Skip to content

Commit cd44680

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent abfbb63 commit cd44680

File tree

29 files changed

+1045
-0
lines changed

29 files changed

+1045
-0
lines changed

‎advisories/unreviewed/2025/10/GHSA-27fv-rpgj-4c6m/GHSA-27fv-rpgj-4c6m.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27fv-rpgj-4c6m",
4+
"modified": "2025-10-30T00:31:03Z",
5+
"published": "2025-10-30T00:31:03Z",
6+
"aliases": [
7+
"CVE-2025-10930"
8+
],
9+
"details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10930"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.drupal.org/sa-contrib-2025-110"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-352"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2025-10-30T00:15:34Z"
30+
}
31+
}

‎advisories/unreviewed/2025/10/GHSA-27mc-9399-r9mx/GHSA-27mc-9399-r9mx.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27mc-9399-r9mx",
4+
"modified": "2025-10-30T00:31:03Z",
5+
"published": "2025-10-30T00:31:03Z",
6+
"aliases": [
7+
"CVE-2025-10928"
8+
],
9+
"details": "Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10928"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://www.drupal.org/sa-contrib-2025-108"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-307"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2025-10-30T00:15:34Z"
30+
}
31+
}

‎advisories/unreviewed/2025/10/GHSA-447v-2qg4-h8hc/GHSA-447v-2qg4-h8hc.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-447v-2qg4-h8hc",
4+
"modified": "2025-10-30T00:31:02Z",
5+
"published": "2025-10-30T00:31:02Z",
6+
"aliases": [
7+
"CVE-2025-47912"
8+
],
9+
"details": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47912"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://go.dev/cl/709857"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://go.dev/issue/75678"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://pkg.go.dev/vuln/GO-2025-4010"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2025-10-29T23:16:18Z"
40+
}
41+
}

‎advisories/unreviewed/2025/10/GHSA-47pv-wxrm-xq5g/GHSA-47pv-wxrm-xq5g.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-47pv-wxrm-xq5g",
4+
"modified": "2025-10-30T00:31:02Z",
5+
"published": "2025-10-30T00:31:02Z",
6+
"aliases": [
7+
"CVE-2025-54548"
8+
],
9+
"details": "On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54548"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-200"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-29T23:16:19Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-549x-5p4h-q5jp/GHSA-549x-5p4h-q5jp.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-549x-5p4h-q5jp",
4+
"modified": "2025-10-30T00:31:02Z",
5+
"published": "2025-10-30T00:31:02Z",
6+
"aliases": [
7+
"CVE-2025-61959"
8+
],
9+
"details": "Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode=\"Off\"', which could have facilitated reconnaissance by unauthenticated attackers.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61959"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vertikalsystems.com/en/products/pm/contact.php"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-209"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-29T22:15:40Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-7wwx-xj66-r44x/GHSA-7wwx-xj66-r44x.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7wwx-xj66-r44x",
4+
"modified": "2025-10-30T00:31:03Z",
5+
"published": "2025-10-30T00:31:03Z",
6+
"aliases": [
7+
"CVE-2025-58188"
8+
],
9+
"details": "Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58188"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://go.dev/cl/709853"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://go.dev/issue/75675"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://pkg.go.dev/vuln/GO-2025-4013"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2025-10-29T23:16:19Z"
40+
}
41+
}

‎advisories/unreviewed/2025/10/GHSA-8hw3-ghwv-crfh/GHSA-8hw3-ghwv-crfh.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8hw3-ghwv-crfh",
4+
"modified": "2025-10-30T00:31:04Z",
5+
"published": "2025-10-30T00:31:04Z",
6+
"aliases": [
7+
"CVE-2025-62257"
8+
],
9+
"details": "Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62257"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-307"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-30T00:15:34Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-9gcr-gp5f-jw27/GHSA-9gcr-gp5f-jw27.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9gcr-gp5f-jw27",
4+
"modified": "2025-10-30T00:31:02Z",
5+
"published": "2025-10-30T00:31:02Z",
6+
"aliases": [
7+
"CVE-2025-58183"
8+
],
9+
"details": "tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://go.dev/cl/709861"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://go.dev/issue/75677"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://pkg.go.dev/vuln/GO-2025-4014"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2025-10-29T23:16:19Z"
40+
}
41+
}

‎advisories/unreviewed/2025/10/GHSA-c4hj-8xp2-799f/GHSA-c4hj-8xp2-799f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c4hj-8xp2-799f",
4+
"modified": "2025-10-30T00:31:02Z",
5+
"published": "2025-10-30T00:31:02Z",
6+
"aliases": [
7+
"CVE-2025-54547"
8+
],
9+
"details": "On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54547"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-613"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-29T23:16:18Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-cxq7-xw9v-rcv3/GHSA-cxq7-xw9v-rcv3.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cxq7-xw9v-rcv3",
4+
"modified": "2025-10-30T00:31:03Z",
5+
"published": "2025-10-30T00:31:03Z",
6+
"aliases": [
7+
"CVE-2025-58189"
8+
],
9+
"details": "When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58189"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://go.dev/cl/707776"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://go.dev/issue/75652"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://pkg.go.dev/vuln/GO-2025-4008"
32+
}
33+
],
34+
"database_specific": {
35+
"cwe_ids": [],
36+
"severity": null,
37+
"github_reviewed": false,
38+
"github_reviewed_at": null,
39+
"nvd_published_at": "2025-10-29T23:16:19Z"
40+
}
41+
}

0 commit comments

Comments
 (0)