Skip to content

Commit b91cb2e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-45h5-66jx-r2wf GHSA-774q-r975-vqwp GHSA-cwrr-xmm2-f4jr GHSA-h2vr-rqqp-xv8m GHSA-p779-v69c-4294 GHSA-r6j8-c6r2-37rr GHSA-x37w-7p52-8f49
1 parent c6ca45b commit b91cb2e

File tree

7 files changed

+316
-0
lines changed

7 files changed

+316
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-45h5-66jx-r2wf/GHSA-45h5-66jx-r2wf.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-45h5-66jx-r2wf",
4+
"modified": "2025-12-15T00:30:25Z",
5+
"published": "2025-12-15T00:30:25Z",
6+
"aliases": [
7+
"CVE-2025-67898"
8+
],
9+
"details": "MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type=\"css\" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67898"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/mjmlio/mjml/issues/3018"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-36"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-14T22:15:36Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-774q-r975-vqwp/GHSA-774q-r975-vqwp.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-774q-r975-vqwp",
4+
"modified": "2025-12-15T00:30:26Z",
5+
"published": "2025-12-15T00:30:25Z",
6+
"aliases": [
7+
"CVE-2025-14691"
8+
],
9+
"details": "A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms that this is \"[f]ixed in version 4.10.2\". Furthermore, that \"[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete.\"",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14691"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://docs.mayan-edms.com/chapters/releases/4.10.2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://docs.mayan-edms.com/chapters/releases/4.10.2.html#security"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/ionutluca888/Mayan-EDMS-XSS-POC"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.336409"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.336409"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.711713"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-79"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-12-14T23:15:36Z"
59+
}
60+
}

‎advisories/unreviewed/2025/12/GHSA-cwrr-xmm2-f4jr/GHSA-cwrr-xmm2-f4jr.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cwrr-xmm2-f4jr",
4+
"modified": "2025-12-15T00:30:26Z",
5+
"published": "2025-12-15T00:30:25Z",
6+
"aliases": [
7+
"CVE-2025-67901"
8+
],
9+
"details": "openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a length of zero for block data, because the relationship between p->rem and p->len is not checked.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67901"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/kristapsdz/openrsync/issues/34"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/openbsd/src/blob/60b9c3dff1abf933e85e3c4d96b54201ee947513/usr.bin/rsync/blocks.c#L480-L481"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-1284"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-15T00:15:40Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-h2vr-rqqp-xv8m/GHSA-h2vr-rqqp-xv8m.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h2vr-rqqp-xv8m",
4+
"modified": "2025-12-15T00:30:25Z",
5+
"published": "2025-12-15T00:30:25Z",
6+
"aliases": [
7+
"CVE-2025-67899"
8+
],
9+
"details": "uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67899"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/uriparser/uriparser/issues/282"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/uriparser/uriparser/pull/284"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-674"
34+
],
35+
"severity": "LOW",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-14T23:15:37Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-p779-v69c-4294/GHSA-p779-v69c-4294.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p779-v69c-4294",
4+
"modified": "2025-12-15T00:30:25Z",
5+
"published": "2025-12-15T00:30:25Z",
6+
"aliases": [
7+
"CVE-2025-67900"
8+
],
9+
"details": "NXLog Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67900"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://docs.nxlog.co/agent/current/release-notes.html#nxlog-agent-6-11"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-829"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-14T23:15:37Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-r6j8-c6r2-37rr/GHSA-r6j8-c6r2-37rr.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r6j8-c6r2-37rr",
4+
"modified": "2025-12-15T00:30:25Z",
5+
"published": "2025-12-15T00:30:25Z",
6+
"aliases": [
7+
"CVE-2025-13281"
8+
],
9+
"details": "A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13281"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/kubernetes/kubernetes/issues/135525"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://groups.google.com/g/kubernetes-security-announce/c/EORqZg0k1l4/m/TtD-q0v7AgAJ"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "http://www.openwall.com/lists/oss-security/2025/12/01/4"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-918"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-12-14T22:15:36Z"
43+
}
44+
}

‎advisories/unreviewed/2025/12/GHSA-x37w-7p52-8f49/GHSA-x37w-7p52-8f49.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x37w-7p52-8f49",
4+
"modified": "2025-12-15T00:30:25Z",
5+
"published": "2025-12-15T00:30:25Z",
6+
"aliases": [
7+
"CVE-2025-14692"
8+
],
9+
"details": "A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 4.10.2 is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms that this is \"[f]ixed in version 4.10.2\". Furthermore, that \"[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete.\"",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14692"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://docs.mayan-edms.com/chapters/releases/4.10.2.html"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://docs.mayan-edms.com/chapters/releases/4.10.2.html#security"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://github.com/ionutluca888/Mayan-EDMS-OpenRedirect-POC/tree/main"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?ctiid.336410"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?id.336410"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://vuldb.com/?submit.711729"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-601"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2025-12-15T00:15:39Z"
59+
}
60+
}

0 commit comments

Comments
 (0)