Skip to content

Commit 43c1b20

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 4dcf226 commit 43c1b20

File tree

34 files changed

+781
-40
lines changed

34 files changed

+781
-40
lines changed

‎advisories/unreviewed/2025/09/GHSA-2xm6-gr28-3f78/GHSA-2xm6-gr28-3f78.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2xm6-gr28-3f78",
4-
"modified": "2025-09-16T15:32:35Z",
4+
"modified": "2025-12-02T18:30:26Z",
55
"published": "2025-09-16T15:32:35Z",
66
"aliases": [
77
"CVE-2025-39818"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save\n\nImproper use of secondary pointer (&dev->i2c_subip_regs) caused\nkernel crash and out-of-bounds error:\n\n BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510\n Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107\n\n CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\n Workqueue: async async_run_entry_fn\n Call Trace:\n <TASK>\n dump_stack_lvl+0x76/0xa0\n print_report+0xd1/0x660\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? kasan_complete_mode_report_info+0x26/0x200\n kasan_report+0xe1/0x120\n ? _regmap_bulk_read+0x449/0x510\n ? _regmap_bulk_read+0x449/0x510\n __asan_report_store4_noabort+0x17/0x30\n _regmap_bulk_read+0x449/0x510\n ? __pfx__regmap_bulk_read+0x10/0x10\n regmap_bulk_read+0x270/0x3d0\n pio_complete+0x1ee/0x2c0 [intel_thc]\n ? __pfx_pio_complete+0x10/0x10 [intel_thc]\n ? __pfx_pio_wait+0x10/0x10 [intel_thc]\n ? regmap_update_bits_base+0x13b/0x1f0\n thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]\n thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]\n ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]\n[...]\n The buggy address belongs to the object at ffff888136005d00\n which belongs to the cache kmalloc-rnd-12-192 of size 192\n The buggy address is located 0 bytes to the right of\n allocated 192-byte region [ffff888136005d00, ffff888136005dc0)\n\nReplaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure\nsafe memory access.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-787"
34+
],
35+
"severity": "HIGH",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-09-16T13:15:57Z"

‎advisories/unreviewed/2025/10/GHSA-8cmf-rx89-f229/GHSA-8cmf-rx89-f229.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8cmf-rx89-f229",
4-
"modified": "2025-10-22T00:33:24Z",
4+
"modified": "2025-12-02T18:30:26Z",
55
"published": "2025-10-14T18:30:34Z",
66
"aliases": [
77
"CVE-2025-59230"
@@ -26,6 +26,14 @@
2626
{
2727
"type": "WEB",
2828
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59230"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-59230-detection-script-elevation-of-privilege-vulnerability-affecting-windows-rasman"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-59230-mitigation-script-elevation-of-privilege-vulnerability-affecting-windows-rasman"
2937
}
3038
],
3139
"database_specific": {

‎advisories/unreviewed/2025/11/GHSA-43w2-q5cj-hwmq/GHSA-43w2-q5cj-hwmq.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-43w2-q5cj-hwmq",
4-
"modified": "2025-11-26T21:31:26Z",
4+
"modified": "2025-12-02T18:30:29Z",
55
"published": "2025-11-26T21:31:26Z",
66
"aliases": [
77
"CVE-2025-65669"
88
],
99
"details": "An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-862"
38+
],
39+
"severity": "CRITICAL",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2025-11-26T19:15:47Z"

‎advisories/unreviewed/2025/11/GHSA-8ggr-43pq-rp2g/GHSA-8ggr-43pq-rp2g.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8ggr-43pq-rp2g",
4-
"modified": "2025-11-26T18:31:04Z",
4+
"modified": "2025-12-02T18:30:29Z",
55
"published": "2025-11-26T18:31:04Z",
66
"aliases": [
77
"CVE-2025-65236"
88
],
99
"details": "OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-89"
38+
],
39+
"severity": "CRITICAL",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2025-11-26T17:15:47Z"

‎advisories/unreviewed/2025/11/GHSA-gfvq-wmqw-q9j2/GHSA-gfvq-wmqw-q9j2.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gfvq-wmqw-q9j2",
4-
"modified": "2025-11-26T21:31:26Z",
4+
"modified": "2025-12-02T18:30:29Z",
55
"published": "2025-11-26T21:31:26Z",
66
"aliases": [
77
"CVE-2025-65675"
88
],
99
"details": "Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2025-11-26T19:15:48Z"

‎advisories/unreviewed/2025/11/GHSA-h67h-6hv5-vfg2/GHSA-h67h-6hv5-vfg2.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h67h-6hv5-vfg2",
4-
"modified": "2025-11-26T18:31:04Z",
4+
"modified": "2025-12-02T18:30:29Z",
55
"published": "2025-11-26T18:31:04Z",
66
"aliases": [
77
"CVE-2025-55469"
88
],
99
"details": "Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-284"
38+
],
39+
"severity": "CRITICAL",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2025-11-26T18:15:48Z"

‎advisories/unreviewed/2025/11/GHSA-jxxq-v434-pmg5/GHSA-jxxq-v434-pmg5.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-74"
49+
"CWE-74",
50+
"CWE-91"
5051
],
5152
"severity": "MODERATE",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/11/GHSA-q269-xqww-45mm/GHSA-q269-xqww-45mm.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@
5454
],
5555
"database_specific": {
5656
"cwe_ids": [
57-
"CWE-119"
57+
"CWE-119",
58+
"CWE-787"
5859
],
5960
"severity": "MODERATE",
6061
"github_reviewed": false,

‎advisories/unreviewed/2025/11/GHSA-rxc6-c5mm-j9vx/GHSA-rxc6-c5mm-j9vx.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rxc6-c5mm-j9vx",
4-
"modified": "2025-11-26T21:31:26Z",
4+
"modified": "2025-12-02T18:30:30Z",
55
"published": "2025-11-26T21:31:26Z",
66
"aliases": [
77
"CVE-2025-65676"
88
],
99
"details": "Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2025-11-26T19:15:48Z"

‎advisories/unreviewed/2025/11/GHSA-x96r-v3vc-578h/GHSA-x96r-v3vc-578h.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-x96r-v3vc-578h",
4-
"modified": "2025-11-19T18:31:21Z",
4+
"modified": "2025-12-02T18:30:26Z",
55
"published": "2025-11-19T18:31:21Z",
66
"aliases": [
77
"CVE-2025-13315"
88
],
99
"details": "Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

0 commit comments

Comments
 (0)