Skip to content

Commit 75e72ac

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3w6x-xqhx-2c63 GHSA-65c5-j3wr-v7fh GHSA-97mj-r9v7-258f GHSA-fv47-pqh6-wxgq GHSA-m9gh-789g-q5pv
1 parent befb4ae commit 75e72ac

File tree

5 files changed

+179
-0
lines changed

5 files changed

+179
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-3w6x-xqhx-2c63/GHSA-3w6x-xqhx-2c63.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3w6x-xqhx-2c63",
4+
"modified": "2025-12-15T12:30:26Z",
5+
"published": "2025-12-15T12:30:26Z",
6+
"aliases": [
7+
"CVE-2025-11670"
8+
],
9+
"details": "Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. \nThis vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11670"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2025-11670.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-200"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-15T11:15:38Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-65c5-j3wr-v7fh/GHSA-65c5-j3wr-v7fh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-65c5-j3wr-v7fh",
4+
"modified": "2025-12-15T12:30:27Z",
5+
"published": "2025-12-15T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-14714"
8+
],
9+
"details": "An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle\n\n\n\n\nBy executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges\n\n\n\n\nIn fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions\n\nThis issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14714"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.libreoffice.org/about-us/security/advisories/cve-2025-14714"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-288"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-15T11:15:39Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-97mj-r9v7-258f/GHSA-97mj-r9v7-258f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-97mj-r9v7-258f",
4+
"modified": "2025-12-15T12:30:27Z",
5+
"published": "2025-12-15T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-37732"
8+
],
9+
"details": "Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37732"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-15T11:15:39Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-fv47-pqh6-wxgq/GHSA-fv47-pqh6-wxgq.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fv47-pqh6-wxgq",
4+
"modified": "2025-12-15T12:30:27Z",
5+
"published": "2025-12-15T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-66388"
8+
],
9+
"details": "A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.\n\nUsers are recommended to upgrade to version 3.1.4, which fixes this issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66388"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/airflow/pull/58772"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-201"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2025-12-15T12:15:40Z"
34+
}
35+
}

‎advisories/unreviewed/2025/12/GHSA-m9gh-789g-q5pv/GHSA-m9gh-789g-q5pv.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m9gh-789g-q5pv",
4+
"modified": "2025-12-15T12:30:27Z",
5+
"published": "2025-12-15T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-37731"
8+
],
9+
"details": "Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-37731"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-287"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-15T11:15:39Z"
35+
}
36+
}

0 commit comments

Comments
 (0)