Skip to content

Commit 1453c67

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5923-r76v-mprm GHSA-7vpr-jm38-wr7w GHSA-7wfc-4796-gmg5 GHSA-cc84-q3v3-mhgf GHSA-hxp3-63hc-5366 GHSA-jv3w-x3r3-g6rm GHSA-v959-qxv6-6f8p GHSA-wx63-35hw-2482
1 parent 89a981d commit 1453c67

File tree

8 files changed

+270
-12
lines changed

8 files changed

+270
-12
lines changed

‎advisories/github-reviewed/2025/12/GHSA-5923-r76v-mprm/GHSA-5923-r76v-mprm.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5923-r76v-mprm",
4-
"modified": "2025-12-09T14:26:34Z",
4+
"modified": "2025-12-10T15:46:45Z",
55
"published": "2025-12-09T14:26:34Z",
66
"aliases": [
77
"CVE-2025-67502"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/remram44/taguette/security/advisories/GHSA-5923-r76v-mprm"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67502"
49+
},
4650
{
4751
"type": "WEB",
4852
"url": "https://github.com/remram44/taguette/commit/67de2d2612e7e2572c61cd9627f89c2bfd0f2a36"
@@ -59,6 +63,6 @@
5963
"severity": "MODERATE",
6064
"github_reviewed": true,
6165
"github_reviewed_at": "2025-12-09T14:26:34Z",
62-
"nvd_published_at": null
66+
"nvd_published_at": "2025-12-10T00:16:11Z"
6367
}
6468
}

‎advisories/github-reviewed/2025/12/GHSA-7vpr-jm38-wr7w/GHSA-7vpr-jm38-wr7w.json‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7vpr-jm38-wr7w",
4+
"modified": "2025-12-10T15:46:48Z",
5+
"published": "2025-12-10T15:46:48Z",
6+
"aliases": [
7+
"CVE-2025-66472"
8+
],
9+
"summary": "XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication",
10+
"details": "### Impact\nA reflected XSS vulnerability in XWiki allows an attacker to send a victim to a URL with a deletion confirmation message on which the attacker-supplied script is executed when the victim clicks the \"No\" button. When the victim has admin or programming right, this allows the attacker to execute basically arbitrary actions on the XWiki installation including remote code execution.\n\n### Patches\nThis vulnerability has been patched in XWiki 16.10.10, 17.4.2 and 17.5.0 by using the affected URL parameter only in the intended context.\n\n### Workarounds\nThe [patch](https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2) can be manually applied to the templates that are present in the WAR. A restart of XWiki is needed for the changes to be applied.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.xwiki.platform:xwiki-platform-flamingo-skin-resources"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "6.2-milestone-1"
29+
},
30+
{
31+
"fixed": "16.10.10"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.xwiki.platform:xwiki-platform-flamingo-skin-resources"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "17.0.0-rc-1"
48+
},
49+
{
50+
"fixed": "17.4.2"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.xwiki.platform:xwiki-platform-web-templates"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "6.2-milestone-1"
67+
},
68+
{
69+
"fixed": "16.10.10"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Maven",
78+
"name": "org.xwiki.platform:xwiki-platform-web-templates"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "17.0.0-rc-1"
86+
},
87+
{
88+
"fixed": "17.4.2"
89+
}
90+
]
91+
}
92+
]
93+
}
94+
],
95+
"references": [
96+
{
97+
"type": "WEB",
98+
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w"
99+
},
100+
{
101+
"type": "WEB",
102+
"url": "https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2"
103+
},
104+
{
105+
"type": "PACKAGE",
106+
"url": "https://github.com/xwiki/xwiki-platform"
107+
},
108+
{
109+
"type": "WEB",
110+
"url": "https://jira.xwiki.org/browse/XWIKI-23244"
111+
}
112+
],
113+
"database_specific": {
114+
"cwe_ids": [
115+
"CWE-79",
116+
"CWE-80"
117+
],
118+
"severity": "MODERATE",
119+
"github_reviewed": true,
120+
"github_reviewed_at": "2025-12-10T15:46:48Z",
121+
"nvd_published_at": null
122+
}
123+
}

‎advisories/github-reviewed/2025/12/GHSA-7wfc-4796-gmg5/GHSA-7wfc-4796-gmg5.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7wfc-4796-gmg5",
4-
"modified": "2025-12-08T22:19:04Z",
4+
"modified": "2025-12-10T15:45:58Z",
55
"published": "2025-12-08T22:19:04Z",
66
"aliases": [
77
"CVE-2025-67494"
@@ -97,6 +97,10 @@
9797
"type": "WEB",
9898
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-7wfc-4796-gmg5"
9999
},
100+
{
101+
"type": "ADVISORY",
102+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67494"
103+
},
100104
{
101105
"type": "WEB",
102106
"url": "https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96"
@@ -113,6 +117,6 @@
113117
"severity": "CRITICAL",
114118
"github_reviewed": true,
115119
"github_reviewed_at": "2025-12-08T22:19:04Z",
116-
"nvd_published_at": null
120+
"nvd_published_at": "2025-12-09T22:16:16Z"
117121
}
118122
}

‎advisories/github-reviewed/2025/12/GHSA-cc84-q3v3-mhgf/GHSA-cc84-q3v3-mhgf.json‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cc84-q3v3-mhgf",
4+
"modified": "2025-12-10T15:46:57Z",
5+
"published": "2025-12-10T15:46:57Z",
6+
"aliases": [
7+
"CVE-2025-66473"
8+
],
9+
"summary": "XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis",
10+
"details": "### Impact\nXWiki's REST API doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the `/rest/wikis/xwiki/spaces` resource returns all spaces on the wiki by default, which are basically all pages.\n\n### Patches\nXWiki 17.7.0RC1, 17.4.4 and 16.10.11 introduce a configurable limit, limiting responses to 1000 items by default. Requesting larger limits leads to an error now.\n\n### Workarounds\nWe're not aware of any workaround, except denying access to the affected REST resources in a proxy in front of XWiki.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.xwiki.platform:xwiki-platform-rest-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "16.10.11"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.xwiki.platform:xwiki-platform-rest-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "17.0.0-rc-1"
48+
},
49+
{
50+
"fixed": "17.4.4"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.xwiki.platform:xwiki-platform-rest-server"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "17.5.0-rc-1"
67+
},
68+
{
69+
"fixed": "17.7.0-rc-1"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cc84-q3v3-mhgf"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/xwiki/xwiki-platform/commit/e3c47745195fb445b054537be86f5c01ee69558b"
84+
},
85+
{
86+
"type": "PACKAGE",
87+
"url": "https://github.com/xwiki/xwiki-platform"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://jira.xwiki.org/browse/XWIKI-23355"
92+
}
93+
],
94+
"database_specific": {
95+
"cwe_ids": [
96+
"CWE-770"
97+
],
98+
"severity": "HIGH",
99+
"github_reviewed": true,
100+
"github_reviewed_at": "2025-12-10T15:46:57Z",
101+
"nvd_published_at": null
102+
}
103+
}

‎advisories/github-reviewed/2025/12/GHSA-hxp3-63hc-5366/GHSA-hxp3-63hc-5366.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hxp3-63hc-5366",
4-
"modified": "2025-12-09T14:25:16Z",
4+
"modified": "2025-12-10T15:46:17Z",
55
"published": "2025-12-09T14:25:15Z",
66
"aliases": [
77
"CVE-2025-66645"
@@ -40,6 +40,10 @@
4040
"type": "WEB",
4141
"url": "https://github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66645"
46+
},
4347
{
4448
"type": "WEB",
4549
"url": "https://github.com/zauberzeug/nicegui/commit/a1b89e2a24e1911a40389ace2153a37f4eea92a9"
@@ -56,6 +60,6 @@
5660
"severity": "HIGH",
5761
"github_reviewed": true,
5862
"github_reviewed_at": "2025-12-09T14:25:15Z",
59-
"nvd_published_at": null
63+
"nvd_published_at": "2025-12-09T22:16:15Z"
6064
}
6165
}

‎advisories/github-reviewed/2025/12/GHSA-jv3w-x3r3-g6rm/GHSA-jv3w-x3r3-g6rm.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jv3w-x3r3-g6rm",
4-
"modified": "2025-12-09T17:18:59Z",
4+
"modified": "2025-12-10T15:46:29Z",
55
"published": "2025-12-09T17:18:59Z",
66
"aliases": [
77
"CVE-2025-67499"
@@ -40,13 +40,25 @@
4040
"type": "WEB",
4141
"url": "https://github.com/containernetworking/plugins/security/advisories/GHSA-jv3w-x3r3-g6rm"
4242
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67499"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/containernetworking/plugins/pull/1210"
50+
},
4351
{
4452
"type": "WEB",
4553
"url": "https://github.com/containernetworking/plugins/commit/9b3772e1a7abf93cbb7c6526a28bc0d27b830e02"
4654
},
4755
{
4856
"type": "PACKAGE",
4957
"url": "https://github.com/containernetworking/plugins"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/containernetworking/plugins/releases/tag/v1.9.0"
5062
}
5163
],
5264
"database_specific": {
@@ -56,6 +68,6 @@
5668
"severity": "MODERATE",
5769
"github_reviewed": true,
5870
"github_reviewed_at": "2025-12-09T17:18:59Z",
59-
"nvd_published_at": null
71+
"nvd_published_at": "2025-12-10T00:16:11Z"
6072
}
6173
}

‎advisories/github-reviewed/2025/12/GHSA-v959-qxv6-6f8p/GHSA-v959-qxv6-6f8p.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v959-qxv6-6f8p",
4-
"modified": "2025-12-08T22:20:07Z",
4+
"modified": "2025-12-10T15:46:09Z",
55
"published": "2025-12-08T22:20:07Z",
66
"aliases": [
77
"CVE-2025-67495"
@@ -97,6 +97,10 @@
9797
"type": "WEB",
9898
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-v959-qxv6-6f8p"
9999
},
100+
{
101+
"type": "ADVISORY",
102+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67495"
103+
},
100104
{
101105
"type": "WEB",
102106
"url": "https://github.com/zitadel/zitadel/commit/4c879b47334e01d4fcab921ac1b44eda39acdb96"
@@ -113,6 +117,6 @@
113117
"severity": "HIGH",
114118
"github_reviewed": true,
115119
"github_reviewed_at": "2025-12-08T22:20:07Z",
116-
"nvd_published_at": null
120+
"nvd_published_at": "2025-12-09T23:15:59Z"
117121
}
118122
}

0 commit comments

Comments
 (0)