Skip to content

Commit 1c03fd3

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent eba383b commit 1c03fd3

File tree

43 files changed

+1632
-8
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1632
-8
lines changed

‎advisories/unreviewed/2024/03/GHSA-3m2p-xpv4-jfjm/GHSA-3m2p-xpv4-jfjm.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3m2p-xpv4-jfjm",
4-
"modified": "2024-03-21T03:36:46Z",
4+
"modified": "2025-09-02T15:31:06Z",
55
"published": "2024-03-21T03:36:46Z",
66
"aliases": [
77
"CVE-2024-1908"
88
],
9-
"details": "An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. An attacker would require an account on the server instance with non-default settings for GitHub Connect. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. This vulnerability was reported via the GitHub Bug Bounty program. \n\n\n",
9+
"details": "An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use the Enterprise Actions GitHub Connect download token to fetch private repository data. An attacker would require an account on the server instance with non-default settings for GitHub Connect. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.16, 3.9.11, 3.10.8, and 3.11.6. This vulnerability was reported via the GitHub Bug Bounty program. ",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2025/05/GHSA-3p82-g7cx-7qrf/GHSA-3p82-g7cx-7qrf.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3p82-g7cx-7qrf",
4-
"modified": "2025-05-22T15:34:51Z",
4+
"modified": "2025-09-02T15:31:06Z",
55
"published": "2025-05-22T15:34:51Z",
66
"aliases": [
77
"CVE-2025-5078"
@@ -39,6 +39,10 @@
3939
"type": "WEB",
4040
"url": "https://vuldb.com/?submit.581432"
4141
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.641751"
45+
},
4246
{
4347
"type": "WEB",
4448
"url": "https://www.campcodes.com"

‎advisories/unreviewed/2025/08/GHSA-f7wf-m2qg-r9rx/GHSA-f7wf-m2qg-r9rx.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f7wf-m2qg-r9rx",
4-
"modified": "2025-08-29T18:30:50Z",
4+
"modified": "2025-09-02T15:31:07Z",
55
"published": "2025-08-29T18:30:50Z",
66
"aliases": [
77
"CVE-2025-55177"
@@ -19,6 +19,10 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55177"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.facebook.com/security/advisories/cve-2025-55177"
25+
},
2226
{
2327
"type": "WEB",
2428
"url": "https://www.whatsapp.com/security/advisories/2025"

‎advisories/unreviewed/2025/08/GHSA-fc59-q736-3r9p/GHSA-fc59-q736-3r9p.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fc59-q736-3r9p",
4-
"modified": "2025-08-15T15:30:23Z",
4+
"modified": "2025-09-02T15:31:06Z",
55
"published": "2025-08-14T18:31:28Z",
66
"aliases": [
77
"CVE-2025-50518"
@@ -19,6 +19,18 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50518"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/IreneTheITCrowd/blog/issues/1"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/obgm/libcoap/issues/1724#issuecomment-3199631257"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/obgm/libcoap/issues/1724#issuecomment-3234613482"
33+
},
2234
{
2335
"type": "WEB",
2436
"url": "https://github.com/IreneTheITCrowd/blog/blob/main/libcoap-vulnerability.md"

‎advisories/unreviewed/2025/08/GHSA-pvrh-q8vc-9vpv/GHSA-pvrh-q8vc-9vpv.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pvrh-q8vc-9vpv",
4-
"modified": "2025-08-29T12:31:12Z",
4+
"modified": "2025-09-02T15:31:06Z",
55
"published": "2025-08-29T12:31:12Z",
66
"aliases": [
77
"CVE-2025-40708"
88
],
99
"details": "Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the \"/insert/event\" petition, \"name\" parameter.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/08/GHSA-rrcr-6rg5-cgmj/GHSA-rrcr-6rg5-cgmj.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rrcr-6rg5-cgmj",
4-
"modified": "2025-08-29T12:31:12Z",
4+
"modified": "2025-09-02T15:31:06Z",
55
"published": "2025-08-29T12:31:12Z",
66
"aliases": [
77
"CVE-2025-40709"
88
],
99
"details": "Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the \"/insert/person/<ID>” petition, \"name\" and \"alias-0” parameters.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/08/GHSA-v3v7-q6j6-7xwr/GHSA-v3v7-q6j6-7xwr.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v3v7-q6j6-7xwr",
4-
"modified": "2025-08-29T12:31:12Z",
4+
"modified": "2025-09-02T15:31:06Z",
55
"published": "2025-08-29T12:31:12Z",
66
"aliases": [
77
"CVE-2025-40707"
88
],
99
"details": "Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the \"/insert/place\" petition, \"name\" and \"alias-0” parameters.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/09/GHSA-3qp4-ph79-wf85/GHSA-3qp4-ph79-wf85.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3qp4-ph79-wf85",
4+
"modified": "2025-09-02T15:31:07Z",
5+
"published": "2025-09-02T15:31:07Z",
6+
"aliases": [
7+
"CVE-2022-38695"
8+
],
9+
"details": "In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38695"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-250"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-01T08:15:32Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-48qx-3q6v-746v/GHSA-48qx-3q6v-746v.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-48qx-3q6v-746v",
4+
"modified": "2025-09-02T15:31:07Z",
5+
"published": "2025-09-02T15:31:07Z",
6+
"aliases": [
7+
"CVE-2022-38691"
8+
],
9+
"details": "In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privileges needed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38691"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-250"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-01T08:15:31Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-4pcj-2vcf-4q8j/GHSA-4pcj-2vcf-4q8j.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4pcj-2vcf-4q8j",
4+
"modified": "2025-09-02T15:31:08Z",
5+
"published": "2025-09-02T15:31:08Z",
6+
"aliases": [
7+
"CVE-2025-9790"
8+
],
9+
"details": "A security flaw has been discovered in SourceCodester Hotel Reservation System 1.0. This affects an unknown part of the file /admin/updateabout.php. The manipulation of the argument address results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9790"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/YoSheep/cve/blob/main/Online%20Hotel%20Reservation%20System%20In%20PHP%20With%20Source%20Code%20-%20SQL%20Injection%20in%20updateabout.php.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.322105"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.322105"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.641069"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.sourcecodester.com"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-09-01T19:15:31Z"
55+
}
56+
}

0 commit comments

Comments
 (0)