Skip to content

Commit 25510c7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-g5jc-hc65-x4vm GHSA-9x68-7qq6-v523 GHSA-5686-39p2-jcpx GHSA-www6-qmfj-v924 GHSA-33x2-whwf-gwv7 GHSA-jffx-85pq-vrr5 GHSA-r4f7-5v86-4w55 GHSA-wcw3-c785-7q5x
1 parent 795a8ab commit 25510c7

File tree

8 files changed

+169
-3
lines changed

8 files changed

+169
-3
lines changed

‎advisories/unreviewed/2022/12/GHSA-g5jc-hc65-x4vm/GHSA-g5jc-hc65-x4vm.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
],
3131
"database_specific": {
3232
"cwe_ids": [
33+
"CWE-707",
3334
"CWE-89"
3435
],
3536
"severity": "CRITICAL",

‎advisories/unreviewed/2025/01/GHSA-9x68-7qq6-v523/GHSA-9x68-7qq6-v523.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9x68-7qq6-v523",
4-
"modified": "2025-12-22T12:30:21Z",
4+
"modified": "2025-12-22T15:30:20Z",
55
"published": "2025-01-14T18:32:00Z",
66
"aliases": [
77
"CVE-2024-12087"
@@ -59,6 +59,14 @@
5959
"type": "WEB",
6060
"url": "https://access.redhat.com/errata/RHSA-2025:2600"
6161
},
62+
{
63+
"type": "WEB",
64+
"url": "https://access.redhat.com/errata/RHSA-2025:23858"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://access.redhat.com/errata/RHSA-2025:23854"
69+
},
6270
{
6371
"type": "WEB",
6472
"url": "https://access.redhat.com/errata/RHSA-2025:23853"

‎advisories/unreviewed/2025/10/GHSA-5686-39p2-jcpx/GHSA-5686-39p2-jcpx.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5686-39p2-jcpx",
4-
"modified": "2025-10-03T21:30:59Z",
4+
"modified": "2025-12-22T15:30:20Z",
55
"published": "2025-10-03T21:30:59Z",
66
"aliases": [
77
"CVE-2025-10695"
88
],
99
"details": "Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction.\n\nThis issue affects OpenSupports: 4.11.0.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/10/GHSA-www6-qmfj-v924/GHSA-www6-qmfj-v924.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-www6-qmfj-v924",
4-
"modified": "2025-10-03T21:30:59Z",
4+
"modified": "2025-12-22T15:30:21Z",
55
"published": "2025-10-03T21:30:59Z",
66
"aliases": [
77
"CVE-2025-10696"
88
],
99
"details": "OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/12/GHSA-33x2-whwf-gwv7/GHSA-33x2-whwf-gwv7.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-33x2-whwf-gwv7",
4+
"modified": "2025-12-22T15:30:21Z",
5+
"published": "2025-12-22T15:30:21Z",
6+
"aliases": [
7+
"CVE-2025-67826"
8+
],
9+
"details": "An issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security antivirus can be exploited by a local unprivileged user on default installations of the product. Insecure access to a named pipe allows unprivileged users to edit any registry key, leading to a full compromise as SYSTEM.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67826"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-22nd-Dec-2025"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://www.k7computing.com"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-12-22T15:16:00Z"
32+
}
33+
}

‎advisories/unreviewed/2025/12/GHSA-jffx-85pq-vrr5/GHSA-jffx-85pq-vrr5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jffx-85pq-vrr5",
4+
"modified": "2025-12-22T15:30:21Z",
5+
"published": "2025-12-22T15:30:21Z",
6+
"aliases": [
7+
"CVE-2025-14018"
8+
],
9+
"details": "Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File Search Paths, Redirect Access to Libraries.This issue affects e-Fatura: before 1.2.15.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14018"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.usom.gov.tr/bildirim/tr-25-0474"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-428"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-22T14:15:59Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-r4f7-5v86-4w55/GHSA-r4f7-5v86-4w55.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r4f7-5v86-4w55",
4+
"modified": "2025-12-22T15:30:21Z",
5+
"published": "2025-12-22T15:30:21Z",
6+
"aliases": [
7+
"CVE-2025-61740"
8+
],
9+
"details": "Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61740"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-346"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-22T15:16:00Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-wcw3-c785-7q5x/GHSA-wcw3-c785-7q5x.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wcw3-c785-7q5x",
4+
"modified": "2025-12-22T15:30:21Z",
5+
"published": "2025-12-22T15:30:21Z",
6+
"aliases": [
7+
"CVE-2025-26379"
8+
],
9+
"details": "Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26379"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-338"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-22T15:16:00Z"
39+
}
40+
}

0 commit comments

Comments
 (0)