Publish Advisories

GHSA-r93j-3mmp-px57
GHSA-rx48-gqc2-4w47
GHSA-r93j-3mmp-px57

Author: advisory-database[bot]

advisories/github-reviewed/2022/05/GHSA-r93j-3mmp-px57/GHSA-r93j-3mmp-px57.json

@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r93j-3mmp-px57",
+  "modified": "2025-10-21T22:38:56Z",
+  "published": "2022-05-24T17:21:01Z",
+  "aliases": [
+    "CVE-2016-11066"
+  ],
+  "summary": "Mattermost Server: initial_load API exposes unnecessary information",
+  "details": "An issue was discovered in Mattermost Server before 3.1.1. The initial_load API disclosed unnecessary personal information.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/mattermost/mattermost-server"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.1.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-11066"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mattermost/mattermost/commit/f89e7c6d543a82d6078c2ca0f892914d7976a6f5"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/mattermost/mattermost"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mattermost.com/security-updates"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200",
+      "CWE-359"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-10-21T22:38:28Z",
+    "nvd_published_at": "2020-06-19T20:15:00Z"
+  }
+}

…-rx48-gqc2-4w47/GHSA-rx48-gqc2-4w47.json …-rx48-gqc2-4w47/GHSA-rx48-gqc2-4w47.jsonadvisories/unreviewed/2025/10/GHSA-rx48-gqc2-4w47/GHSA-rx48-gqc2-4w47.json renamed to advisories/github-reviewed/2025/10/GHSA-rx48-gqc2-4w47/GHSA-rx48-gqc2-4w47.json advisories/unreviewed/2025/10/GHSA-rx48-gqc2-4w47/GHSA-rx48-gqc2-4w47.json renamed to advisories/github-reviewed/2025/10/GHSA-rx48-gqc2-4w47/GHSA-rx48-gqc2-4w47.json

@@ -1,24 +1,61 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rx48-gqc2-4w47",
-  "modified": "2025-10-21T21:33:41Z",
+  "modified": "2025-10-21T22:37:39Z",
   "published": "2025-10-21T21:33:41Z",
   "aliases": [
     "CVE-2025-62249"
   ],
+  "summary": "Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget",
   "details": "A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.",
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:com.liferay.portal.impl"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "114.1.0"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62249"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/liferay/liferay-portal/commit/66c51e026f7c9eee8f82137a586ceea5bdc081a5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/liferay/liferay-portal/commit/8309d01f151124e1af392b67baf9711e46488791"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/liferay/liferay-portal/commit/f041e7058929618bb101b8e4bae5a8a226e6f8b8"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/liferay/liferay-portal"
+    },
     {
       "type": "WEB",
       "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62249"
@@ -29,8 +66,8 @@
       "CWE-79"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-10-21T22:37:39Z",
     "nvd_published_at": "2025-10-21T19:21:25Z"
   }
 }