Skip to content

Commit a87d030

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3q8m-2mjw-v5cg GHSA-g3qw-5m3w-vr84 GHSA-g6mh-6454-qm24 GHSA-gx78-xfgv-xgx7 GHSA-hxvg-xxq8-4wc2 GHSA-pgjh-rx3f-6555 GHSA-wg65-qr54-32p9
1 parent 8228413 commit a87d030

File tree

7 files changed

+261
-0
lines changed

7 files changed

+261
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-3q8m-2mjw-v5cg/GHSA-3q8m-2mjw-v5cg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3q8m-2mjw-v5cg",
4+
"modified": "2025-11-25T00:31:41Z",
5+
"published": "2025-11-25T00:31:41Z",
6+
"aliases": [
7+
"CVE-2025-54347"
8+
],
9+
"details": "A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to write arbitrary files under certain conditions.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54347"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://desktopalert.net/cve-2025-54347"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-22"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-24T22:15:49Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-g3qw-5m3w-vr84/GHSA-g3qw-5m3w-vr84.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g3qw-5m3w-vr84",
4+
"modified": "2025-11-25T00:31:41Z",
5+
"published": "2025-11-25T00:31:41Z",
6+
"aliases": [
7+
"CVE-2025-54563"
8+
],
9+
"details": "An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54563"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://desktopalert.net/cve-2025-54563"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-284"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-24T22:15:49Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-g6mh-6454-qm24/GHSA-g6mh-6454-qm24.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g6mh-6454-qm24",
4+
"modified": "2025-11-25T00:31:41Z",
5+
"published": "2025-11-25T00:31:41Z",
6+
"aliases": [
7+
"CVE-2024-47856"
8+
],
9+
"details": "In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks. An adversary can place an executable in a higher-level directory of the path, and Windows will resolve that executable instead of the intended executable.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47856"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://community.rsa.com/s/article/RSA-2024-13-RSA-Authentication-Agent-for-Microsoft-Windows-Security-Update"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://community.rsa.com/s/product-download/a9G4u000000mCOYEAU/rsa-authentication-agent-747-for-microsoft-windows"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2025-11-24T22:15:46Z"
32+
}
33+
}

‎advisories/unreviewed/2025/11/GHSA-gx78-xfgv-xgx7/GHSA-gx78-xfgv-xgx7.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gx78-xfgv-xgx7",
4+
"modified": "2025-11-25T00:31:41Z",
5+
"published": "2025-11-25T00:31:41Z",
6+
"aliases": [
7+
"CVE-2025-54338"
8+
],
9+
"details": "An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54338"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://desktopalert.net/cve-2025-54338"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-284"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-24T22:15:48Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-hxvg-xxq8-4wc2/GHSA-hxvg-xxq8-4wc2.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hxvg-xxq8-4wc2",
4+
"modified": "2025-11-25T00:31:41Z",
5+
"published": "2025-11-25T00:31:41Z",
6+
"aliases": [
7+
"CVE-2025-10144"
8+
],
9+
"details": "The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10144"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/perfect-woocommerce-brands/tags/3.6.0/lib/class-woocommerce.php#L112"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f4618bfd-77d9-4396-b041-d7ba0f6ec75a?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-11-24T23:15:46Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-pgjh-rx3f-6555/GHSA-pgjh-rx3f-6555.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pgjh-rx3f-6555",
4+
"modified": "2025-11-25T00:31:41Z",
5+
"published": "2025-11-25T00:31:41Z",
6+
"aliases": [
7+
"CVE-2025-63674"
8+
],
9+
"details": "An issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers to execute arbitrary code via overriding the bootloader on the SD card.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63674"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://vindivlabs.com/research/lumi_part_2"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "http://a31c.com"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "http://blurams.com"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-77"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-11-24T22:15:49Z"
43+
}
44+
}

‎advisories/unreviewed/2025/11/GHSA-wg65-qr54-32p9/GHSA-wg65-qr54-32p9.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wg65-qr54-32p9",
4+
"modified": "2025-11-25T00:31:41Z",
5+
"published": "2025-11-25T00:31:41Z",
6+
"aliases": [
7+
"CVE-2025-54341"
8+
],
9+
"details": "A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54341"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://desktopalert.net/cve-2025-54341"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-798"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-24T22:15:49Z"
35+
}
36+
}

0 commit comments

Comments
 (0)