Skip to content

Commit b36c8b4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 1775152 commit b36c8b4

File tree

36 files changed

+1279
-38
lines changed

36 files changed

+1279
-38
lines changed

‎advisories/unreviewed/2025/09/GHSA-25qr-xf4w-7m3j/GHSA-25qr-xf4w-7m3j.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45-
"CWE-74"
45+
"CWE-74",
46+
"CWE-89"
4647
],
4748
"severity": "MODERATE",
4849
"github_reviewed": false,

‎advisories/unreviewed/2025/10/GHSA-5mxh-q367-rc3m/GHSA-5mxh-q367-rc3m.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@
2929
}
3030
],
3131
"database_specific": {
32-
"cwe_ids": [],
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
3335
"severity": "HIGH",
3436
"github_reviewed": false,
3537
"github_reviewed_at": null,

‎advisories/unreviewed/2025/11/GHSA-2hjg-83v5-q3mf/GHSA-2hjg-83v5-q3mf.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hjg-83v5-q3mf",
4+
"modified": "2025-11-15T00:30:26Z",
5+
"published": "2025-11-15T00:30:26Z",
6+
"aliases": [
7+
"CVE-2025-13187"
8+
],
9+
"details": "A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipulation of the argument NomeUsuario/SenhaAcess leads to unprotected storage of credentials. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13187"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://vuldb.com/?ctiid.332475"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?id.332475"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?submit.685522"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.notion.so/eldruin/Intelbras-ICIP-Plaintext-Admin-Credentials-Disclosure-29b27474cccb80ff943ff2776d03d7cd"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-11-14T22:15:45Z"
49+
}
50+
}

‎advisories/unreviewed/2025/11/GHSA-2xcq-fmvr-mmpw/GHSA-2xcq-fmvr-mmpw.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2xcq-fmvr-mmpw",
4-
"modified": "2025-11-14T18:31:40Z",
4+
"modified": "2025-11-15T00:30:26Z",
55
"published": "2025-11-14T18:31:40Z",
66
"aliases": [
77
"CVE-2025-63830"
88
],
99
"details": "CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-11-14T18:15:51Z"

‎advisories/unreviewed/2025/11/GHSA-392p-wm2f-p96x/GHSA-392p-wm2f-p96x.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-392p-wm2f-p96x",
4-
"modified": "2025-11-14T18:31:39Z",
4+
"modified": "2025-11-15T00:30:25Z",
55
"published": "2025-11-14T18:31:39Z",
66
"aliases": [
77
"CVE-2025-54345"
88
],
99
"details": "An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. Sensitive Information is exposed to an Unauthorized Actor.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-200"
34+
],
35+
"severity": "HIGH",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-11-14T18:15:48Z"

‎advisories/unreviewed/2025/11/GHSA-3cvf-5chq-5r99/GHSA-3cvf-5chq-5r99.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3cvf-5chq-5r99",
4-
"modified": "2025-11-14T21:30:29Z",
4+
"modified": "2025-11-15T00:30:26Z",
55
"published": "2025-11-14T21:30:29Z",
66
"aliases": [
77
"CVE-2025-63291"
88
],
99
"details": "When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being requested by the caller. The Alteryx server did not check whether the authenticated user had permission to access the specified MongoDB object ID. By specifying particlar MongoDB object IDs, callers could obtain records for other users without proper authorization. Records retrievable using this attack included administrative API keys and private studio api keys.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-648"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2025-11-14T19:16:01Z"

‎advisories/unreviewed/2025/11/GHSA-3fh5-63gr-xqxc/GHSA-3fh5-63gr-xqxc.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3fh5-63gr-xqxc",
4+
"modified": "2025-11-15T00:30:26Z",
5+
"published": "2025-11-15T00:30:26Z",
6+
"aliases": [
7+
"CVE-2018-25125"
8+
],
9+
"details": "Netis ADSL Router DL4322D firmware RTK 2.1.1 contains a buffer overflow vulnerability in the embedded FTP service that allows an authenticated remote user to trigger a denial of service. After logging in to the FTP service, sending an FTP command such as ABOR with an excessively long argument causes the service, and in practice the router, to crash or become unresponsive, resulting in a loss of availability for the device and connected users.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25125"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://web.archive.org/web/20180731191918/http://www.netis-systems.com/Home/detail/id/74.html"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.exploit-db.com/exploits/45424"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.netis-systems.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/netis-dl4322d-ftp-service-dos"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-120"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-11-14T23:15:41Z"
47+
}
48+
}

‎advisories/unreviewed/2025/11/GHSA-3hfj-mrxp-x3v9/GHSA-3hfj-mrxp-x3v9.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3hfj-mrxp-x3v9",
4-
"modified": "2025-11-14T21:30:30Z",
4+
"modified": "2025-11-15T00:30:26Z",
55
"published": "2025-11-14T21:30:30Z",
66
"aliases": [
77
"CVE-2025-63744"
88
],
99
"details": "A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-476"
42+
],
43+
"severity": "MODERATE",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2025-11-14T21:15:44Z"

‎advisories/unreviewed/2025/11/GHSA-3mr8-x6wp-2wc6/GHSA-3mr8-x6wp-2wc6.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3mr8-x6wp-2wc6",
4+
"modified": "2025-11-15T00:30:25Z",
5+
"published": "2025-11-15T00:30:25Z",
6+
"aliases": [
7+
"CVE-2024-28988"
8+
],
9+
"details": "SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability was found by the ZDI team after researching a previous vulnerability and providing this report. The ZDI team was able to discover an unauthenticated attack during their research. \n\n\n\n\n\nWe recommend all Web Help Desk customers apply the patch, which is now available. \n\n\n\n\n\nWe thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28988"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-3"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28988"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-502"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-09-01T22:15:30Z"
39+
}
40+
}

‎advisories/unreviewed/2025/11/GHSA-4w9w-pqwx-pfqr/GHSA-4w9w-pqwx-pfqr.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4w9w-pqwx-pfqr",
4+
"modified": "2025-11-15T00:30:26Z",
5+
"published": "2025-11-15T00:30:26Z",
6+
"aliases": [
7+
"CVE-2021-4468"
8+
],
9+
"details": "PLANEX CS-QP50F-ING2 smart cameras expose a configuration backup interface over HTTP that does not require authentication. A remote, unauthenticated attacker can directly retrieve a compressed configuration backup file from the device. The backup contains sensitive configuration information, including credentials, allowing an attacker to obtain administrative access to the camera and compromise the confidentiality of the monitored environment.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4468"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cxsecurity.com/issue/WLB-2021010050"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://packetstorm.news/files/id/160805"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.planex.co.jp/products/cs-qp50f"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.vulncheck.com/advisories/planex-cs-qp50f-ing2-smart-camera-remote-configuration-disclosure"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-306"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-11-14T23:15:42Z"
47+
}
48+
}

0 commit comments

Comments
 (0)