Skip to content

Commit a34fca7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-43hq-c99c-6p3f GHSA-53pc-prxg-7xp2 GHSA-648p-48g9-674x GHSA-hhp2-jq65-cjxx GHSA-j6c2-7rv4-43qj GHSA-jp64-2qcg-892x GHSA-m9rv-g47r-qvh2 GHSA-pmc7-2mv9-jmgx GHSA-pwmf-gq5q-rjmq GHSA-qr7g-8gm2-h5q6 GHSA-wcrw-whfv-8v36 GHSA-x476-g3pc-3h6p GHSA-xr9w-r8gw-wjhw GHSA-xx7c-xcq4-cj23
1 parent a7ea28d commit a34fca7

File tree

14 files changed

+389
-18
lines changed

14 files changed

+389
-18
lines changed

‎advisories/unreviewed/2025/12/GHSA-43hq-c99c-6p3f/GHSA-43hq-c99c-6p3f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-43hq-c99c-6p3f",
4+
"modified": "2025-12-09T00:31:16Z",
5+
"published": "2025-12-09T00:31:16Z",
6+
"aliases": [
7+
"CVE-2025-36015"
8+
],
9+
"details": "IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36015"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.ibm.com/support/pages/node/7253273"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1284"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-08T22:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-53pc-prxg-7xp2/GHSA-53pc-prxg-7xp2.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-53pc-prxg-7xp2",
4+
"modified": "2025-12-09T00:31:16Z",
5+
"published": "2025-12-09T00:31:16Z",
6+
"aliases": [
7+
"CVE-2025-64650"
8+
],
9+
"details": "IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64650"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.ibm.com/support/pages/node/7253864"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-532"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-08T22:15:52Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-648p-48g9-674x/GHSA-648p-48g9-674x.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-648p-48g9-674x",
4+
"modified": "2025-12-09T00:31:16Z",
5+
"published": "2025-12-09T00:31:16Z",
6+
"aliases": [
7+
"CVE-2025-36140"
8+
],
9+
"details": "IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36140"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.ibm.com/support/pages/node/7253932"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-770"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-08T23:15:47Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-hhp2-jq65-cjxx/GHSA-hhp2-jq65-cjxx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hhp2-jq65-cjxx",
4+
"modified": "2025-12-09T00:31:16Z",
5+
"published": "2025-12-09T00:31:16Z",
6+
"aliases": [
7+
"CVE-2025-14276"
8+
],
9+
"details": "A vulnerability was determined in Ilevia EVE X1 Server up to 4.6.5.0.eden. Impacted is an unknown function of the file /ajax/php/leaf_search.php. This manipulation of the argument line causes command injection. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized. Upgrading the affected component is recommended. The vendor confirms the issue and recommends: \"We already know that issue and on most devices are already solved, also it’s not needed to open the port to outside world so we advised our customer to close it\".",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14276"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.334802"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.334802"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.702649"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.yuque.com/yuqueyonghuexlgkz/zepczx/ahygt5u6sgqpk5tt?singleDoc"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-12-08T22:15:50Z"
51+
}
52+
}

‎advisories/unreviewed/2025/12/GHSA-j6c2-7rv4-43qj/GHSA-j6c2-7rv4-43qj.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j6c2-7rv4-43qj",
4+
"modified": "2025-12-09T00:31:16Z",
5+
"published": "2025-12-09T00:31:16Z",
6+
"aliases": [
7+
"CVE-2025-12832"
8+
],
9+
"details": "IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12832"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.ibm.com/support/pages/node/7253507"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-918"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-08T22:15:49Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-jp64-2qcg-892x/GHSA-jp64-2qcg-892x.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jp64-2qcg-892x",
4-
"modified": "2025-12-08T18:30:43Z",
4+
"modified": "2025-12-09T00:31:15Z",
55
"published": "2025-12-08T18:30:42Z",
66
"aliases": [
77
"CVE-2025-48580"
88
],
99
"details": "In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -25,7 +30,7 @@
2530
],
2631
"database_specific": {
2732
"cwe_ids": [],
28-
"severity": null,
33+
"severity": "HIGH",
2934
"github_reviewed": false,
3035
"github_reviewed_at": null,
3136
"nvd_published_at": "2025-12-08T17:16:15Z"

‎advisories/unreviewed/2025/12/GHSA-m9rv-g47r-qvh2/GHSA-m9rv-g47r-qvh2.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-m9rv-g47r-qvh2",
4-
"modified": "2025-12-08T21:30:22Z",
4+
"modified": "2025-12-09T00:31:16Z",
55
"published": "2025-12-08T21:30:22Z",
66
"aliases": [
77
"CVE-2025-65229"
88
],
99
"details": "A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with access to Settings Player can save arbitrary HTML/JavaScript in the Player name field. That value is stored by the server and later rendered without proper output encoding on the Information (Player Info) tab, causing the script to execute in the context of any user viewing that page.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2025-12-08T20:15:52Z"

‎advisories/unreviewed/2025/12/GHSA-pmc7-2mv9-jmgx/GHSA-pmc7-2mv9-jmgx.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pmc7-2mv9-jmgx",
4+
"modified": "2025-12-09T00:31:16Z",
5+
"published": "2025-12-09T00:31:16Z",
6+
"aliases": [
7+
"CVE-2025-12635"
8+
],
9+
"details": "IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12635"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.ibm.com/support/pages/node/7254078"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-08T22:15:49Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-pwmf-gq5q-rjmq/GHSA-pwmf-gq5q-rjmq.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pwmf-gq5q-rjmq",
4-
"modified": "2025-12-08T18:30:42Z",
4+
"modified": "2025-12-09T00:31:15Z",
55
"published": "2025-12-08T18:30:42Z",
66
"aliases": [
77
"CVE-2025-48573"
88
],
99
"details": "In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use abuse. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-250"
34+
],
35+
"severity": "HIGH",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-12-08T17:16:15Z"

‎advisories/unreviewed/2025/12/GHSA-qr7g-8gm2-h5q6/GHSA-qr7g-8gm2-h5q6.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qr7g-8gm2-h5q6",
4-
"modified": "2025-12-08T18:30:43Z",
4+
"modified": "2025-12-09T00:31:16Z",
55
"published": "2025-12-08T18:30:43Z",
66
"aliases": [
77
"CVE-2025-48583"
88
],
99
"details": "In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -25,7 +30,7 @@
2530
],
2631
"database_specific": {
2732
"cwe_ids": [],
28-
"severity": null,
33+
"severity": "HIGH",
2934
"github_reviewed": false,
3035
"github_reviewed_at": null,
3136
"nvd_published_at": "2025-12-08T17:16:15Z"

0 commit comments

Comments
 (0)