Skip to content

Commit 1d3df75

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4cj5-g32w-86fv GHSA-8g4c-2q3x-9mwx GHSA-ccpp-j37g-5j85 GHSA-cf45-9gm7-48g2 GHSA-fqmp-3m4p-qrq2 GHSA-fw62-2gpr-jghv GHSA-g5h3-m84x-898j GHSA-r5px-69pm-q397
1 parent 607aa61 commit 1d3df75

File tree

8 files changed

+330
-0
lines changed

8 files changed

+330
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-4cj5-g32w-86fv/GHSA-4cj5-g32w-86fv.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4cj5-g32w-86fv",
4+
"modified": "2025-12-16T06:30:18Z",
5+
"published": "2025-12-16T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-14777"
8+
],
9+
"details": "A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14777"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2025-14777"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422596"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-289"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-16T05:16:11Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-8g4c-2q3x-9mwx/GHSA-8g4c-2q3x-9mwx.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8g4c-2q3x-9mwx",
4+
"modified": "2025-12-16T06:30:19Z",
5+
"published": "2025-12-16T06:30:19Z",
6+
"aliases": [
7+
"CVE-2025-61976"
8+
],
9+
"details": "CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. If a remote attacker sends a specially crafted request to the Video Download interface, the system may become unresponsive.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61976"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/vu/JVNVU92827367"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.inaba.co.jp/files/chocomini_vulnerability_newly_identified.pdf"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-754"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-16T05:16:13Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-ccpp-j37g-5j85/GHSA-ccpp-j37g-5j85.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ccpp-j37g-5j85",
4+
"modified": "2025-12-16T06:30:19Z",
5+
"published": "2025-12-16T06:30:19Z",
6+
"aliases": [
7+
"CVE-2025-66357"
8+
],
9+
"details": "CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. When the Video Download feature is in a specific communication state, the product's resources may be consumed abnormally.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66357"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/vu/JVNVU92827367"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.inaba.co.jp/files/chocomini_vulnerability_newly_identified.pdf"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-754"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-16T05:16:14Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-cf45-9gm7-48g2/GHSA-cf45-9gm7-48g2.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cf45-9gm7-48g2",
4+
"modified": "2025-12-16T06:30:20Z",
5+
"published": "2025-12-16T06:30:20Z",
6+
"aliases": [
7+
"CVE-2025-12809"
8+
],
9+
"details": "The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to enumerate users and retrieve their email addresses via the REST API by providing a user ID, along with other information such as usernames, display names, user roles, and registration dates.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12809"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://dokan.co/wordpress/changelog"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/534557b0-16d2-4a77-a118-b66fc7474ecf?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-16T06:15:41Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-fqmp-3m4p-qrq2/GHSA-fqmp-3m4p-qrq2.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fqmp-3m4p-qrq2",
4+
"modified": "2025-12-16T06:30:18Z",
5+
"published": "2025-12-16T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-59479"
8+
],
9+
"details": "CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a user clicks on content on a malicious web page while logged into the product, unintended operations may be performed on the product.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59479"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/vu/JVNVU92827367"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.inaba.co.jp/files/chocomini_vulnerability_newly_identified.pdf"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-1021"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-16T05:16:13Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-fw62-2gpr-jghv/GHSA-fw62-2gpr-jghv.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fw62-2gpr-jghv",
4+
"modified": "2025-12-16T06:30:20Z",
5+
"published": "2025-12-16T06:30:20Z",
6+
"aliases": [
7+
"CVE-2025-14252"
8+
],
9+
"details": "An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in privilege escalation, arbitrary code execution, and information disclosure. This issue affects Advantech SUSI: 5.0.24335 and prior.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14252"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.txone.com/psirt/advisories/CVE-2025-14252"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [],
33+
"severity": "HIGH",
34+
"github_reviewed": false,
35+
"github_reviewed_at": null,
36+
"nvd_published_at": "2025-12-16T06:15:42Z"
37+
}
38+
}

‎advisories/unreviewed/2025/12/GHSA-g5h3-m84x-898j/GHSA-g5h3-m84x-898j.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g5h3-m84x-898j",
4+
"modified": "2025-12-16T06:30:18Z",
5+
"published": "2025-12-16T06:30:18Z",
6+
"aliases": [
7+
"CVE-2025-13956"
8+
],
9+
"details": "The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13956"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.1/inc/rest-api/v1/frontend/class-lp-rest-orders-controller.php#L36"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c4b833c3-818d-4646-bd6d-8b3be13ea0f1?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-16T05:16:08Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-r5px-69pm-q397/GHSA-r5px-69pm-q397.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r5px-69pm-q397",
4+
"modified": "2025-12-16T06:30:20Z",
5+
"published": "2025-12-16T06:30:20Z",
6+
"aliases": [
7+
"CVE-2025-13794"
8+
],
9+
"details": "The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13794"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/tags/4.2.1/includes/class-plugin.php#L425"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/29b0fd97-a669-42bb-b01e-bdc0395d697e?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-16T06:15:42Z"
39+
}
40+
}

0 commit comments

Comments
 (0)