Skip to content

Commit 9c1a2a2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9f46-w24h-69w4 GHSA-2488-c4gj-6g77 GHSA-4f42-626f-cqm7 GHSA-57pf-qw33-m6q8 GHSA-7rw8-4p59-vgjq GHSA-cmrw-mhwx-4m8w GHSA-fq58-99h4-8g39 GHSA-gv8f-9g4r-fj8q GHSA-hg42-5fw6-5rj9 GHSA-j4jm-c8xw-8xf7 GHSA-m8x7-m39c-62g2 GHSA-r46x-x9h4-p52r GHSA-r5qp-7h29-v42w GHSA-r8v7-r4ff-qv43 GHSA-xcmr-c479-3mcp GHSA-xqwf-q6p3-jgrr GHSA-xxqq-pg5g-cgqm
1 parent 02cba57 commit 9c1a2a2

File tree

17 files changed

+379
-19
lines changed

17 files changed

+379
-19
lines changed

‎advisories/github-reviewed/2025/11/GHSA-9f46-w24h-69w4/GHSA-9f46-w24h-69w4.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9f46-w24h-69w4",
4-
"modified": "2025-11-27T07:53:59Z",
4+
"modified": "2025-12-17T00:31:18Z",
55
"published": "2025-11-24T20:05:21Z",
66
"aliases": [
77
"CVE-2025-62155"

‎advisories/unreviewed/2025/12/GHSA-2488-c4gj-6g77/GHSA-2488-c4gj-6g77.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2488-c4gj-6g77",
4+
"modified": "2025-12-17T00:31:18Z",
5+
"published": "2025-12-17T00:31:18Z",
6+
"aliases": [
7+
"CVE-2025-34288"
8+
],
9+
"details": "Nagios XI versions prior to 2026R1.1 are vulnerable to local privilege escalation due to an unsafe interaction between sudo permissions and application file permissions. A user‑accessible maintenance script may be executed as root via sudo and includes an application file that is writable by a lower‑privileged user. A local attacker with access to the application account can modify this file to introduce malicious code, which is then executed with elevated privileges when the script is run. Successful exploitation results in arbitrary code execution as the root user.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34288"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.nagios.com/changelog/nagios-xi/2026r1-1"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-writable-php-include-executed-with-sudo"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-732"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-16T23:15:44Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-4f42-626f-cqm7/GHSA-4f42-626f-cqm7.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-497"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/12/GHSA-57pf-qw33-m6q8/GHSA-57pf-qw33-m6q8.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-57pf-qw33-m6q8",
4+
"modified": "2025-12-17T00:31:18Z",
5+
"published": "2025-12-17T00:31:18Z",
6+
"aliases": [
7+
"CVE-2025-14466"
8+
],
9+
"details": "A vulnerability in the web interface of the Güralp Fortimus Series, Minimus Series and Certimus Series allows an unauthenticated attacker with network access to send specially-crafted HTTP requests that can cause the web service process to deliberately restart. Although this mechanism limits the impact of the attack, it results in a brief denial-of-service condition during the restart.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14466"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-350-01.json"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-01"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-770"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-16T22:15:46Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-7rw8-4p59-vgjq/GHSA-7rw8-4p59-vgjq.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7rw8-4p59-vgjq",
4+
"modified": "2025-12-17T00:31:18Z",
5+
"published": "2025-12-17T00:31:18Z",
6+
"aliases": [
7+
"CVE-2025-48429"
8+
],
9+
"details": "An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data. An attacker can provide a malicious file to trigger this vulnerability.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48429"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2214"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2214"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-119"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-16T22:15:47Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-cmrw-mhwx-4m8w/GHSA-cmrw-mhwx-4m8w.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cmrw-mhwx-4m8w",
4-
"modified": "2025-12-16T09:31:09Z",
4+
"modified": "2025-12-17T00:31:17Z",
55
"published": "2025-12-16T09:31:09Z",
66
"aliases": [
77
"CVE-2025-66130"
88
],
99
"details": "Missing Authorization vulnerability in etruel WP Views Counter wpecounter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Views Counter: from n/a through <= 2.1.2.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -23,7 +28,7 @@
2328
"cwe_ids": [
2429
"CWE-862"
2530
],
26-
"severity": null,
31+
"severity": "MODERATE",
2732
"github_reviewed": false,
2833
"github_reviewed_at": null,
2934
"nvd_published_at": "2025-12-16T09:15:57Z"

‎advisories/unreviewed/2025/12/GHSA-fq58-99h4-8g39/GHSA-fq58-99h4-8g39.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fq58-99h4-8g39",
4+
"modified": "2025-12-17T00:31:19Z",
5+
"published": "2025-12-17T00:31:19Z",
6+
"aliases": [
7+
"CVE-2025-53619"
8+
],
9+
"details": "An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `null_convert` is called based of the value of the malicious DICOM file specifying the intended interpretation of the image pixel data",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53619"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2025-2210"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-119"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-16T22:15:47Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-gv8f-9g4r-fj8q/GHSA-gv8f-9g4r-fj8q.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gv8f-9g4r-fj8q",
4+
"modified": "2025-12-17T00:31:18Z",
5+
"published": "2025-12-17T00:31:18Z",
6+
"aliases": [
7+
"CVE-2025-14765"
8+
],
9+
"details": "Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14765"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_16.html"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://issues.chromium.org/issues/448294721"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-416"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2025-12-16T23:15:44Z"
34+
}
35+
}

‎advisories/unreviewed/2025/12/GHSA-hg42-5fw6-5rj9/GHSA-hg42-5fw6-5rj9.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hg42-5fw6-5rj9",
4-
"modified": "2025-12-12T21:31:39Z",
4+
"modified": "2025-12-17T00:31:17Z",
55
"published": "2025-12-12T21:31:39Z",
66
"aliases": [
77
"CVE-2025-43463"
88
],
99
"details": "A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sonoma 14.8.3, macOS Tahoe 26.1, macOS Sequoia 15.7.3. An app may be able to access sensitive user data.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-22"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2025-12-12T21:15:54Z"

‎advisories/unreviewed/2025/12/GHSA-j4jm-c8xw-8xf7/GHSA-j4jm-c8xw-8xf7.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j4jm-c8xw-8xf7",
4-
"modified": "2025-12-12T21:31:38Z",
4+
"modified": "2025-12-17T00:31:17Z",
55
"published": "2025-12-12T21:31:38Z",
66
"aliases": [
77
"CVE-2025-43320"
88
],
99
"details": "The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -21,7 +26,7 @@
2126
],
2227
"database_specific": {
2328
"cwe_ids": [],
24-
"severity": null,
29+
"severity": "HIGH",
2530
"github_reviewed": false,
2631
"github_reviewed_at": null,
2732
"nvd_published_at": "2025-12-12T21:15:53Z"

0 commit comments

Comments
 (0)