Skip to content

Commit 08dbece

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2rm4-674c-43v5 GHSA-33vr-hv7f-mv36 GHSA-4chx-3xpf-9pfj GHSA-5f3x-cpqc-wr99 GHSA-5jph-4x8h-wx83 GHSA-5mr4-m32g-vmwq GHSA-68h7-pm4h-c96m GHSA-8c9w-7999-9v62 GHSA-99cp-q7mc-52c4 GHSA-cm35-q368-98g3 GHSA-g39h-563w-fg8c GHSA-mj5c-c9mm-83jf GHSA-p754-x56h-5ffr GHSA-q963-9rqv-mq7m
1 parent 1f56f4e commit 08dbece

File tree

14 files changed

+352
-24
lines changed

14 files changed

+352
-24
lines changed

‎advisories/unreviewed/2025/11/GHSA-2rm4-674c-43v5/GHSA-2rm4-674c-43v5.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2rm4-674c-43v5",
4-
"modified": "2025-11-10T21:30:36Z",
4+
"modified": "2025-11-11T00:30:20Z",
55
"published": "2025-11-10T21:30:36Z",
66
"aliases": [
77
"CVE-2025-12728"
88
],
99
"details": "Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-451"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-11-10T20:15:39Z"

‎advisories/unreviewed/2025/11/GHSA-33vr-hv7f-mv36/GHSA-33vr-hv7f-mv36.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-33vr-hv7f-mv36",
4+
"modified": "2025-11-11T00:30:21Z",
5+
"published": "2025-11-11T00:30:21Z",
6+
"aliases": [
7+
"CVE-2025-63678"
8+
],
9+
"details": "An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63678"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/kasiasok/raports/blob/main/CMSMS%202.2.22%20_%20Raport%20092025.pdf"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-11-10T23:15:41Z"
28+
}
29+
}

‎advisories/unreviewed/2025/11/GHSA-4chx-3xpf-9pfj/GHSA-4chx-3xpf-9pfj.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4chx-3xpf-9pfj",
4-
"modified": "2025-11-10T21:30:36Z",
4+
"modified": "2025-11-11T00:30:20Z",
55
"published": "2025-11-10T21:30:36Z",
66
"aliases": [
77
"CVE-2025-12725"
88
],
99
"details": "Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-125"
2934
],
30-
"severity": null,
35+
"severity": "MODERATE",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2025-11-10T20:15:39Z"

‎advisories/unreviewed/2025/11/GHSA-5f3x-cpqc-wr99/GHSA-5f3x-cpqc-wr99.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5f3x-cpqc-wr99",
4+
"modified": "2025-11-11T00:30:21Z",
5+
"published": "2025-11-11T00:30:21Z",
6+
"aliases": [
7+
"CVE-2018-25124"
8+
],
9+
"details": "PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within the web-based DICOM viewer component. Successful exploitation allows a remote unauthenticated attacker to read arbitrary files via the 'nocache.php' endpoint with a crafted 'path' parameter. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-07 UTC.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25124"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://pacsone.net/download.htm"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/43907"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/pacsone-server-dicom-web-viewer-directory-traversal-lfi"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-22"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-10T23:15:39Z"
43+
}
44+
}

‎advisories/unreviewed/2025/11/GHSA-5jph-4x8h-wx83/GHSA-5jph-4x8h-wx83.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5jph-4x8h-wx83",
4-
"modified": "2025-11-10T21:30:35Z",
4+
"modified": "2025-11-11T00:30:20Z",
55
"published": "2025-11-10T21:30:35Z",
66
"aliases": [
77
"CVE-2025-12443"
88
],
99
"details": "Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-125"
2934
],
30-
"severity": null,
35+
"severity": "MODERATE",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2025-11-10T20:15:39Z"

‎advisories/unreviewed/2025/11/GHSA-5mr4-m32g-vmwq/GHSA-5mr4-m32g-vmwq.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5mr4-m32g-vmwq",
4+
"modified": "2025-11-11T00:30:20Z",
5+
"published": "2025-11-11T00:30:20Z",
6+
"aliases": [
7+
"CVE-2025-63397"
8+
],
9+
"details": "Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/type conversion.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63397"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/Oneflow-Inc/oneflow/issues/10666"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/Daisy2ang"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/Oneflow-Inc/oneflow"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "http://oneflow.com"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2025-11-10T22:15:36Z"
40+
}
41+
}

‎advisories/unreviewed/2025/11/GHSA-68h7-pm4h-c96m/GHSA-68h7-pm4h-c96m.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-68h7-pm4h-c96m",
4-
"modified": "2025-11-10T21:30:35Z",
4+
"modified": "2025-11-11T00:30:20Z",
55
"published": "2025-11-10T21:30:35Z",
66
"aliases": [
77
"CVE-2025-12433"
88
],
99
"details": "Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -25,7 +30,7 @@
2530
],
2631
"database_specific": {
2732
"cwe_ids": [],
28-
"severity": null,
33+
"severity": "MODERATE",
2934
"github_reviewed": false,
3035
"github_reviewed_at": null,
3136
"nvd_published_at": "2025-11-10T20:15:37Z"

‎advisories/unreviewed/2025/11/GHSA-8c9w-7999-9v62/GHSA-8c9w-7999-9v62.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8c9w-7999-9v62",
4+
"modified": "2025-11-11T00:30:21Z",
5+
"published": "2025-11-11T00:30:21Z",
6+
"aliases": [
7+
"CVE-2025-12542"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12542"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-10T23:15:41Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-99cp-q7mc-52c4/GHSA-99cp-q7mc-52c4.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-99cp-q7mc-52c4",
4-
"modified": "2025-11-10T21:30:35Z",
4+
"modified": "2025-11-11T00:30:20Z",
55
"published": "2025-11-10T21:30:35Z",
66
"aliases": [
77
"CVE-2025-12441"
88
],
99
"details": "Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-125"
2934
],
30-
"severity": null,
35+
"severity": "MODERATE",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2025-11-10T20:15:38Z"

‎advisories/unreviewed/2025/11/GHSA-cm35-q368-98g3/GHSA-cm35-q368-98g3.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cm35-q368-98g3",
4+
"modified": "2025-11-11T00:30:21Z",
5+
"published": "2025-11-11T00:30:21Z",
6+
"aliases": [
7+
"CVE-2021-4462"
8+
],
9+
"details": "Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side validation.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4462"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.exploit-db.com/exploits/49596"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.sourcecodester.com/php/11393/employee-records-system.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/employees-records-system-arbitrary-file-upload-rce"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-434"
38+
],
39+
"severity": "CRITICAL",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-10T23:15:40Z"
43+
}
44+
}

0 commit comments

Comments
 (0)