Skip to content

Commit be00087

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-xh5w-g8gq-r3v9 GHSA-3fjx-35vx-pq97 GHSA-rj3q-q9f3-gr2v GHSA-r6gx-fcg6-8hhj GHSA-269f-8844-8wj6 GHSA-7fj8-g5x7-m9v3 GHSA-f6mf-j487-747p GHSA-fw2m-wrv6-prrx GHSA-j77f-3hf7-7rvg GHSA-p9f8-2p87-2pq5 GHSA-q5wr-jxr7-gxfv GHSA-x4q2-5wx6-98m5
1 parent 1b91538 commit be00087

File tree

12 files changed

+290
-6
lines changed

12 files changed

+290
-6
lines changed

‎advisories/github-reviewed/2025/11/GHSA-xh5w-g8gq-r3v9/GHSA-xh5w-g8gq-r3v9.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xh5w-g8gq-r3v9",
4-
"modified": "2025-12-16T21:30:50Z",
4+
"modified": "2025-12-18T12:30:27Z",
55
"published": "2025-11-24T18:31:14Z",
66
"aliases": [
77
"CVE-2025-13609"
@@ -56,6 +56,10 @@
5656
"type": "WEB",
5757
"url": "https://access.redhat.com/errata/RHSA-2025:23210"
5858
},
59+
{
60+
"type": "WEB",
61+
"url": "https://access.redhat.com/errata/RHSA-2025:23628"
62+
},
5963
{
6064
"type": "WEB",
6165
"url": "https://access.redhat.com/security/cve/CVE-2025-13609"

‎advisories/unreviewed/2022/05/GHSA-3fjx-35vx-pq97/GHSA-3fjx-35vx-pq97.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3fjx-35vx-pq97",
4-
"modified": "2022-05-14T00:55:55Z",
4+
"modified": "2025-12-18T12:30:27Z",
55
"published": "2022-05-14T00:55:55Z",
66
"aliases": [
77
"CVE-2019-3859"
@@ -35,6 +35,14 @@
3535
"type": "WEB",
3636
"url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html"
3737
},
38+
{
39+
"type": "WEB",
40+
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO"
45+
},
3846
{
3947
"type": "WEB",
4048
"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O"

‎advisories/unreviewed/2022/05/GHSA-rj3q-q9f3-gr2v/GHSA-rj3q-q9f3-gr2v.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rj3q-q9f3-gr2v",
4-
"modified": "2022-05-14T01:28:01Z",
4+
"modified": "2025-12-18T12:30:27Z",
55
"published": "2022-05-14T01:28:01Z",
66
"aliases": [
77
"CVE-2018-15919"

‎advisories/unreviewed/2025/11/GHSA-r6gx-fcg6-8hhj/GHSA-r6gx-fcg6-8hhj.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-r6gx-fcg6-8hhj",
4-
"modified": "2025-12-17T15:34:51Z",
4+
"modified": "2025-12-18T12:30:27Z",
55
"published": "2025-11-25T09:31:24Z",
66
"aliases": [
77
"CVE-2025-13502"
@@ -47,6 +47,14 @@
4747
"type": "WEB",
4848
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
4949
},
50+
{
51+
"type": "WEB",
52+
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
57+
},
5058
{
5159
"type": "WEB",
5260
"url": "https://access.redhat.com/security/cve/CVE-2025-13502"

‎advisories/unreviewed/2025/12/GHSA-269f-8844-8wj6/GHSA-269f-8844-8wj6.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-269f-8844-8wj6",
4+
"modified": "2025-12-18T12:30:27Z",
5+
"published": "2025-12-18T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-14364"
8+
],
9+
"details": "The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full site reset, dropping all database tables except users/usermeta and re-running wp_install(), which also assigns the Administrator role to the attacking subscriber account.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14364"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3420645/demo-importer-plus/trunk/inc/Ajax.php"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff9364a9-18f8-47d3-b992-e39c8d99d6ea?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-862"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-18T10:16:11Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-7fj8-g5x7-m9v3/GHSA-7fj8-g5x7-m9v3.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7fj8-g5x7-m9v3",
4+
"modified": "2025-12-18T12:30:27Z",
5+
"published": "2025-12-18T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-10910"
8+
],
9+
"details": "A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account.\nThe server‑side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client‑computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\n\nThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud‑connected devices. The vendor is not able to provide a list of affected products, but rolls out a firmware and server-side fixes. Devices that reached end‑of‑life for security support need replacement with newer models supporting updates.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10910"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cert.pl/en/posts/2025/12/CVE-2025-10910"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-639"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-18T12:16:07Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-f6mf-j487-747p/GHSA-f6mf-j487-747p.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f6mf-j487-747p",
4-
"modified": "2025-12-17T15:34:51Z",
4+
"modified": "2025-12-18T12:30:27Z",
55
"published": "2025-12-04T18:30:53Z",
66
"aliases": [
77
"CVE-2025-66287"
@@ -47,6 +47,14 @@
4747
"type": "WEB",
4848
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
4949
},
50+
{
51+
"type": "WEB",
52+
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
57+
},
5058
{
5159
"type": "WEB",
5260
"url": "https://access.redhat.com/security/cve/CVE-2025-66287"

‎advisories/unreviewed/2025/12/GHSA-fw2m-wrv6-prrx/GHSA-fw2m-wrv6-prrx.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fw2m-wrv6-prrx",
4+
"modified": "2025-12-18T12:30:27Z",
5+
"published": "2025-12-18T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-13730"
8+
],
9+
"details": "The OpenID Connect Generic Client plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'openid_connect_generic_auth_url' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13730"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/daggerhart-openid-connect-generic/trunk/includes/openid-connect-generic-client-wrapper.php#L241"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/daggerhart-openid-connect-generic/trunk/openid-connect-generic.php#L168"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3418927"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fe5fd453-b1fc-4d52-bb46-aebd68508891?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-12-18T10:16:11Z"
47+
}
48+
}

‎advisories/unreviewed/2025/12/GHSA-j77f-3hf7-7rvg/GHSA-j77f-3hf7-7rvg.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j77f-3hf7-7rvg",
4-
"modified": "2025-12-17T15:34:51Z",
4+
"modified": "2025-12-18T12:30:27Z",
55
"published": "2025-12-03T12:30:14Z",
66
"aliases": [
77
"CVE-2025-13947"
@@ -47,6 +47,14 @@
4747
"type": "WEB",
4848
"url": "https://access.redhat.com/errata/RHSA-2025:23452"
4949
},
50+
{
51+
"type": "WEB",
52+
"url": "https://access.redhat.com/errata/RHSA-2025:23583"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://access.redhat.com/errata/RHSA-2025:23591"
57+
},
5058
{
5159
"type": "WEB",
5260
"url": "https://access.redhat.com/security/cve/CVE-2025-13947"

‎advisories/unreviewed/2025/12/GHSA-p9f8-2p87-2pq5/GHSA-p9f8-2p87-2pq5.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p9f8-2p87-2pq5",
4+
"modified": "2025-12-18T12:30:27Z",
5+
"published": "2025-12-18T12:30:27Z",
6+
"aliases": [
7+
"CVE-2025-40602"
8+
],
9+
"details": "A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40602"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40602"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-250"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-18T11:15:46Z"
39+
}
40+
}

0 commit comments

Comments
 (0)