Skip to content

Commit 5a9d0de

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-8wf8-frjg-xv74 GHSA-93vm-mqpw-8wh3 GHSA-vqc7-7fj4-3fm3 GHSA-xj9j-gjxg-7jvq
1 parent 7d6cf8c commit 5a9d0de

File tree

4 files changed

+125
-25
lines changed

4 files changed

+125
-25
lines changed

advisories/unreviewed/2025/11/GHSA-8wf8-frjg-xv74/GHSA-8wf8-frjg-xv74.json renamed to advisories/github-reviewed/2025/11/GHSA-8wf8-frjg-xv74/GHSA-8wf8-frjg-xv74.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8wf8-frjg-xv74",
4-
"modified": "2025-11-17T06:30:15Z",
4+
"modified": "2025-11-26T22:02:07Z",
55
"published": "2025-11-17T06:30:15Z",
66
"aliases": [
77
"CVE-2025-13265"
88
],
9+
"summary": "lsFusion Server is vulnerable to Path Traversal through its unpackFile function",
910
"details": "A weakness has been identified in lsfusion platform up to 6.1. This vulnerability affects the function unpackFile of the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. This manipulation causes path traversal. It is possible to initiate the attack remotely.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "Maven",
25+
"name": "lsfusion.platform:server"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"last_affected": "6.0-beta2"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -27,6 +48,10 @@
2748
"type": "WEB",
2849
"url": "https://github.com/lsfusion/platform/issues/1545"
2950
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/lsfusion/platformx"
54+
},
3055
{
3156
"type": "WEB",
3257
"url": "https://vuldb.com/?ctiid.332600"
@@ -45,8 +70,8 @@
4570
"CWE-22"
4671
],
4772
"severity": "MODERATE",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2025-11-26T22:02:07Z",
5075
"nvd_published_at": "2025-11-17T06:15:43Z"
5176
}
5277
}

advisories/unreviewed/2025/11/GHSA-93vm-mqpw-8wh3/GHSA-93vm-mqpw-8wh3.json renamed to advisories/github-reviewed/2025/11/GHSA-93vm-mqpw-8wh3/GHSA-93vm-mqpw-8wh3.json

Lines changed: 35 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,81 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-93vm-mqpw-8wh3",
4-
"modified": "2025-11-26T00:30:25Z",
4+
"modified": "2025-11-26T22:01:36Z",
55
"published": "2025-11-25T18:32:22Z",
66
"aliases": [
77
"CVE-2025-13467"
88
],
9+
"summary": "Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization",
910
"details": "A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.keycloak:keycloak-ldap-federation"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "26.4.6"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13467"
2142
},
2243
{
2344
"type": "WEB",
24-
"url": "https://access.redhat.com/errata/RHSA-2025:22088"
45+
"url": "https://github.com/keycloak/keycloak/issues/44478"
2546
},
2647
{
2748
"type": "WEB",
28-
"url": "https://access.redhat.com/errata/RHSA-2025:22089"
49+
"url": "https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328"
2950
},
3051
{
3152
"type": "WEB",
32-
"url": "https://access.redhat.com/errata/RHSA-2025:22090"
53+
"url": "https://access.redhat.com/errata/RHSA-2025:22088"
3354
},
3455
{
3556
"type": "WEB",
36-
"url": "https://access.redhat.com/errata/RHSA-2025:22091"
57+
"url": "https://access.redhat.com/security/cve/CVE-2025-13467"
3758
},
3859
{
3960
"type": "WEB",
40-
"url": "https://access.redhat.com/security/cve/CVE-2025-13467"
61+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416038"
62+
},
63+
{
64+
"type": "PACKAGE",
65+
"url": "https://github.com/keycloak/keycloak"
4166
},
4267
{
4368
"type": "WEB",
44-
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416038"
69+
"url": "https://github.com/keycloak/keycloak/releases/tag/26.4.6"
4570
}
4671
],
4772
"database_specific": {
4873
"cwe_ids": [
4974
"CWE-502"
5075
],
5176
"severity": "MODERATE",
52-
"github_reviewed": false,
53-
"github_reviewed_at": null,
77+
"github_reviewed": true,
78+
"github_reviewed_at": "2025-11-26T22:01:36Z",
5479
"nvd_published_at": "2025-11-25T16:16:06Z"
5580
}
5681
}

advisories/unreviewed/2025/11/GHSA-vqc7-7fj4-3fm3/GHSA-vqc7-7fj4-3fm3.json renamed to advisories/github-reviewed/2025/11/GHSA-vqc7-7fj4-3fm3/GHSA-vqc7-7fj4-3fm3.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,55 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vqc7-7fj4-3fm3",
4-
"modified": "2025-11-25T18:32:22Z",
4+
"modified": "2025-11-26T22:00:50Z",
55
"published": "2025-11-25T18:32:22Z",
66
"aliases": [
77
"CVE-2025-64049"
88
],
9+
"summary": "REDAXO CMS is vulnerable to XSS through its module management component",
910
"details": "A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "redaxo/source"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "5.20.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64049"
2142
},
2243
{
2344
"type": "WEB",
24-
"url": "https://drive.google.com/drive/folders/1SpwL548ZBRYU_uL8W7Riv7VHshr2UN0R?usp=sharing"
45+
"url": "https://github.com/redaxo/redaxo/commit/58929062312cf03e344ab04067a365e6b6ee66aa"
2546
},
2647
{
2748
"type": "WEB",
49+
"url": "https://drive.google.com/drive/folders/1SpwL548ZBRYU_uL8W7Riv7VHshr2UN0R?usp=sharing"
50+
},
51+
{
52+
"type": "PACKAGE",
2853
"url": "https://github.com/redaxo/redaxo"
2954
},
3055
{
@@ -37,8 +62,8 @@
3762
"CWE-79"
3863
],
3964
"severity": "MODERATE",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-11-26T22:00:50Z",
4267
"nvd_published_at": "2025-11-25T16:16:07Z"
4368
}
4469
}

advisories/unreviewed/2025/11/GHSA-xj9j-gjxg-7jvq/GHSA-xj9j-gjxg-7jvq.json renamed to advisories/github-reviewed/2025/11/GHSA-xj9j-gjxg-7jvq/GHSA-xj9j-gjxg-7jvq.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,55 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xj9j-gjxg-7jvq",
4-
"modified": "2025-11-25T18:32:22Z",
4+
"modified": "2025-11-26T22:00:29Z",
55
"published": "2025-11-25T18:32:22Z",
66
"aliases": [
77
"CVE-2025-64050"
88
],
9+
"summary": "REDAXO CMS is vulnerable to RCE attack through its template management component",
910
"details": "A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "redaxo/source"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "5.20.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64050"
2142
},
2243
{
2344
"type": "WEB",
24-
"url": "https://drive.google.com/drive/folders/1Via4r4wn5zCcBllWmHpxYweCPgcbN0bz?usp=sharing"
45+
"url": "https://github.com/redaxo/redaxo/pull/6372/commits/bc96462e20f7e651b2e6c3bb59d141d5cb09af0f"
2546
},
2647
{
2748
"type": "WEB",
49+
"url": "https://drive.google.com/drive/folders/1Via4r4wn5zCcBllWmHpxYweCPgcbN0bz?usp=sharing"
50+
},
51+
{
52+
"type": "PACKAGE",
2853
"url": "https://github.com/redaxo/redaxo"
2954
},
3055
{
@@ -37,8 +62,8 @@
3762
"CWE-94"
3863
],
3964
"severity": "HIGH",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-11-26T22:00:29Z",
4267
"nvd_published_at": "2025-11-25T16:16:07Z"
4368
}
4469
}

0 commit comments

Comments
 (0)