Skip to content

Commit 20b4495

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7whh-79j3-7c55 GHSA-jv6h-4262-q663
1 parent 98fe1eb commit 20b4495

File tree

2 files changed

+127
-4
lines changed

2 files changed

+127
-4
lines changed

‎advisories/github-reviewed/2025/10/GHSA-7whh-79j3-7c55/GHSA-7whh-79j3-7c55.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7whh-79j3-7c55",
4+
"modified": "2025-10-28T17:49:50Z",
5+
"published": "2025-10-28T17:49:50Z",
6+
"aliases": [
7+
"CVE-2025-62784"
8+
],
9+
"summary": "InventoryGui allows item duplication in GUIs which use GuiStorageElement",
10+
"details": "### Impact\nAny plugin using a GUI with the GuiStorageElement and allows taking out items out of that element.\n\n### Patches\nInventoryGui 1.6.5 (included in latest 1.6.5-SNAPSHOT) by disabling GuiStorageElement when not running on 1.21.9 or later.\n\n### Workarounds\nNot using the GuiStorageElement.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "de.themoep:inventorygui"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.6.5"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-7whh-79j3-7c55"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62784"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/Phoenix616/InventoryGui/commit/690fc91d137c6cc04f6ed3a89449050964dd8cb9"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/Phoenix616/InventoryGui"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-837"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-10-28T17:49:50Z",
63+
"nvd_published_at": "2025-10-27T21:15:38Z"
64+
}
65+
}

advisories/unreviewed/2025/10/GHSA-jv6h-4262-q663/GHSA-jv6h-4262-q663.json renamed to advisories/github-reviewed/2025/10/GHSA-jv6h-4262-q663/GHSA-jv6h-4262-q663.json

Lines changed: 62 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,94 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jv6h-4262-q663",
4-
"modified": "2025-10-25T00:30:39Z",
4+
"modified": "2025-10-28T17:48:24Z",
55
"published": "2025-10-25T00:30:39Z",
66
"aliases": [
77
"CVE-2025-12194"
88
],
9+
"summary": "Bouncy Castle Vulnerable to Uncontrolled Resource Consumption",
910
"details": "Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java.\n\nThis issue affects Bouncy Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
1314
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:C/RE:M/U:Amber"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.bouncycastle:bc-fips"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.1.0"
29+
},
30+
{
31+
"fixed": "2.1.2"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.1.1"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Maven",
43+
"name": "org.bouncycastle:bcprov-debug-lts8on"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "2.73.0"
51+
},
52+
{
53+
"fixed": "2.73.8"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 2.73.7"
60+
}
61+
}
62+
],
1763
"references": [
1864
{
1965
"type": "ADVISORY",
2066
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12194"
2167
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/bcgit/bc-lts-java/commit/2c9be6c64152ce48c6afc784c042a514be71ec71"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/bcgit/bc-lts-java/commit/f2776feac0c30230f7a5ac34eb24f5019caf0324"
75+
},
2276
{
2377
"type": "WEB",
2478
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9012194"
79+
},
80+
{
81+
"type": "PACKAGE",
82+
"url": "https://github.com/bcgit/bc-lts-java"
2583
}
2684
],
2785
"database_specific": {
2886
"cwe_ids": [
2987
"CWE-400"
3088
],
3189
"severity": "MODERATE",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
90+
"github_reviewed": true,
91+
"github_reviewed_at": "2025-10-28T17:48:24Z",
3492
"nvd_published_at": "2025-10-24T23:15:39Z"
3593
}
3694
}

0 commit comments

Comments
 (0)