Skip to content

Commit 605d0a6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-rm24-25xm-9454 GHSA-vw57-55f8-c73q GHSA-cqwv-9xh5-25fg GHSA-rm24-25xm-9454 GHSA-vw57-55f8-c73q
1 parent 7a0ba9f commit 605d0a6

File tree

5 files changed

+165
-63
lines changed

5 files changed

+165
-63
lines changed

‎advisories/github-reviewed/2022/05/GHSA-rm24-25xm-9454/GHSA-rm24-25xm-9454.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rm24-25xm-9454",
4+
"modified": "2025-10-22T21:58:04Z",
5+
"published": "2022-05-24T17:21:02Z",
6+
"aliases": [
7+
"CVE-2016-11083"
8+
],
9+
"summary": "Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution",
10+
"details": "An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.2.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-11083"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/mattermost/mattermost/commit/480308b7029a04cf41d0e9e7cd68b52dc2138e98"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/mattermost/mattermost"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://mattermost.com/security-updates"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-79"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-10-22T21:58:04Z",
63+
"nvd_published_at": "2020-06-19T20:15:00Z"
64+
}
65+
}

‎advisories/github-reviewed/2022/05/GHSA-vw57-55f8-c73q/GHSA-vw57-55f8-c73q.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vw57-55f8-c73q",
4+
"modified": "2025-10-22T21:58:57Z",
5+
"published": "2022-05-24T17:21:02Z",
6+
"aliases": [
7+
"CVE-2016-11084"
8+
],
9+
"summary": "Mattermost Server allows XSS via CSRF",
10+
"details": "An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.1.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-11084"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/mattermost/mattermost"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://mattermost.com/security-updates"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-352",
55+
"CWE-79"
56+
],
57+
"severity": "MODERATE",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2025-10-22T21:58:57Z",
60+
"nvd_published_at": "2020-06-19T20:15:00Z"
61+
}
62+
}

advisories/unreviewed/2025/10/GHSA-cqwv-9xh5-25fg/GHSA-cqwv-9xh5-25fg.json renamed to advisories/github-reviewed/2025/10/GHSA-cqwv-9xh5-25fg/GHSA-cqwv-9xh5-25fg.json

Lines changed: 38 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,57 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cqwv-9xh5-25fg",
4-
"modified": "2025-10-22T21:31:34Z",
4+
"modified": "2025-10-22T21:59:42Z",
55
"published": "2025-10-22T21:31:34Z",
66
"aliases": [
77
"CVE-2025-62247"
88
],
9+
"summary": "Liferay Portal and DXP are Missing Authorization in Collection Provider",
910
"details": "Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.liferay:com.liferay.search.experiences.service"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "3.0.84"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62247"
2142
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/liferay/liferay-portal/commit/019d703943ef58fb7bd3f30fe680c02c2756f86b"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/liferay/liferay-portal"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://liferay.atlassian.net/browse/LPE-18297"
54+
},
2255
{
2356
"type": "WEB",
2457
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62247"
@@ -29,8 +62,8 @@
2962
"CWE-862"
3063
],
3164
"severity": "LOW",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-10-22T21:59:41Z",
3467
"nvd_published_at": "2025-10-22T20:15:37Z"
3568
}
3669
}

‎advisories/unreviewed/2022/05/GHSA-rm24-25xm-9454/GHSA-rm24-25xm-9454.json‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎advisories/unreviewed/2022/05/GHSA-vw57-55f8-c73q/GHSA-vw57-55f8-c73q.json‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

0 commit comments

Comments
 (0)