Skip to content

Commit a0a0047

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-m7gw-975p-jwfj GHSA-9x68-7qq6-v523 GHSA-34hw-4cqq-qh3w GHSA-8376-84xq-6jjp GHSA-c4h7-r924-5jg8 GHSA-fvh3-hc2j-x6cc GHSA-ghjx-924r-mqm7 GHSA-r767-8x6q-rpfx GHSA-w47f-xmcq-j6m3 GHSA-wcjp-gpp5-94xv
1 parent f1f9789 commit a0a0047

File tree

10 files changed

+373
-4
lines changed

10 files changed

+373
-4
lines changed

‎advisories/unreviewed/2024/06/GHSA-m7gw-975p-jwfj/GHSA-m7gw-975p-jwfj.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-m7gw-975p-jwfj",
4-
"modified": "2024-06-27T12:30:47Z",
4+
"modified": "2025-12-17T03:30:13Z",
55
"published": "2024-06-03T09:30:48Z",
66
"aliases": [
77
"CVE-2024-36964"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/9p: only translate RWX permissions for plain 9P2000\n\nGarbage in plain 9P2000's perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -53,7 +58,7 @@
5358
],
5459
"database_specific": {
5560
"cwe_ids": [],
56-
"severity": null,
61+
"severity": "MODERATE",
5762
"github_reviewed": false,
5863
"github_reviewed_at": null,
5964
"nvd_published_at": "2024-06-03T08:15:09Z"

‎advisories/unreviewed/2025/01/GHSA-9x68-7qq6-v523/GHSA-9x68-7qq6-v523.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9x68-7qq6-v523",
4-
"modified": "2025-12-16T12:30:27Z",
4+
"modified": "2025-12-17T03:30:13Z",
55
"published": "2025-01-14T18:32:00Z",
66
"aliases": [
77
"CVE-2024-12087"
@@ -31,6 +31,14 @@
3131
"type": "WEB",
3232
"url": "https://access.redhat.com/errata/RHSA-2025:23235"
3333
},
34+
{
35+
"type": "WEB",
36+
"url": "https://access.redhat.com/errata/RHSA-2025:23407"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://access.redhat.com/errata/RHSA-2025:23416"
41+
},
3442
{
3543
"type": "WEB",
3644
"url": "https://access.redhat.com/errata/RHSA-2025:2600"

‎advisories/unreviewed/2025/12/GHSA-34hw-4cqq-qh3w/GHSA-34hw-4cqq-qh3w.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34hw-4cqq-qh3w",
4+
"modified": "2025-12-17T03:30:13Z",
5+
"published": "2025-12-17T03:30:13Z",
6+
"aliases": [
7+
"CVE-2025-14700"
8+
],
9+
"details": "An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14700"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.com/crafty-controller/crafty-4/-/issues/646"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1336"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-17T01:15:59Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-8376-84xq-6jjp/GHSA-8376-84xq-6jjp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8376-84xq-6jjp",
4+
"modified": "2025-12-17T03:30:13Z",
5+
"published": "2025-12-17T03:30:13Z",
6+
"aliases": [
7+
"CVE-2025-14701"
8+
],
9+
"details": "An input neutralization vulnerability in the Server MOTD component of Crafty Controller allows a remote, unauthenticated attacker to perform stored XSS via server MOTD modification.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14701"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.com/crafty-controller/crafty-4/-/issues/647"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-17T01:15:59Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-c4h7-r924-5jg8/GHSA-c4h7-r924-5jg8.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c4h7-r924-5jg8",
4+
"modified": "2025-12-17T03:30:13Z",
5+
"published": "2025-12-17T03:30:13Z",
6+
"aliases": [
7+
"CVE-2025-11369"
8+
],
9+
"details": "The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback and get_siteinfo functions in all versions up to, and including, 5.7.2. This makes it possible for authenticated attackers, with Author-level access and above, to view API keys configured for the external services.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Integrations/GoogleMap.php#L50"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Integrations/Instagram.php#L20"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Integrations/OpenVerse.php#L108"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e5b1e90-53f7-4afc-9544-c36afe1ee813?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-862"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-17T02:16:00Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-fvh3-hc2j-x6cc/GHSA-fvh3-hc2j-x6cc.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fvh3-hc2j-x6cc",
4+
"modified": "2025-12-17T03:30:14Z",
5+
"published": "2025-12-17T03:30:13Z",
6+
"aliases": [
7+
"CVE-2025-14801"
8+
],
9+
"details": "A security vulnerability has been detected in xiweicheng TMS up to 2.28.0. This affects the function createComment of the file /admin/blog/comment/create. Such manipulation of the argument content leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14801"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/ha1yu-Yiqiyin/warehouse/blob/main/TMS_v2.28.0_XSS-1.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.336939"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.336939"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.708322"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-17T02:16:00Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-ghjx-924r-mqm7/GHSA-ghjx-924r-mqm7.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ghjx-924r-mqm7",
4+
"modified": "2025-12-17T03:30:13Z",
5+
"published": "2025-12-17T03:30:13Z",
6+
"aliases": [
7+
"CVE-2025-53524"
8+
],
9+
"details": "Fuji Electric Monitouch V-SFT-6 is vulnerable to an out-of-bounds write \nwhile processing a specially crafted project file, which may allow an \nattacker to execute arbitrary code.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53524"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://felib.fujielectric.co.jp/en/document_search?tab=software&document1%5B1%5D=M10009&document2%5B1%5D=M20104&product1%5B1%5D=P10003&product2%5B1%5D=P20023&product3%5B1%5D=P30623&product4%5B1%5D=S11133&discontinued%5B1%5D=0&count=20&sort=en_title&page=1&region=en-glb"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-308-01.json"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-01"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-787"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-17T01:15:59Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-r767-8x6q-rpfx/GHSA-r767-8x6q-rpfx.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r767-8x6q-rpfx",
4+
"modified": "2025-12-17T03:30:13Z",
5+
"published": "2025-12-17T03:30:13Z",
6+
"aliases": [
7+
"CVE-2025-14302"
8+
],
9+
"details": "Certain motherboard models developed by GIGABYTE has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security features are loaded.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14302"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.gigabyte.com/Support/Security?type=1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/en/cp-139-10575-e4f41-2.html"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.twcert.org.tw/tw/cp-132-10574-ddf09-1.html"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-693"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-17T03:15:57Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-w47f-xmcq-j6m3/GHSA-w47f-xmcq-j6m3.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w47f-xmcq-j6m3",
4+
"modified": "2025-12-17T03:30:13Z",
5+
"published": "2025-12-17T03:30:13Z",
6+
"aliases": [
7+
"CVE-2025-14303"
8+
],
9+
"details": "Certain motherboard models developed by MSI has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security features are loaded.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14303"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://csr.msi.com/global/product-security-advisories"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.twcert.org.tw/en/cp-139-10577-3cd58-2.html"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.twcert.org.tw/tw/cp-132-10576-0a0fd-1.html"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-693"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-17T03:15:57Z"
47+
}
48+
}

0 commit comments

Comments
 (0)