Skip to content

Commit 9d3df49

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7cjv-vw69-7fxx GHSA-jpj2-v98q-h9vj GHSA-jwf9-8pmx-vhcx GHSA-xg9f-qgvm-j933
1 parent bffd966 commit 9d3df49

File tree

4 files changed

+188
-0
lines changed

4 files changed

+188
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-7cjv-vw69-7fxx/GHSA-7cjv-vw69-7fxx.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7cjv-vw69-7fxx",
4+
"modified": "2025-11-30T06:30:13Z",
5+
"published": "2025-11-30T06:30:13Z",
6+
"aliases": [
7+
"CVE-2025-66433"
8+
],
9+
"details": "HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job. This is fixed in 24.12.14, 25.0.3, and 25.3.1. The earliest affected version is 24.7.3.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66433"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://htcondor.org/security/vulnerabilities/HTCONDOR-2025-0002.html"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-863"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-30T05:16:12Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-jpj2-v98q-h9vj/GHSA-jpj2-v98q-h9vj.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jpj2-v98q-h9vj",
4+
"modified": "2025-11-30T06:30:13Z",
5+
"published": "2025-11-30T06:30:12Z",
6+
"aliases": [
7+
"CVE-2025-13782"
8+
],
9+
"details": "A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file application/Admin/Controller/SlideController.class.php of the component SlideController. The manipulation of the argument ids leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13782"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.333786"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.333786"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.688837"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.yuque.com/shangu-vvuup/ydpg69/amhlbdhkw0pgt44g?singleDoc"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-11-30T04:15:58Z"
51+
}
52+
}

‎advisories/unreviewed/2025/11/GHSA-jwf9-8pmx-vhcx/GHSA-jwf9-8pmx-vhcx.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jwf9-8pmx-vhcx",
4+
"modified": "2025-11-30T06:30:13Z",
5+
"published": "2025-11-30T06:30:13Z",
6+
"aliases": [
7+
"CVE-2025-13783"
8+
],
9+
"details": "A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminController. The manipulation of the argument ids results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13783"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.333787"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.333787"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.688838"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.688839"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://www.yuque.com/shangu-vvuup/ydpg69/dd5zpygt7w5w4d19?singleDoc"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-30T06:15:45Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-xg9f-qgvm-j933/GHSA-xg9f-qgvm-j933.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xg9f-qgvm-j933",
4+
"modified": "2025-11-30T06:30:13Z",
5+
"published": "2025-11-30T06:30:13Z",
6+
"aliases": [
7+
"CVE-2025-66432"
8+
],
9+
"details": "In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66432"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://docs.oxide.computer/security/advisories/20251117-1"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/oxidecomputer/omicron/compare/01bb875...ec069f0"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://oxide.computer"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-420"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-30T05:16:08Z"
43+
}
44+
}

0 commit comments

Comments
 (0)