Skip to content

Commit 5eb2209

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-39gf-78j2-vwxh GHSA-53j9-8fm4-3gf5 GHSA-8j49-66vh-8w64 GHSA-95c9-mv7r-2wgh GHSA-g6q4-chqv-724q GHSA-hj85-g2fm-mxw9 GHSA-jq9h-gmxw-7j5w GHSA-jv3w-4h8m-v487 GHSA-qv25-9f5q-rj39 GHSA-rcm6-w3rr-fcw3 GHSA-rh9w-5362-2p58 GHSA-v854-296p-97gp GHSA-vmhc-4p3p-6gpv GHSA-x5mr-f43m-7r93 GHSA-xqhw-96qr-hjw7
1 parent 8031571 commit 5eb2209

File tree

15 files changed

+616
-0
lines changed

15 files changed

+616
-0
lines changed

‎advisories/unreviewed/2025/09/GHSA-39gf-78j2-vwxh/GHSA-39gf-78j2-vwxh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-39gf-78j2-vwxh",
4+
"modified": "2025-09-17T09:30:44Z",
5+
"published": "2025-09-17T09:30:44Z",
6+
"aliases": [
7+
"CVE-2025-0419"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. Zirve Nova allows Cross-Site Scripting (XSS).This issue affects Zirve Nova: from 235 through 20250131.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0419"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.usom.gov.tr/bildirim/tr-25-0260"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-17T09:15:30Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-53j9-8fm4-3gf5/GHSA-53j9-8fm4-3gf5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-53j9-8fm4-3gf5",
4+
"modified": "2025-09-17T09:30:45Z",
5+
"published": "2025-09-17T09:30:45Z",
6+
"aliases": [
7+
"CVE-2025-59458"
8+
],
9+
"details": "In JetBrains Junie before 252.284.66,\n251.284.66,\n243.284.66,\n252.284.61,\n251.284.61,\n243.284.61,\n252.284.50,\n252.284.54,\n251.284.54,\n251.284.50,\n243.284.54,\n243.284.50 code execution was possible due to improper command validation",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59458"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-77"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-17T09:15:32Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-8j49-66vh-8w64/GHSA-8j49-66vh-8w64.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8j49-66vh-8w64",
4+
"modified": "2025-09-17T09:30:45Z",
5+
"published": "2025-09-17T09:30:45Z",
6+
"aliases": [
7+
"CVE-2025-59456"
8+
],
9+
"details": "In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59456"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-23"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-17T09:15:31Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-95c9-mv7r-2wgh/GHSA-95c9-mv7r-2wgh.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-95c9-mv7r-2wgh",
4+
"modified": "2025-09-17T09:30:44Z",
5+
"published": "2025-09-17T09:30:44Z",
6+
"aliases": [
7+
"CVE-2025-9565"
8+
],
9+
"details": "The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksy_newsletter_subscribe shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9565"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.9/framework/extensions/newsletter-subscribe/extension.php#L191"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.9/framework/extensions/newsletter-subscribe/helpers.php#L65"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3360000/blocksy-companion/trunk/framework/extensions/newsletter-subscribe/helpers.php"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://wordpress.org/plugins/blocksy-companion"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c28e740e-9337-41b5-a8e7-ca68e41eaed4?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-09-17T07:15:43Z"
51+
}
52+
}

‎advisories/unreviewed/2025/09/GHSA-g6q4-chqv-724q/GHSA-g6q4-chqv-724q.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g6q4-chqv-724q",
4+
"modified": "2025-09-17T09:30:44Z",
5+
"published": "2025-09-17T09:30:44Z",
6+
"aliases": [
7+
"CVE-2025-9242"
8+
],
9+
"details": "An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9242"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-787"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-17T08:15:33Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-hj85-g2fm-mxw9/GHSA-hj85-g2fm-mxw9.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hj85-g2fm-mxw9",
4+
"modified": "2025-09-17T09:30:45Z",
5+
"published": "2025-09-17T09:30:45Z",
6+
"aliases": [
7+
"CVE-2025-59455"
8+
],
9+
"details": "In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59455"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-362"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-17T09:15:31Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-jq9h-gmxw-7j5w/GHSA-jq9h-gmxw-7j5w.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jq9h-gmxw-7j5w",
4+
"modified": "2025-09-17T09:30:45Z",
5+
"published": "2025-09-17T09:30:45Z",
6+
"aliases": [
7+
"CVE-2025-59457"
8+
],
9+
"details": "In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59457"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-183"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-17T09:15:32Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-jv3w-4h8m-v487/GHSA-jv3w-4h8m-v487.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jv3w-4h8m-v487",
4+
"modified": "2025-09-17T09:30:44Z",
5+
"published": "2025-09-17T09:30:44Z",
6+
"aliases": [
7+
"CVE-2025-9215"
8+
],
9+
"details": "The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the file_download() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9215"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/d0n601/CVE-2025-9215"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/storeengine/trunk/addons/csv/ajax/export.php#L47"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3360097/storeengine/trunk/addons/csv/ajax/export.php"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://ryankozak.com/posts/cve-2025-9215"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07b1dc05-1340-4ea3-9315-3e1ca4a0cb7f?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-22"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-09-17T07:15:42Z"
51+
}
52+
}

‎advisories/unreviewed/2025/09/GHSA-qv25-9f5q-rj39/GHSA-qv25-9f5q-rj39.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qv25-9f5q-rj39",
4+
"modified": "2025-09-17T09:30:44Z",
5+
"published": "2025-09-17T09:30:44Z",
6+
"aliases": [
7+
"CVE-2025-9449"
8+
],
9+
"details": "A Use After Free vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to execute arbitrary code while opening a specially crafted PAR file.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9449"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-9449"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-416"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-17T07:15:42Z"
35+
}
36+
}

0 commit comments

Comments
 (0)