Skip to content

Commit 90d919b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent f46df0f commit 90d919b

File tree

27 files changed

+517
-17
lines changed

27 files changed

+517
-17
lines changed

‎advisories/unreviewed/2022/05/GHSA-8966-pp95-9j6j/GHSA-8966-pp95-9j6j.json‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,28 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8966-pp95-9j6j",
4-
"modified": "2022-05-24T17:29:01Z",
4+
"modified": "2025-12-23T15:30:25Z",
55
"published": "2022-05-24T17:29:01Z",
66
"aliases": [
77
"CVE-2020-25787"
88
],
99
"details": "An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
1419
"type": "ADVISORY",
1520
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25787"
1621
},
22+
{
23+
"type": "WEB",
24+
"url": "https://blog.neagaru.com/p/exploiting-tiny-tiny-rss-2020"
25+
},
1726
{
1827
"type": "WEB",
1928
"url": "https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799"

‎advisories/unreviewed/2024/11/GHSA-wfh7-4g7r-cxxq/GHSA-wfh7-4g7r-cxxq.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wfh7-4g7r-cxxq",
4-
"modified": "2025-11-03T21:31:36Z",
4+
"modified": "2025-12-23T15:30:25Z",
55
"published": "2024-11-14T21:32:03Z",
66
"aliases": [
77
"CVE-2024-10397"
@@ -30,6 +30,10 @@
3030
{
3131
"type": "WEB",
3232
"url": "https://openafs.org/pages/security/OPENAFS-SA-2024-003.txt"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.openafs.org/pages/security/OPENAFS-SA-2024-003.txt"
3337
}
3438
],
3539
"database_specific": {

‎advisories/unreviewed/2025/12/GHSA-2689-g4r3-gxrx/GHSA-2689-g4r3-gxrx.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2689-g4r3-gxrx",
4-
"modified": "2025-12-23T12:30:18Z",
4+
"modified": "2025-12-23T15:30:39Z",
55
"published": "2025-12-23T12:30:18Z",
66
"aliases": [
77
"CVE-2023-52210"
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-287"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/12/GHSA-2f36-x8xr-4642/GHSA-2f36-x8xr-4642.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2f36-x8xr-4642",
4+
"modified": "2025-12-23T15:30:40Z",
5+
"published": "2025-12-23T15:30:40Z",
6+
"aliases": [
7+
"CVE-2025-68342"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data\n\nThe URB received in gs_usb_receive_bulk_callback() contains a struct\ngs_host_frame. The length of the data after the header depends on the\ngs_host_frame hf::flags and the active device features (e.g. time\nstamping).\n\nIntroduce a new function gs_usb_get_minimum_length() and check that we have\nat least received the required amount of data before accessing it. Only\ncopy the data to that skb that has actually been received.\n\n[mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68342"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/395d988f93861101ec89d0dd9e3b876ae9392a5b"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/4ffac725154cf6a253f5e6aa0c8946232b6a0af5"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/ad55004a3cb5b41ef78aa6c09e7bc5a489ba652b"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/fb0c7c77a7ae3a2c3404b7d0173b8739a754b513"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2025-12-23T14:16:40Z"
40+
}
41+
}

‎advisories/unreviewed/2025/12/GHSA-47rc-xxqp-2645/GHSA-47rc-xxqp-2645.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-47rc-xxqp-2645",
4-
"modified": "2025-12-10T18:30:25Z",
4+
"modified": "2025-12-23T15:30:29Z",
55
"published": "2025-12-10T18:30:25Z",
66
"aliases": [
77
"CVE-2025-34419"
88
],
99
"details": "MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAISM.DLL from its installation directory without sufficient integrity validation or a secure search order. A local attacker with write access to that directory can plant a malicious MEAISM.DLL, which is then loaded when the executable starts, resulting in execution of attacker-controlled code with the privileges of the process.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/12/GHSA-4mf7-7hx2-42fv/GHSA-4mf7-7hx2-42fv.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4mf7-7hx2-42fv",
4+
"modified": "2025-12-23T15:30:40Z",
5+
"published": "2025-12-23T15:30:40Z",
6+
"aliases": [
7+
"CVE-2025-68338"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: microchip: Don't free uninitialized ksz_irq\n\nIf something goes wrong at setup, ksz_irq_free() can be called on\nuninitialized ksz_irq (for example when ksz_ptp_irq_setup() fails). It\nleads to freeing uninitialized IRQ numbers and/or domains.\n\nUse dsa_switch_for_each_user_port_continue_reverse() in the error path\nto iterate only over the fully initialized ports.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68338"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/25b62cc5b22c45face094ae3e8717258e46d1d19"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/32abbcf4379a0f851d7eb9d4389e7bf5c64bf6c0"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/9428654c827fa8d38b898135d26d39ee2d544246"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2025-12-23T14:16:40Z"
36+
}
37+
}

‎advisories/unreviewed/2025/12/GHSA-4p2q-qc9w-jq74/GHSA-4p2q-qc9w-jq74.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4p2q-qc9w-jq74",
4+
"modified": "2025-12-23T15:30:40Z",
5+
"published": "2025-12-23T15:30:40Z",
6+
"aliases": [
7+
"CVE-2025-66845"
8+
],
9+
"details": "A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0. The user_name endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66845"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gist.github.com/MuratSevri/d78efed86ca5f82e8a6683ace5061319"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-23T14:16:40Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-5623-7pmr-m98j/GHSA-5623-7pmr-m98j.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5623-7pmr-m98j",
4+
"modified": "2025-12-23T15:30:39Z",
5+
"published": "2025-12-23T15:30:39Z",
6+
"aliases": [
7+
"CVE-2023-5092"
8+
],
9+
"details": "Rejected reason: This CVE id was assigned to an issue which was later deemed not security relevant.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5092"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-12-23T14:16:39Z"
24+
}
25+
}

‎advisories/unreviewed/2025/12/GHSA-57g8-267x-ffc8/GHSA-57g8-267x-ffc8.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-57g8-267x-ffc8",
4-
"modified": "2025-12-10T18:30:25Z",
4+
"modified": "2025-12-23T15:30:29Z",
55
"published": "2025-12-10T18:30:25Z",
66
"aliases": [
77
"CVE-2025-34394"
88
],
99
"details": "Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected against deserialization of arbitrary types. This can lead to remote code execution.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/12/GHSA-68w5-72rc-pgrc/GHSA-68w5-72rc-pgrc.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-68w5-72rc-pgrc",
4+
"modified": "2025-12-23T15:30:40Z",
5+
"published": "2025-12-23T15:30:40Z",
6+
"aliases": [
7+
"CVE-2025-68341"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: reduce XDP no_direct return section to fix race\n\nAs explain in commit fa349e396e48 (\"veth: Fix race with AF_XDP exposing\nold or uninitialized descriptors\") for veth there is a chance after\nnapi_complete_done() that another CPU can manage start another NAPI\ninstance running veth_pool(). For NAPI this is correctly handled as the\nnapi_schedule_prep() check will prevent multiple instances from getting\nscheduled, but for the remaining code in veth_pool() this can run\nconcurrent with the newly started NAPI instance.\n\nThe problem/race is that xdp_clear_return_frame_no_direct() isn't\ndesigned to be nested.\n\nPrior to commit 401cb7dae813 (\"net: Reference bpf_redirect_info via\ntask_struct on PREEMPT_RT.\") the temporary BPF net context\nbpf_redirect_info was stored per CPU, where this wasn't an issue. Since\nthis commit the BPF context is stored in 'current' task_struct. When\nrunning veth in threaded-NAPI mode, then the kthread becomes the storage\narea. Now a race exists between two concurrent veth_pool() function calls\none exiting NAPI and one running new NAPI, both using the same BPF net\ncontext.\n\nRace is when another CPU gets within the xdp_set_return_frame_no_direct()\nsection before exiting veth_pool() calls the clear-function\nxdp_clear_return_frame_no_direct().",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68341"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/a14602fcae17a3f1cb8a8521bedf31728f9e7e39"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/c1ceabcb347d1b0f7e70a7384ec7eff3847b7628"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/d0bd018ad72a8a598ae709588934135017f8af52"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2025-12-23T14:16:40Z"
36+
}
37+
}

0 commit comments

Comments
 (0)