Skip to content

Commit 7b456c8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3cm9-jrf5-h2cx GHSA-45cw-92h9-h4hh GHSA-4vv9-j5h4-6c9w GHSA-6h5q-3xr5-cw4h GHSA-c8m2-cx6j-jf7p GHSA-fhcw-px4q-pmvv GHSA-gc69-q37f-fv6m GHSA-mj68-2xr5-28xh GHSA-pfwq-mr9g-gq6m GHSA-rc85-v737-94m9 GHSA-rqqv-ff68-qw2w GHSA-x86m-hvgq-rp2x
1 parent e4e477f commit 7b456c8

File tree

12 files changed

+501
-0
lines changed

12 files changed

+501
-0
lines changed

‎advisories/unreviewed/2025/10/GHSA-3cm9-jrf5-h2cx/GHSA-3cm9-jrf5-h2cx.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3cm9-jrf5-h2cx",
4+
"modified": "2025-10-13T21:31:10Z",
5+
"published": "2025-10-13T21:31:10Z",
6+
"aliases": [
7+
"CVE-2025-62242"
8+
],
9+
"details": "Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62242"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62245"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-639"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-13T20:15:34Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-45cw-92h9-h4hh/GHSA-45cw-92h9-h4hh.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45cw-92h9-h4hh",
4+
"modified": "2025-10-13T21:31:10Z",
5+
"published": "2025-10-13T21:31:10Z",
6+
"aliases": [
7+
"CVE-2025-9723"
8+
],
9+
"details": "A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_regime_cad.php. Performing manipulation of the argument nm_tipo results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9723"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://karinagante.github.io/cve-2025-9723"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://karinagante.github.io/cve-2025-9723/#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.322012"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.322012"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.638698"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-08-31T09:15:33Z"
55+
}
56+
}

‎advisories/unreviewed/2025/10/GHSA-4vv9-j5h4-6c9w/GHSA-4vv9-j5h4-6c9w.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4vv9-j5h4-6c9w",
4+
"modified": "2025-10-13T21:31:10Z",
5+
"published": "2025-10-13T21:31:10Z",
6+
"aliases": [
7+
"CVE-2025-9713"
8+
],
9+
"details": "Path traversal in Ivanti Endpoint Manager allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9713"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-22"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-13T21:15:35Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-6h5q-3xr5-cw4h/GHSA-6h5q-3xr5-cw4h.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6h5q-3xr5-cw4h",
4+
"modified": "2025-10-13T21:31:10Z",
5+
"published": "2025-10-13T21:31:10Z",
6+
"aliases": [
7+
"CVE-2025-9721"
8+
],
9+
"details": "A flaw has been found in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/FormulaMedia/edit. This manipulation of the argument nome/formulaMedia causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9721"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://karinagante.github.io/cve-2025-9721"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://karinagante.github.io/cve-2025-9721/#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.322010"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.322010"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.638672"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-08-31T08:15:35Z"
55+
}
56+
}

‎advisories/unreviewed/2025/10/GHSA-c8m2-cx6j-jf7p/GHSA-c8m2-cx6j-jf7p.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c8m2-cx6j-jf7p",
4+
"modified": "2025-10-13T21:31:10Z",
5+
"published": "2025-10-13T21:31:10Z",
6+
"aliases": [
7+
"CVE-2025-58084"
8+
],
9+
"details": "Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58084"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://mattermost.com/security-updates"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1287"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-13T20:15:33Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-fhcw-px4q-pmvv/GHSA-fhcw-px4q-pmvv.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fhcw-px4q-pmvv",
4+
"modified": "2025-10-13T21:31:10Z",
5+
"published": "2025-10-13T21:31:10Z",
6+
"aliases": [
7+
"CVE-2025-62241"
8+
],
9+
"details": "Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62241"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62241"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-639"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-13T20:15:34Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-gc69-q37f-fv6m/GHSA-gc69-q37f-fv6m.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gc69-q37f-fv6m",
4+
"modified": "2025-10-13T21:31:10Z",
5+
"published": "2025-10-13T21:31:10Z",
6+
"aliases": [
7+
"CVE-2025-9720"
8+
],
9+
"details": "A vulnerability was detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/TabelaArredondamento/edit of the component Cadastrar tabela de arredondamento Page. The manipulation of the argument Nome results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9720"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://karinagante.github.io/cve-2025-9720"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://karinagante.github.io/cve-2025-9720/#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.322009"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.322009"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.638671"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-79"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-08-31T07:15:32Z"
55+
}
56+
}

‎advisories/unreviewed/2025/10/GHSA-mj68-2xr5-28xh/GHSA-mj68-2xr5-28xh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mj68-2xr5-28xh",
4+
"modified": "2025-10-13T21:31:10Z",
5+
"published": "2025-10-13T21:31:10Z",
6+
"aliases": [
7+
"CVE-2025-62246"
8+
],
9+
"details": "Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a user’s first, middle or last name text field to (1) page comments widget, (2) blog entry comments, (3) document and media document comments, (4) message board messages, (5) wiki page comments or (6) other widgets/apps that supports mentions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62246"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62246"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-13T21:15:35Z"
35+
}
36+
}

0 commit comments

Comments
 (0)