Skip to content

Commit 6b4e26b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-64w3-5q9m-68xf GHSA-895x-rfqp-jh5c GHSA-rg35-5v25-mqvp GHSA-24hm-wm2h-h8w7 GHSA-2gg2-m8xj-hx68 GHSA-64r8-mrv6-hj88 GHSA-6p6f-w7vp-pv39 GHSA-76f9-42qx-mfmx GHSA-9c32-r6xg-x5p7 GHSA-f85c-2x25-hppv GHSA-p5wv-67hv-xm4c GHSA-wv5r-gfp7-rgxv GHSA-x832-fpvj-r5ph
1 parent 81aeb9c commit 6b4e26b

File tree

13 files changed

+415
-3
lines changed

13 files changed

+415
-3
lines changed

‎advisories/github-reviewed/2025/10/GHSA-64w3-5q9m-68xf/GHSA-64w3-5q9m-68xf.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-64w3-5q9m-68xf",
4-
"modified": "2025-10-23T19:24:48Z",
4+
"modified": "2025-11-28T06:32:05Z",
55
"published": "2025-10-23T15:30:34Z",
66
"aliases": [
77
"CVE-2025-11429"
@@ -52,6 +52,14 @@
5252
"type": "WEB",
5353
"url": "https://github.com/keycloak/keycloak/commit/bda0e2a67c8cf41d1b3d9010e6dfcddaf79bf59b"
5454
},
55+
{
56+
"type": "WEB",
57+
"url": "https://access.redhat.com/errata/RHSA-2025:22088"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://access.redhat.com/errata/RHSA-2025:22089"
62+
},
5563
{
5664
"type": "WEB",
5765
"url": "https://access.redhat.com/security/cve/CVE-2025-11429"

‎advisories/github-reviewed/2025/10/GHSA-895x-rfqp-jh5c/GHSA-895x-rfqp-jh5c.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-895x-rfqp-jh5c",
4-
"modified": "2025-11-14T00:30:27Z",
4+
"modified": "2025-11-28T06:32:05Z",
55
"published": "2025-10-23T15:30:34Z",
66
"aliases": [
77
"CVE-2025-12110"
@@ -52,6 +52,14 @@
5252
"type": "WEB",
5353
"url": "https://access.redhat.com/errata/RHSA-2025:21371"
5454
},
55+
{
56+
"type": "WEB",
57+
"url": "https://access.redhat.com/errata/RHSA-2025:22088"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://access.redhat.com/errata/RHSA-2025:22089"
62+
},
5563
{
5664
"type": "WEB",
5765
"url": "https://access.redhat.com/security/cve/CVE-2025-12110"

‎advisories/github-reviewed/2025/10/GHSA-rg35-5v25-mqvp/GHSA-rg35-5v25-mqvp.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rg35-5v25-mqvp",
4-
"modified": "2025-11-14T00:30:27Z",
4+
"modified": "2025-11-28T06:32:05Z",
55
"published": "2025-10-28T15:30:43Z",
66
"aliases": [
77
"CVE-2025-12390"
@@ -68,6 +68,14 @@
6868
"type": "WEB",
6969
"url": "https://access.redhat.com/errata/RHSA-2025:21371"
7070
},
71+
{
72+
"type": "WEB",
73+
"url": "https://access.redhat.com/errata/RHSA-2025:22088"
74+
},
75+
{
76+
"type": "WEB",
77+
"url": "https://access.redhat.com/errata/RHSA-2025:22089"
78+
},
7179
{
7280
"type": "WEB",
7381
"url": "https://access.redhat.com/security/cve/CVE-2025-12390"

‎advisories/unreviewed/2025/11/GHSA-24hm-wm2h-h8w7/GHSA-24hm-wm2h-h8w7.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-24hm-wm2h-h8w7",
4+
"modified": "2025-11-28T06:32:06Z",
5+
"published": "2025-11-28T06:32:06Z",
6+
"aliases": [
7+
"CVE-2025-66371"
8+
],
9+
"details": "Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66371"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/iterasdev/peppol-py/pull/16"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/iterasdev/peppol-py/releases/tag/1.1.1"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-611"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-28T04:16:01Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-2gg2-m8xj-hx68/GHSA-2gg2-m8xj-hx68.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2gg2-m8xj-hx68",
4+
"modified": "2025-11-28T06:32:05Z",
5+
"published": "2025-11-28T06:32:05Z",
6+
"aliases": [
7+
"CVE-2025-58302"
8+
],
9+
"details": "Permission control vulnerability in the Settings module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58302"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://consumer.huawei.com/en/support/bulletin/2025/11"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "HIGH",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-11-28T04:16:00Z"
33+
}
34+
}

‎advisories/unreviewed/2025/11/GHSA-64r8-mrv6-hj88/GHSA-64r8-mrv6-hj88.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-64r8-mrv6-hj88",
4+
"modified": "2025-11-28T06:32:06Z",
5+
"published": "2025-11-28T06:32:06Z",
6+
"aliases": [
7+
"CVE-2025-58311"
8+
],
9+
"details": "UAF vulnerability in the USB driver module.\nImpact: Successful exploitation of this vulnerability will affect availability and confidentiality.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58311"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://consumer.huawei.com/en/support/bulletin/2025/11"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-416"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-28T04:16:00Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-6p6f-w7vp-pv39/GHSA-6p6f-w7vp-pv39.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6p6f-w7vp-pv39",
4+
"modified": "2025-11-28T06:32:06Z",
5+
"published": "2025-11-28T06:32:06Z",
6+
"aliases": [
7+
"CVE-2025-66370"
8+
],
9+
"details": "Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66370"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/kivitendo/kivitendo-erp/commit/1286dee72f9919166178d0cdb5f52f13b0f7d4de"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/kivitendo/kivitendo-erp/commit/f6ba56bd8d22a428534057589baace6b7bfdf2e9"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://blog.kivitendo.de/?p=1415"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/kivitendo/kivitendo-erp/blob/fd3f993fc731cbcaa5eb87d55df7c82df4df9c09/doc/changelog"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-611"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-11-28T04:16:01Z"
47+
}
48+
}

‎advisories/unreviewed/2025/11/GHSA-76f9-42qx-mfmx/GHSA-76f9-42qx-mfmx.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-76f9-42qx-mfmx",
4+
"modified": "2025-11-28T06:32:06Z",
5+
"published": "2025-11-28T06:32:06Z",
6+
"aliases": [
7+
"CVE-2025-58308"
8+
],
9+
"details": "Vulnerability of improper criterion security check in the call module.\nImpact: Successful exploitation of this vulnerability may cause features to perform abnormally.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58308"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://consumer.huawei.com/en/support/bulletin/2025/11"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-358"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-28T04:16:00Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-9c32-r6xg-x5p7/GHSA-9c32-r6xg-x5p7.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9c32-r6xg-x5p7",
4+
"modified": "2025-11-28T06:32:06Z",
5+
"published": "2025-11-28T06:32:06Z",
6+
"aliases": [
7+
"CVE-2025-58305"
8+
],
9+
"details": "Identity authentication bypass vulnerability in the Gallery app.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58305"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://consumer.huawei.com/en/support/bulletin/2025/11"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-200"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-28T04:16:00Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-f85c-2x25-hppv/GHSA-f85c-2x25-hppv.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f85c-2x25-hppv",
4+
"modified": "2025-11-28T06:32:05Z",
5+
"published": "2025-11-28T06:32:05Z",
6+
"aliases": [
7+
"CVE-2025-13737"
8+
],
9+
"details": "The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for unauthenticated attackers to unlink the user's social login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13737"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/nextend-facebook-connect/tags/3.1.21/includes/provider.php#L772"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3404174/nextend-facebook-connect/trunk/includes/provider.php"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6b747e-d267-4fd3-a4fd-022aa657c796?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-352"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-28T04:16:00Z"
43+
}
44+
}

0 commit comments

Comments
 (0)