Skip to content

Commit 2e40acc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 5fd4b7d commit 2e40acc

File tree

31 files changed

+637
-43
lines changed

31 files changed

+637
-43
lines changed

‎advisories/unreviewed/2025/10/GHSA-jgm2-j5pr-pph9/GHSA-jgm2-j5pr-pph9.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45-
"CWE-284"
45+
"CWE-284",
46+
"CWE-434"
4647
],
4748
"severity": "MODERATE",
4849
"github_reviewed": false,

‎advisories/unreviewed/2025/10/GHSA-jvgr-7mgj-9rx2/GHSA-jvgr-7mgj-9rx2.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45-
"CWE-284"
45+
"CWE-284",
46+
"CWE-434"
4647
],
4748
"severity": "MODERATE",
4849
"github_reviewed": false,

‎advisories/unreviewed/2025/11/GHSA-25fh-5c58-j8q5/GHSA-25fh-5c58-j8q5.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-25fh-5c58-j8q5",
4-
"modified": "2025-11-21T15:31:27Z",
4+
"modified": "2025-11-22T00:31:20Z",
55
"published": "2025-11-21T15:31:26Z",
66
"aliases": [
77
"CVE-2025-66073"
88
],
99
"details": "Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through <= 3.3.8.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-502"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2025-11-21T13:15:48Z"

‎advisories/unreviewed/2025/11/GHSA-2gw8-x645-qvjj/GHSA-2gw8-x645-qvjj.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2gw8-x645-qvjj",
4+
"modified": "2025-11-22T00:31:20Z",
5+
"published": "2025-11-22T00:31:20Z",
6+
"aliases": [
7+
"CVE-2025-0504"
8+
],
9+
"details": "Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible. Exploitation does not grant full system control, but it may enable unauthorized changes to project configurations or access to system sensitive information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0504"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2025-0504"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-266"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-21T22:16:17Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-2mmq-prpj-ww9q/GHSA-2mmq-prpj-ww9q.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2mmq-prpj-ww9q",
4+
"modified": "2025-11-22T00:31:21Z",
5+
"published": "2025-11-22T00:31:21Z",
6+
"aliases": [
7+
"CVE-2025-11936"
8+
],
9+
"details": "Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to excessive CPU and memory consumption during ClientHello processing.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11936"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/wolfSSL/wolfssl/pull/9117"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/wolfSSL/wolfssl"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-20"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-21T23:15:44Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-3x9f-jgfq-gjmx/GHSA-3x9f-jgfq-gjmx.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3x9f-jgfq-gjmx",
4+
"modified": "2025-11-22T00:31:21Z",
5+
"published": "2025-11-22T00:31:21Z",
6+
"aliases": [
7+
"CVE-2025-31266"
8+
],
9+
"details": "A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31266"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://support.apple.com/en-us/122716"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://support.apple.com/en-us/122719"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-21T22:16:19Z"
32+
}
33+
}

‎advisories/unreviewed/2025/11/GHSA-4497-xvm3-5vh9/GHSA-4497-xvm3-5vh9.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4497-xvm3-5vh9",
4+
"modified": "2025-11-22T00:31:20Z",
5+
"published": "2025-11-22T00:31:20Z",
6+
"aliases": [
7+
"CVE-2025-11935"
8+
],
9+
"details": "With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing psk_dhe_ke without a key_share extension. The re-use of an authenticated PSK connection that on the clients side unexpectedly did not have PFS, reduces the security of the connection.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11935"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/wolfSSL/wolfssl/pull/9112"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/wolfSSL/wolfssl"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-326"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-21T22:16:18Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-4w2g-j23f-x62h/GHSA-4w2g-j23f-x62h.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4w2g-j23f-x62h",
4-
"modified": "2025-11-21T15:31:27Z",
4+
"modified": "2025-11-22T00:31:20Z",
55
"published": "2025-11-21T15:31:27Z",
66
"aliases": [
77
"CVE-2025-66083"
88
],
99
"details": "Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 5.0.4.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2025-11-21T13:15:49Z"

‎advisories/unreviewed/2025/11/GHSA-5v3v-f25w-2f2w/GHSA-5v3v-f25w-2f2w.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5v3v-f25w-2f2w",
4-
"modified": "2025-11-21T15:31:26Z",
4+
"modified": "2025-11-22T00:31:20Z",
55
"published": "2025-11-21T15:31:26Z",
66
"aliases": [
77
"CVE-2025-66066"
88
],
99
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra envo-extra allows Stored XSS.This issue affects Envo Extra: from n/a through <= 1.9.11.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-79"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2025-11-21T13:15:47Z"

‎advisories/unreviewed/2025/11/GHSA-66mj-mp25-rg6g/GHSA-66mj-mp25-rg6g.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-66mj-mp25-rg6g",
4-
"modified": "2025-11-21T15:31:27Z",
4+
"modified": "2025-11-22T00:31:20Z",
55
"published": "2025-11-21T15:31:27Z",
66
"aliases": [
77
"CVE-2025-66085"
88
],
99
"details": "Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2025-11-21T13:15:49Z"

0 commit comments

Comments
 (0)