26.5 and 3.0.0-beta5.\n\n### Workarounds\n\nEnsure that values passed to `rollbar.configure()` do not contain untrusted input.\n\n### References\n\nFixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "rollbar"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.26.5"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.26.4"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "npm",
43+
"name": "rollbar"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "3.0.0-alpha1"
51+
},
52+
{
53+
"fixed": "3.0.0-beta5"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 3.0.0-beta4"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/rollbar/rollbar.js/pull/1390"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/rollbar/rollbar.js/pull/1394"
75+
},
76+
{
77+
"type": "WEB",
78+
"url": "https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb"
79+
},
80+
{
81+
"type": "WEB",
82+
"url": "https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343"
83+
},
84+
{
85+
"type": "PACKAGE",
86+
"url": "https://github.com/rollbar/rollbar.js"
87+
}
88+
],
89+
"database_specific": {
90+
"cwe_ids": [
91+
"CWE-1321"
92+
],
93+
"severity": "MODERATE",
94+
"github_reviewed": true,
95+
"github_reviewed_at": "2025-10-23T20:31:30Z",
96+
"nvd_published_at": null
97+
}
98+
}

0 commit comments

Comments
 (0)