Skip to content

Commit 4812933

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2hg8-9339-xpwg GHSA-3679-62vm-qq5r GHSA-5j73-c8q2-cfqp GHSA-7954-xqv5-fh2r GHSA-7xq4-mwcp-q8fx GHSA-f85h-c7m6-cfpm GHSA-hq57-c72x-4774 GHSA-jhx5-4vr4-f327 GHSA-m4g6-6v9m-6q6x GHSA-mjv5-8wf2-6rhp GHSA-p8g3-7r42-x5c9
1 parent 4a9f1a6 commit 4812933

File tree

11 files changed

+456
-0
lines changed

11 files changed

+456
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-2hg8-9339-xpwg/GHSA-2hg8-9339-xpwg.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hg8-9339-xpwg",
4+
"modified": "2025-12-26T06:30:27Z",
5+
"published": "2025-12-26T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-15099"
8+
],
9+
"details": "A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the component CRON Secret Handler. The manipulation of the argument INTERNAL_API_SECRET leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is e359dc2946b12ed5e45a0ec9c95ecf91bd18502a. Applying a patch is the recommended action to fix this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15099"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/simstudioai/sim/pull/2343"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/simstudioai/sim/commit/e359dc2946b12ed5e45a0ec9c95ecf91bd18502a"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2#-steps-to-reproduce"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?ctiid.338430"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?id.338430"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?submit.710255"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-287"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2025-12-26T04:15:40Z"
63+
}
64+
}

‎advisories/unreviewed/2025/12/GHSA-3679-62vm-qq5r/GHSA-3679-62vm-qq5r.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3679-62vm-qq5r",
4+
"modified": "2025-12-26T06:30:27Z",
5+
"published": "2025-12-26T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-52598"
8+
],
9+
"details": "Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has found a flaw that camera's client service does not perform certificate validation. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52598"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.hanwhavision.com/wp-content/uploads/2025/12/Camera-Vulnerability-ReportCVE-2025-5259852601-8075.pdf"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-295"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-26T05:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-5j73-c8q2-cfqp/GHSA-5j73-c8q2-cfqp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5j73-c8q2-cfqp",
4+
"modified": "2025-12-26T06:30:27Z",
5+
"published": "2025-12-26T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-52600"
8+
],
9+
"details": "Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in camera video analytics that Improper input validation. This vulnerability could allow an attacker to execute specific commands on the user's host PC.The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52600"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.hanwhavision.com/wp-content/uploads/2025/12/Camera-Vulnerability-ReportCVE-2025-5259852601-8075.pdf"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-26T05:16:11Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-7954-xqv5-fh2r/GHSA-7954-xqv5-fh2r.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7954-xqv5-fh2r",
4+
"modified": "2025-12-26T06:30:27Z",
5+
"published": "2025-12-26T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-52601"
8+
],
9+
"details": "Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in Device Manager that a hardcoded encryption key for sensitive information. An attacker can use key to decrypt sensitive information. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52601"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.hanwhavision.com/wp-content/uploads/2025/12/Camera-Vulnerability-ReportCVE-2025-5259852601-8075.pdf"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-321"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-26T05:16:11Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-7xq4-mwcp-q8fx/GHSA-7xq4-mwcp-q8fx.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7xq4-mwcp-q8fx",
4+
"modified": "2025-12-26T06:30:27Z",
5+
"published": "2025-12-26T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-68945"
8+
],
9+
"details": "In Gitea before 1.21.2, an anonymous user can visit a private user's project.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68945"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/go-gitea/gitea/pull/28423"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://blog.gitea.com/release-of-1.21.2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.21.2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-359"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-26T04:15:41Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-f85h-c7m6-cfpm/GHSA-f85h-c7m6-cfpm.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f85h-c7m6-cfpm",
4+
"modified": "2025-12-26T06:30:27Z",
5+
"published": "2025-12-26T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-68944"
8+
],
9+
"details": "Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68944"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/go-gitea/gitea/pull/31967"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://blog.gitea.com/release-of-1.22.2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.22.2"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-441"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-26T04:15:41Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-hq57-c72x-4774/GHSA-hq57-c72x-4774.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hq57-c72x-4774",
4+
"modified": "2025-12-26T06:30:27Z",
5+
"published": "2025-12-26T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-68946"
8+
],
9+
"details": "In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68946"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/go-gitea/gitea/pull/25960"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://blog.gitea.com/release-of-1.20.1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.20.1"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-26T05:16:11Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-jhx5-4vr4-f327/GHSA-jhx5-4vr4-f327.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jhx5-4vr4-f327",
4+
"modified": "2025-12-26T06:30:27Z",
5+
"published": "2025-12-26T06:30:27Z",
6+
"aliases": [
7+
"CVE-2025-68943"
8+
],
9+
"details": "Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68943"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/go-gitea/gitea/pull/29430"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.21.8"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-497"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-26T04:15:41Z"
43+
}
44+
}

0 commit comments

Comments
 (0)