Skip to content

Commit 2394e0f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-23xc-wwgh-93wr GHSA-36wg-34jh-gmgv GHSA-g42p-2jqv-j24r GHSA-mhm8-9xx6-hwgw GHSA-vxpx-mqx4-f9h3 GHSA-ww92-642m-ccgq
1 parent 0391b70 commit 2394e0f

File tree

6 files changed

+320
-0
lines changed

6 files changed

+320
-0
lines changed

‎advisories/unreviewed/2025/10/GHSA-23xc-wwgh-93wr/GHSA-23xc-wwgh-93wr.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-23xc-wwgh-93wr",
4+
"modified": "2025-10-05T03:30:19Z",
5+
"published": "2025-10-05T03:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11276"
8+
],
9+
"details": "A security flaw has been discovered in Rebuild up to 4.1.3. Affected by this issue is some unknown functionality of the component Comment/Guestbook. Performing manipulation results in cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 4.1.4 can resolve this issue. It is suggested to upgrade the affected component. According to the researcher the vendor has confirmed the flaw and fix in a private issue response.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11276"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitee.com/getrebuild/rebuild/releases/tag/4.1.4"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.327010"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.327010"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.658910"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-05T02:15:35Z"
51+
}
52+
}

‎advisories/unreviewed/2025/10/GHSA-36wg-34jh-gmgv/GHSA-36wg-34jh-gmgv.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-36wg-34jh-gmgv",
4+
"modified": "2025-10-05T03:30:20Z",
5+
"published": "2025-10-05T03:30:20Z",
6+
"aliases": [
7+
"CVE-2025-11277"
8+
],
9+
"details": "A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be exploited.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11277"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/assimp/assimp/issues/6358"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/user-attachments/files/22422643/poc.zip"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.327011"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.327011"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.658912"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-10-05T02:15:37Z"
55+
}
56+
}

‎advisories/unreviewed/2025/10/GHSA-g42p-2jqv-j24r/GHSA-g42p-2jqv-j24r.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g42p-2jqv-j24r",
4+
"modified": "2025-10-05T03:30:20Z",
5+
"published": "2025-10-05T03:30:20Z",
6+
"aliases": [
7+
"CVE-2025-11278"
8+
],
9+
"details": "A security vulnerability has been detected in AllStarLink Supermon up to 6.2. This vulnerability affects unknown code of the component AllMon2. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11278"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.327012"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.327012"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.659016"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-10-05T03:15:39Z"
47+
}
48+
}

‎advisories/unreviewed/2025/10/GHSA-mhm8-9xx6-hwgw/GHSA-mhm8-9xx6-hwgw.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mhm8-9xx6-hwgw",
4+
"modified": "2025-10-05T03:30:20Z",
5+
"published": "2025-10-05T03:30:20Z",
6+
"aliases": [
7+
"CVE-2025-11279"
8+
],
9+
"details": "A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. This issue affects some unknown processing of the component Add Work Item Page. The manipulation of the argument Title results in csv injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11279"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://drive.google.com/file/d/1Lw9_KYblnhg7FQU70G0SgH_VyYRUD-rX/view?usp=sharing"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.327013"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.327013"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.659422"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-10-05T03:15:40Z"
51+
}
52+
}

‎advisories/unreviewed/2025/10/GHSA-vxpx-mqx4-f9h3/GHSA-vxpx-mqx4-f9h3.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vxpx-mqx4-f9h3",
4+
"modified": "2025-10-05T03:30:19Z",
5+
"published": "2025-10-05T03:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11275"
8+
],
9+
"details": "A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/include/openddlparser/OpenDDLParserUtils.h. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11275"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/assimp/assimp/issues/6357"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/user-attachments/files/22417682/poc.zip"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.327009"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.327009"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.658675"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-10-05T01:15:35Z"
55+
}
56+
}

‎advisories/unreviewed/2025/10/GHSA-ww92-642m-ccgq/GHSA-ww92-642m-ccgq.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ww92-642m-ccgq",
4+
"modified": "2025-10-05T03:30:19Z",
5+
"published": "2025-10-05T03:30:19Z",
6+
"aliases": [
7+
"CVE-2025-11274"
8+
],
9+
"details": "A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11274"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/assimp/assimp/issues/6356"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/user-attachments/files/22407575/poc.zip"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.327008"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.327008"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.658075"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-400"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-10-05T01:15:35Z"
55+
}
56+
}

0 commit comments

Comments
 (0)