Skip to content

Commit 82f3abe

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent e2ab284 commit 82f3abe

File tree

30 files changed

+826
-12
lines changed

30 files changed

+826
-12
lines changed

‎advisories/unreviewed/2025/04/GHSA-fqm9-qqwf-gq9r/GHSA-fqm9-qqwf-gq9r.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fqm9-qqwf-gq9r",
4-
"modified": "2025-05-15T12:30:26Z",
4+
"modified": "2025-10-21T18:30:29Z",
55
"published": "2025-04-23T21:30:36Z",
66
"aliases": [
77
"CVE-2025-46397"

‎advisories/unreviewed/2025/10/GHSA-2928-r2w9-gm4x/GHSA-2928-r2w9-gm4x.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2928-r2w9-gm4x",
4+
"modified": "2025-10-21T18:30:35Z",
5+
"published": "2025-10-21T18:30:35Z",
6+
"aliases": [
7+
"CVE-2025-62763"
8+
],
9+
"details": "Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62763"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://blog.zimbra.com/2025/10/patch-release-update-zimbra-10-1-12"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://wiki.zimbra.com/wiki/Security_Center"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.12"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-918"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-21T17:15:41Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-2rvw-jrp7-x2vg/GHSA-2rvw-jrp7-x2vg.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2rvw-jrp7-x2vg",
4+
"modified": "2025-10-21T18:30:35Z",
5+
"published": "2025-10-21T18:30:35Z",
6+
"aliases": [
7+
"CVE-2025-60427"
8+
],
9+
"details": "LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of station-wide metrics. This results in information disclosure to less privileged users.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60427"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/libretime/libretime/issues/1251"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://beafn28.gitbook.io/beafn28/cve/broken-access-control-in-libretime-analytics-endpoints-cve-2025-60427"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/libretime/libretime"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2025-10-21T18:15:36Z"
36+
}
37+
}

‎advisories/unreviewed/2025/10/GHSA-3jx5-x6hv-w267/GHSA-3jx5-x6hv-w267.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3jx5-x6hv-w267",
4-
"modified": "2025-10-13T09:30:24Z",
4+
"modified": "2025-10-21T18:30:31Z",
55
"published": "2025-10-13T09:30:24Z",
66
"aliases": [
77
"CVE-2025-27259"
88
],
99
"details": "Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sites or domains.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/10/GHSA-464p-mh7x-6549/GHSA-464p-mh7x-6549.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-464p-mh7x-6549",
4+
"modified": "2025-10-21T18:30:35Z",
5+
"published": "2025-10-21T18:30:35Z",
6+
"aliases": [
7+
"CVE-2025-11757"
8+
],
9+
"details": "The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should be delivered to other users by subscribing to the a MQTT topic. In these messages, the attacker can obtain the credentials and key information to connect to the cameras from peer to peer.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11757"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-294-05"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-155"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-21T18:15:35Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-6j5c-gc78-pqgr/GHSA-6j5c-gc78-pqgr.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@
3434
],
3535
"database_specific": {
3636
"cwe_ids": [
37-
"CWE-305"
37+
"CWE-305",
38+
"CWE-307"
3839
],
3940
"severity": "MODERATE",
4041
"github_reviewed": false,

‎advisories/unreviewed/2025/10/GHSA-6p74-jjw6-9j89/GHSA-6p74-jjw6-9j89.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6p74-jjw6-9j89",
4+
"modified": "2025-10-21T18:30:35Z",
5+
"published": "2025-10-21T18:30:35Z",
6+
"aliases": [
7+
"CVE-2025-60772"
8+
],
9+
"details": "Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges and lock out the legitimate administrator via crafted HTTP requests.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60772"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/navy-birds-MRS/vuln-reports/blob/main/vendors/netlink/CVE-2025-60772/advisory.md"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://netlinkict.com/shop/gpon-ont/gpon-ont-hg322g"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-10-21T17:15:40Z"
32+
}
33+
}

‎advisories/unreviewed/2025/10/GHSA-6pgj-w687-9c8c/GHSA-6pgj-w687-9c8c.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6pgj-w687-9c8c",
4+
"modified": "2025-10-21T18:30:35Z",
5+
"published": "2025-10-21T18:30:35Z",
6+
"aliases": [
7+
"CVE-2025-62250"
8+
],
9+
"details": "Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions that will treat it as trusted data via unauthenticated cluster messages.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62250"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62250"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-346"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-21T16:15:38Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-7f63-wvmx-66p2/GHSA-7f63-wvmx-66p2.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7f63-wvmx-66p2",
4+
"modified": "2025-10-21T18:30:35Z",
5+
"published": "2025-10-21T18:30:35Z",
6+
"aliases": [
7+
"CVE-2025-60507"
8+
],
9+
"details": "Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60507"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/onurcangnc/moodle_genai_plugin_xss"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://moodle.org/plugins/local_geniai"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://moodle.org/security"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://onurcangenc.com.tr/posts/moodle-genia%C4%B1-plugin-vulnerability-stored-reflected-xss-via-pdf-upload-and-chatbot-%C4%B1nput"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [],
41+
"severity": "HIGH",
42+
"github_reviewed": false,
43+
"github_reviewed_at": null,
44+
"nvd_published_at": "2025-10-21T18:15:36Z"
45+
}
46+
}

‎advisories/unreviewed/2025/10/GHSA-7vgg-mch2-66mr/GHSA-7vgg-mch2-66mr.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7vgg-mch2-66mr",
4-
"modified": "2025-10-14T18:30:34Z",
4+
"modified": "2025-10-21T18:30:31Z",
55
"published": "2025-10-14T18:30:34Z",
66
"aliases": [
77
"CVE-2025-59214"
@@ -19,6 +19,14 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59214"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cymulate.com/blog/ntlm-leak-cve-2025-59214"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/rubenformation/CVE-2025-50154"
29+
},
2230
{
2331
"type": "WEB",
2432
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59214"

0 commit comments

Comments
 (0)