Skip to content

Commit 70d5a34

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-hgg2-q547-3gr3 GHSA-2348-qg6m-wv4j GHSA-2gxm-4cm6-2hf9 GHSA-9q9m-rgvw-p592 GHSA-c6hq-r2mm-58p4 GHSA-f3w6-r2g2-vx25 GHSA-gxfm-293q-5f27 GHSA-j2g7-5phj-jr4v GHSA-q6h9-jc46-5c2p GHSA-r975-qjvp-q43h GHSA-v8cp-m2g2-whfj
1 parent b91cb2e commit 70d5a34

File tree

11 files changed

+410
-13
lines changed

11 files changed

+410
-13
lines changed

‎advisories/unreviewed/2025/11/GHSA-hgg2-q547-3gr3/GHSA-hgg2-q547-3gr3.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hgg2-q547-3gr3",
4-
"modified": "2025-11-13T12:31:42Z",
4+
"modified": "2025-12-15T03:30:17Z",
55
"published": "2025-11-13T12:31:42Z",
66
"aliases": [
77
"CVE-2025-12377"

‎advisories/unreviewed/2025/12/GHSA-2348-qg6m-wv4j/GHSA-2348-qg6m-wv4j.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2348-qg6m-wv4j",
4+
"modified": "2025-12-15T03:30:18Z",
5+
"published": "2025-12-15T03:30:18Z",
6+
"aliases": [
7+
"CVE-2025-14699"
8+
],
9+
"details": "A security vulnerability has been detected in Municorn FAX App 3.27.0 on Android. This vulnerability affects unknown code of the component biz.faxapp.app. Such manipulation leads to path traversal. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14699"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Secsys-FDU/AF_CVEs/issues/3"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.336417"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.336417"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.706215"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-22"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-15T03:15:45Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-2gxm-4cm6-2hf9/GHSA-2gxm-4cm6-2hf9.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2gxm-4cm6-2hf9",
4+
"modified": "2025-12-15T03:30:17Z",
5+
"published": "2025-12-15T03:30:17Z",
6+
"aliases": [
7+
"CVE-2025-14694"
8+
],
9+
"details": "A vulnerability was found in ketr JEPaaS up to 7.2.8. This impacts the function readAllPostil of the file /je/postil/postil/readAllPostil. Performing manipulation of the argument keyWord results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14694"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/c3p0ooo-Yiqiyin/JEPaaS-readAllPostil-SQL-Injection-Vulnerability/blob/main/README.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.336412"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.336412"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.707178"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-15T01:15:38Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-9q9m-rgvw-p592/GHSA-9q9m-rgvw-p592.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9q9m-rgvw-p592",
4-
"modified": "2025-12-12T21:31:39Z",
4+
"modified": "2025-12-15T03:30:17Z",
55
"published": "2025-12-12T21:31:39Z",
66
"aliases": [
77
"CVE-2025-43532"
88
],
99
"details": "A memory corruption issue was addressed with improved bounds checking. This issue is fixed in macOS Sonoma 14.8.3, macOS Sequoia 15.7.3. Processing malicious data may lead to unexpected app termination.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-120"
34+
],
35+
"severity": "LOW",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-12-12T21:15:57Z"

‎advisories/unreviewed/2025/12/GHSA-c6hq-r2mm-58p4/GHSA-c6hq-r2mm-58p4.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-c6hq-r2mm-58p4",
4-
"modified": "2025-12-12T21:31:39Z",
4+
"modified": "2025-12-15T03:30:17Z",
55
"published": "2025-12-12T21:31:39Z",
66
"aliases": [
77
"CVE-2025-43482"
88
],
99
"details": "The issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.8.3, macOS Sequoia 15.7.3. An app may be able to cause a denial-of-service.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-20"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-12-12T21:15:55Z"

‎advisories/unreviewed/2025/12/GHSA-f3w6-r2g2-vx25/GHSA-f3w6-r2g2-vx25.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f3w6-r2g2-vx25",
4+
"modified": "2025-12-15T03:30:18Z",
5+
"published": "2025-12-15T03:30:18Z",
6+
"aliases": [
7+
"CVE-2025-14696"
8+
],
9+
"details": "A vulnerability was identified in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this vulnerability is an unknown functionality of the file /api/GylOperator/UpdatePasswordBatch. The manipulation leads to weak password recovery. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14696"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/zhangbuneng/Sissyun-Shanghui-7-Unauthorized-password-modificationfication-vulnerability./issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/zhangbuneng/Sissyun-Shanghui-7-Unauthorized-password-modificationfication-vulnerability./issues/1#issue-3688839620"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.336414"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.336414"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.705601"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-640"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-15T02:15:36Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-gxfm-293q-5f27/GHSA-gxfm-293q-5f27.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gxfm-293q-5f27",
4+
"modified": "2025-12-15T03:30:17Z",
5+
"published": "2025-12-15T03:30:17Z",
6+
"aliases": [
7+
"CVE-2025-14693"
8+
],
9+
"details": "A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Handler. Such manipulation leads to symlink following. The attack can be executed directly on the physical device. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14693"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.336411"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.336411"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.704646"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.704657"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.notion.so/2bc6cf4e528a8083bf3fc6f7a953f0a1"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-59"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-12-15T01:15:37Z"
55+
}
56+
}

‎advisories/unreviewed/2025/12/GHSA-j2g7-5phj-jr4v/GHSA-j2g7-5phj-jr4v.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j2g7-5phj-jr4v",
4+
"modified": "2025-12-15T03:30:18Z",
5+
"published": "2025-12-15T03:30:18Z",
6+
"aliases": [
7+
"CVE-2025-14698"
8+
],
9+
"details": "A weakness has been identified in atlaszz AI Photo Team Galleryit App 1.3.8.2 on Android. This affects an unknown part of the component gallery.photogallery.pictures.vault.album. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14698"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Secsys-FDU/AF_CVEs/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.336416"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.336416"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.706213"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-22"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-15T03:15:44Z"
51+
}
52+
}

0 commit comments

Comments
 (0)