Skip to content

Commit 2104723

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9xfg-frpc-8rwp GHSA-cgg5-w2f8-858m GHSA-frv9-vg6r-h5pf GHSA-qmv7-fcxw-pj9w GHSA-w7m5-fqxg-p9q5
1 parent 3c41662 commit 2104723

File tree

5 files changed

+188
-0
lines changed

5 files changed

+188
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-9xfg-frpc-8rwp/GHSA-9xfg-frpc-8rwp.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9xfg-frpc-8rwp",
4+
"modified": "2025-11-10T09:30:27Z",
5+
"published": "2025-11-10T09:30:27Z",
6+
"aliases": [
7+
"CVE-2025-12409"
8+
],
9+
"details": "A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources.\n \nBy creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery.\n\nThis vulnerability was patched on 07 July 2025, and no customer action is needed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12409"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cloud.google.com/support/bulletins#gcp-2025-053"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.tenable.com/security/research/tra-2025-27"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-10T09:15:42Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-cgg5-w2f8-858m/GHSA-cgg5-w2f8-858m.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cgg5-w2f8-858m",
4+
"modified": "2025-11-10T09:30:27Z",
5+
"published": "2025-11-10T09:30:27Z",
6+
"aliases": [
7+
"CVE-2025-41731"
8+
],
9+
"details": "A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41731"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://jumo.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-086.json"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-338"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-10T08:15:33Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-frv9-vg6r-h5pf/GHSA-frv9-vg6r-h5pf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-frv9-vg6r-h5pf",
4+
"modified": "2025-11-10T09:30:27Z",
5+
"published": "2025-11-10T09:30:27Z",
6+
"aliases": [
7+
"CVE-2025-41107"
8+
],
9+
"details": "Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admission', wich affects the parameters 'firstname', 'lastname', 'guardian_name' and others. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal his/her session cookie details.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41107"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-smart-school"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-10T09:15:42Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-qmv7-fcxw-pj9w/GHSA-qmv7-fcxw-pj9w.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qmv7-fcxw-pj9w",
4+
"modified": "2025-11-10T09:30:27Z",
5+
"published": "2025-11-10T09:30:27Z",
6+
"aliases": [
7+
"CVE-2025-12397"
8+
],
9+
"details": "A SQL injection vulnerability was found in Looker Studio.\n\nA Looker Studio user with report view access could inject malicious SQL that would execute with the report owner's permissions. The vulnerability affected to reports with BigQuery as the data source.\n\nThis vulnerability was patched on 21 July 2025, and no customer action is needed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12397"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cloud.google.com/support/bulletins#gcp-2025-053"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.tenable.com/security/research/tra-2025-28"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-10T09:15:41Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-w7m5-fqxg-p9q5/GHSA-w7m5-fqxg-p9q5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w7m5-fqxg-p9q5",
4+
"modified": "2025-11-10T09:30:27Z",
5+
"published": "2025-11-10T09:30:27Z",
6+
"aliases": [
7+
"CVE-2025-12155"
8+
],
9+
"details": "A Command Injection vulnerability, resulting from improper file path sanitization (Directory Traversal) in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system.\n\nLooker-hosted and Self-hosted were found to be vulnerable.\nThis issue has already been mitigated for Looker-hosted instances. No user action is required for these.\n\nSelf-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.\nThe versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :\n * 24.12.100+\n * 24.18.192+\n * 25.0.69+\n * 25.6.57+\n * 25.8.39+\n * 25.10.22+",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:X/U:Red"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12155"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cloud.google.com/support/bulletins#gcp-2025-052"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-77"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-10T09:15:41Z"
35+
}
36+
}

0 commit comments

Comments
 (0)