Skip to content

Commit ad3ac99

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 64cba70 commit ad3ac99

File tree

27 files changed

+680
-20
lines changed

27 files changed

+680
-20
lines changed

‎advisories/unreviewed/2022/07/GHSA-px93-j66q-3gqm/GHSA-px93-j66q-3gqm.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@
2626
],
2727
"database_specific": {
2828
"cwe_ids": [
29-
"CWE-290"
29+
"CWE-290",
30+
"CWE-358"
3031
],
3132
"severity": "HIGH",
3233
"github_reviewed": false,

‎advisories/unreviewed/2025/01/GHSA-gjv6-pfh4-3rff/GHSA-gjv6-pfh4-3rff.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gjv6-pfh4-3rff",
4-
"modified": "2025-10-22T00:33:12Z",
4+
"modified": "2025-10-31T15:30:29Z",
55
"published": "2025-01-14T18:32:05Z",
66
"aliases": [
77
"CVE-2025-21333"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21333"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.exploit-db.com/exploits/52436"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-detection-script"

‎advisories/unreviewed/2025/03/GHSA-h8g5-2596-xjh9/GHSA-h8g5-2596-xjh9.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@
3737
}
3838
],
3939
"database_specific": {
40-
"cwe_ids": [],
40+
"cwe_ids": [
41+
"CWE-668"
42+
],
4143
"severity": "CRITICAL",
4244
"github_reviewed": false,
4345
"github_reviewed_at": null,

‎advisories/unreviewed/2025/09/GHSA-595w-v3fv-xpwf/GHSA-595w-v3fv-xpwf.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-595w-v3fv-xpwf",
4-
"modified": "2025-09-30T12:30:51Z",
4+
"modified": "2025-10-31T15:30:30Z",
55
"published": "2025-09-30T12:30:51Z",
66
"aliases": [
77
"CVE-2025-59668"
@@ -27,9 +27,17 @@
2727
"type": "WEB",
2828
"url": "https://jvn.jp/en/vu/JVNVU96989989"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-296-01"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "https://www.nihonkohden.com/security.html"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.nihonkohden.com/security/main/01112/teaserItems3/0/linkList/0/link/NKcorporateResponse-CNS-6201_CentralMonitor_Vulnerability(CVE-2025-59668)_en_Rev2.pdf"
3341
}
3442
],
3543
"database_specific": {

‎advisories/unreviewed/2025/10/GHSA-2cfx-ppj7-2856/GHSA-2cfx-ppj7-2856.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2cfx-ppj7-2856",
4+
"modified": "2025-10-31T15:30:31Z",
5+
"published": "2025-10-31T15:30:31Z",
6+
"aliases": [
7+
"CVE-2025-64388"
8+
],
9+
"details": "Denial of service of the web server through specific requests to this protocol",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64388"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cds.thalesgroup.com/es/s21sec"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010."
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-400"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-31T15:15:43Z"
39+
}
40+
}

‎advisories/unreviewed/2025/10/GHSA-2rj5-gh6q-72fp/GHSA-2rj5-gh6q-72fp.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2rj5-gh6q-72fp",
4-
"modified": "2025-10-31T00:30:35Z",
4+
"modified": "2025-10-31T15:30:31Z",
55
"published": "2025-10-31T00:30:35Z",
66
"aliases": [
77
"CVE-2025-52665"
88
],
99
"details": "A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. \n \nAffected Products:\nUniFi Access Application (Version 3.3.22 through 3.4.31). \n \n\nMitigation:\nUpdate your UniFi Access Application to Version 4.0.21 or later.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-306"
30+
],
31+
"severity": "CRITICAL",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2025-10-31T00:15:37Z"

‎advisories/unreviewed/2025/10/GHSA-3h2w-68px-r4v5/GHSA-3h2w-68px-r4v5.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3h2w-68px-r4v5",
4-
"modified": "2025-10-31T09:30:26Z",
4+
"modified": "2025-10-31T15:30:31Z",
55
"published": "2025-10-31T09:30:26Z",
66
"aliases": [
77
"CVE-2025-62232"
88
],
99
"details": "Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access.\nIt has been fixed in the following commit:  https://github.com/apache/apisix/pull/12629 \nUsers are recommended to upgrade to version 3.14, which fixes this issue.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -27,7 +32,7 @@
2732
"cwe_ids": [
2833
"CWE-532"
2934
],
30-
"severity": null,
35+
"severity": "HIGH",
3136
"github_reviewed": false,
3237
"github_reviewed_at": null,
3338
"nvd_published_at": "2025-10-31T09:15:48Z"

‎advisories/unreviewed/2025/10/GHSA-4fg8-97vg-f94j/GHSA-4fg8-97vg-f94j.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4fg8-97vg-f94j",
4+
"modified": "2025-10-31T15:30:31Z",
5+
"published": "2025-10-31T15:30:31Z",
6+
"aliases": [
7+
"CVE-2024-13992"
8+
],
9+
"details": "Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the \"missing page\" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI domain.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13992"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.nagios.com/changelog/nagios-xi/2024r1-1"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.nagios.com/products/security/#nagios-xi"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/nagios-xi-xss-via-missing-page"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-31T13:15:33Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-4m38-cfr7-jx25/GHSA-4m38-cfr7-jx25.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4m38-cfr7-jx25",
4+
"modified": "2025-10-31T15:30:31Z",
5+
"published": "2025-10-31T15:30:31Z",
6+
"aliases": [
7+
"CVE-2025-64386"
8+
],
9+
"details": "The\nequipment grants a JWT token for each connection in the timeline, but during an\nactive valid session, a hijacking of the token can be done. This will allow an\nattacker with the token modify parameters of security, access or even steal the\nsession without\nthe legitimate and active session detecting it. The web server allows the\nattacker to reuse an old session JWT token while the legitimate session is\nactive.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64386"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010."
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-613"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-31T14:16:13Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-5fcf-3m52-f3q5/GHSA-5fcf-3m52-f3q5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5fcf-3m52-f3q5",
4+
"modified": "2025-10-31T15:30:31Z",
5+
"published": "2025-10-31T15:30:31Z",
6+
"aliases": [
7+
"CVE-2025-36249"
8+
],
9+
"details": "IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36249"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.ibm.com/support/pages/node/7249820"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-614"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-31T13:15:33Z"
35+
}
36+
}

0 commit comments

Comments
 (0)