Skip to content

Commit 0630cf4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent ed62a98 commit 0630cf4

File tree

58 files changed

+1720
-45
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+1720
-45
lines changed

‎advisories/unreviewed/2024/07/GHSA-m4wm-24vm-w63j/GHSA-m4wm-24vm-w63j.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-m4wm-24vm-w63j",
4-
"modified": "2024-07-30T09:32:01Z",
4+
"modified": "2025-10-03T21:30:52Z",
55
"published": "2024-07-30T09:32:01Z",
66
"aliases": [
77
"CVE-2024-42130"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc/nci: Add the inconsistency check between the input data length and count\n\nwrite$nci(r0, &(0x7f0000000740)=ANY=[@ANYBLOB=\"610501\"], 0xf)\n\nSyzbot constructed a write() call with a data length of 3 bytes but a count value\nof 15, which passed too little data to meet the basic requirements of the function\nnci_rf_intf_activated_ntf_packet().\n\nTherefore, increasing the comparison between data length and count value to avoid\nproblems caused by inconsistent data length and count.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -37,7 +42,7 @@
3742
],
3843
"database_specific": {
3944
"cwe_ids": [],
40-
"severity": null,
45+
"severity": "MODERATE",
4146
"github_reviewed": false,
4247
"github_reviewed_at": null,
4348
"nvd_published_at": "2024-07-30T08:15:05Z"

‎advisories/unreviewed/2024/08/GHSA-9v94-8833-hv33/GHSA-9v94-8833-hv33.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9v94-8833-hv33",
4-
"modified": "2024-08-19T06:30:53Z",
4+
"modified": "2025-10-03T21:30:52Z",
55
"published": "2024-08-17T09:30:24Z",
66
"aliases": [
77
"CVE-2024-42265"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nprotect the fetch of ->fd[fd] in do_dup2() from mispredictions\n\nboth callers have verified that fd is not greater than ->max_fds;\nhowever, misprediction might end up with\n tofree = fdt->fd[fd];\nbeing speculatively executed. That's wrong for the same reasons\nwhy it's wrong in close_fd()/file_close_fd_locked(); the same\nsolution applies - array_index_nospec(fd, fdt->max_fds) could differ\nfrom fd only in case of speculative execution on mispredicted path.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -49,7 +54,7 @@
4954
],
5055
"database_specific": {
5156
"cwe_ids": [],
52-
"severity": null,
57+
"severity": "MODERATE",
5358
"github_reviewed": false,
5459
"github_reviewed_at": null,
5560
"nvd_published_at": "2024-08-17T09:15:07Z"

‎advisories/unreviewed/2024/08/GHSA-cj67-x3pw-qjqp/GHSA-cj67-x3pw-qjqp.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cj67-x3pw-qjqp",
4-
"modified": "2024-08-19T06:30:53Z",
4+
"modified": "2025-10-03T21:30:52Z",
55
"published": "2024-08-17T09:30:24Z",
66
"aliases": [
77
"CVE-2024-42267"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()\n\nHandle VM_FAULT_SIGSEGV in the page fault path so that we correctly\nkill the process and we don't BUG() the kernel.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -41,7 +46,7 @@
4146
],
4247
"database_specific": {
4348
"cwe_ids": [],
44-
"severity": null,
49+
"severity": "MODERATE",
4550
"github_reviewed": false,
4651
"github_reviewed_at": null,
4752
"nvd_published_at": "2024-08-17T09:15:08Z"

‎advisories/unreviewed/2024/08/GHSA-xjqc-gcmf-pwgc/GHSA-xjqc-gcmf-pwgc.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xjqc-gcmf-pwgc",
4-
"modified": "2024-08-17T09:30:24Z",
4+
"modified": "2025-10-03T21:30:52Z",
55
"published": "2024-08-17T09:30:24Z",
66
"aliases": [
77
"CVE-2024-42260"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Validate passed in drm syncobj handles in the performance extension\n\nIf userspace provides an unknown or invalid handle anywhere in the handle\narray the rest of the driver will not handle that well.\n\nFix it by checking handle was looked up successfully or otherwise fail the\nextension by jumping into the existing unwind.\n\n(cherry picked from commit a546b7e4d73c23838d7e4d2c92882b3ca902d213)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -25,7 +30,7 @@
2530
],
2631
"database_specific": {
2732
"cwe_ids": [],
28-
"severity": null,
33+
"severity": "MODERATE",
2934
"github_reviewed": false,
3035
"github_reviewed_at": null,
3136
"nvd_published_at": "2024-08-17T09:15:07Z"

‎advisories/unreviewed/2024/08/GHSA-xvh5-2mp5-pfc3/GHSA-xvh5-2mp5-pfc3.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xvh5-2mp5-pfc3",
4-
"modified": "2024-08-17T09:30:24Z",
4+
"modified": "2025-10-03T21:30:52Z",
55
"published": "2024-08-17T09:30:24Z",
66
"aliases": [
77
"CVE-2024-42261"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Validate passed in drm syncobj handles in the timestamp extension\n\nIf userspace provides an unknown or invalid handle anywhere in the handle\narray the rest of the driver will not handle that well.\n\nFix it by checking handle was looked up successfully or otherwise fail the\nextension by jumping into the existing unwind.\n\n(cherry picked from commit 8d1276d1b8f738c3afe1457d4dff5cc66fc848a3)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -25,7 +30,7 @@
2530
],
2631
"database_specific": {
2732
"cwe_ids": [],
28-
"severity": null,
33+
"severity": "MODERATE",
2934
"github_reviewed": false,
3035
"github_reviewed_at": null,
3136
"nvd_published_at": "2024-08-17T09:15:07Z"

‎advisories/unreviewed/2025/07/GHSA-gmrc-mvc2-6888/GHSA-gmrc-mvc2-6888.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gmrc-mvc2-6888",
4-
"modified": "2025-07-21T18:32:19Z",
4+
"modified": "2025-10-03T21:30:55Z",
55
"published": "2025-07-21T18:32:18Z",
66
"aliases": [
77
"CVE-2025-7932"

‎advisories/unreviewed/2025/09/GHSA-m3c8-789m-gj36/GHSA-m3c8-789m-gj36.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45-
"CWE-74"
45+
"CWE-74",
46+
"CWE-94"
4647
],
4748
"severity": "MODERATE",
4849
"github_reviewed": false,

‎advisories/unreviewed/2025/09/GHSA-wr4m-f8q9-97q2/GHSA-wr4m-f8q9-97q2.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wr4m-f8q9-97q2",
4-
"modified": "2025-09-30T18:30:25Z",
4+
"modified": "2025-10-03T21:30:56Z",
55
"published": "2025-09-30T18:30:25Z",
66
"aliases": [
77
"CVE-2025-56513"
88
],
99
"details": "NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redirecting traffic to the update url and can hijack the update process and deliver arbitrary executables that are automatically executed, resulting in full remote code execution. This constitutes a critical supply chain attack vector.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-494"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-09-30T18:15:50Z"

‎advisories/unreviewed/2025/10/GHSA-39x4-ph74-c88f/GHSA-39x4-ph74-c88f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-39x4-ph74-c88f",
4+
"modified": "2025-10-03T21:30:58Z",
5+
"published": "2025-10-03T21:30:58Z",
6+
"aliases": [
7+
"CVE-2025-52866"
8+
],
9+
"details": "A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.6.3195 build 20250715 and later\nQuTS hero h5.2.6.3195 build 20250715 and later",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52866"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.qnap.com/en/security-advisory/qsa-25-36"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-476"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-03T19:15:48Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-3mgq-766r-8vr6/GHSA-3mgq-766r-8vr6.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3mgq-766r-8vr6",
4+
"modified": "2025-10-03T21:30:58Z",
5+
"published": "2025-10-03T21:30:58Z",
6+
"aliases": [
7+
"CVE-2025-52656"
8+
],
9+
"details": "HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52656"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-915"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-03T19:15:46Z"
35+
}
36+
}

0 commit comments

Comments
 (0)