Skip to content

Commit 96aac33

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-64r9-7879-fmg9 GHSA-6wwx-2f48-jxh8 GHSA-7565-8whx-jmg5 GHSA-q6mw-555r-hgcg GHSA-q7r9-4c9w-4548 GHSA-v52q-48v6-rmj4 GHSA-vrvm-qc4x-35pw GHSA-x6wm-h4q7-p8hv
1 parent ff06e8e commit 96aac33

File tree

8 files changed

+335
-1
lines changed

8 files changed

+335
-1
lines changed

‎advisories/unreviewed/2025/09/GHSA-64r9-7879-fmg9/GHSA-64r9-7879-fmg9.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-64r9-7879-fmg9",
4+
"modified": "2025-09-26T12:31:08Z",
5+
"published": "2025-09-26T12:31:08Z",
6+
"aliases": [
7+
"CVE-2025-11012"
8+
],
9+
"details": "A vulnerability was determined in BehaviorTree up to 4.7.0. This affects the function ParseScript of the file /src/script_parser.cpp of the component Diagnostic Message Handler. Executing manipulation of the argument error_msgs_buffer can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. This patch is called cb6c7514efa628adb8180b58b4c9ccdebbe096e3. A patch should be applied to remediate this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11012"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1006"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1007"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/BehaviorTree/BehaviorTree.CPP/commit/cb6c7514efa628adb8180b58b4c9ccdebbe096e3"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/user-attachments/files/22251337/poc.zip"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?ctiid.325955"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?id.325955"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?submit.654074"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-119"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2025-09-26T12:15:35Z"
63+
}
64+
}

‎advisories/unreviewed/2025/09/GHSA-6wwx-2f48-jxh8/GHSA-6wwx-2f48-jxh8.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6wwx-2f48-jxh8",
4+
"modified": "2025-09-26T12:31:07Z",
5+
"published": "2025-09-26T12:31:07Z",
6+
"aliases": [
7+
"CVE-2025-10544"
8+
],
9+
"details": "Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system. In addition, it is vulnerable to Path Traversal, which allows files to be written to arbitrary directories within the web root.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10544"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/unrestricted-uploading-dangerous-file-types-avepoint-products"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-434"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-26T10:15:44Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-7565-8whx-jmg5/GHSA-7565-8whx-jmg5.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7565-8whx-jmg5",
4+
"modified": "2025-09-26T12:31:08Z",
5+
"published": "2025-09-26T12:31:08Z",
6+
"aliases": [
7+
"CVE-2025-11011"
8+
],
9+
"details": "A vulnerability was found in BehaviorTree up to 4.7.0. Affected by this issue is the function JsonExporter::fromJson of the file /src/json_export.cpp. Performing manipulation of the argument Source results in null pointer dereference. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named 4b23dcaf0ce951a31299ebdd61df69f9ce99a76d. It is suggested to install a patch to address this issue.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11011"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/BehaviorTree/BehaviorTree.CPP/issues/1008"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/BehaviorTree/BehaviorTree.CPP/pull/1009"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/BehaviorTree/BehaviorTree.CPP/commit/4b23dcaf0ce951a31299ebdd61df69f9ce99a76d"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/user-attachments/files/22270928/poc.zip"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?ctiid.325954"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?id.325954"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vuldb.com/?submit.654073"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-404"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": false,
61+
"github_reviewed_at": null,
62+
"nvd_published_at": "2025-09-26T12:15:34Z"
63+
}
64+
}

‎advisories/unreviewed/2025/09/GHSA-q6mw-555r-hgcg/GHSA-q6mw-555r-hgcg.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q6mw-555r-hgcg",
4+
"modified": "2025-09-26T12:31:08Z",
5+
"published": "2025-09-26T12:31:08Z",
6+
"aliases": [
7+
"CVE-2025-5069"
8+
],
9+
"details": "An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5069"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://hackerone.com/reports/3019236"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/544926"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-708"
34+
],
35+
"severity": "LOW",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-09-26T10:15:47Z"
39+
}
40+
}

‎advisories/unreviewed/2025/09/GHSA-q7r9-4c9w-4548/GHSA-q7r9-4c9w-4548.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q7r9-4c9w-4548",
4+
"modified": "2025-09-26T12:31:08Z",
5+
"published": "2025-09-26T12:31:08Z",
6+
"aliases": [
7+
"CVE-2025-11010"
8+
],
9+
"details": "A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_include_common of the file /src/ucl_util.c. Such manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11010"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/vstakhov/libucl/issues/337"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/user-attachments/files/22317650/poc.zip"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.325953"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.325953"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.654068"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-119"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-09-26T11:15:38Z"
55+
}
56+
}

‎advisories/unreviewed/2025/09/GHSA-v52q-48v6-rmj4/GHSA-v52q-48v6-rmj4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v52q-48v6-rmj4",
4+
"modified": "2025-09-26T12:31:08Z",
5+
"published": "2025-09-26T12:31:07Z",
6+
"aliases": [
7+
"CVE-2025-11042"
8+
],
9+
"details": "An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while using specific GraphQL queries.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11042"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/550374"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-770"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-09-26T10:15:47Z"
35+
}
36+
}

‎advisories/unreviewed/2025/09/GHSA-vrvm-qc4x-35pw/GHSA-vrvm-qc4x-35pw.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vrvm-qc4x-35pw",
4+
"modified": "2025-09-26T12:31:07Z",
5+
"published": "2025-09-26T12:31:07Z",
6+
"aliases": [
7+
"CVE-2025-10868"
8+
],
9+
"details": "An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10868"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/526482"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [],
29+
"severity": "LOW",
30+
"github_reviewed": false,
31+
"github_reviewed_at": null,
32+
"nvd_published_at": "2025-09-26T10:15:46Z"
33+
}
34+
}

‎advisories/unreviewed/2025/09/GHSA-x6wm-h4q7-p8hv/GHSA-x6wm-h4q7-p8hv.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-x6wm-h4q7-p8hv",
4-
"modified": "2025-09-15T12:31:25Z",
4+
"modified": "2025-09-26T12:31:07Z",
55
"published": "2025-09-15T12:31:25Z",
66
"aliases": [
77
"CVE-2025-9826"
@@ -22,6 +22,10 @@
2222
{
2323
"type": "WEB",
2424
"url": "https://product.m-files.com/security-advisories/cve-2024-9826"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://product.m-files.com/security-advisories/cve-2025-9826"
2529
}
2630
],
2731
"database_specific": {

0 commit comments

Comments
 (0)