Skip to content

Commit ce39579

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 59c96ed commit ce39579

File tree

30 files changed

+906
-6
lines changed

30 files changed

+906
-6
lines changed

‎advisories/unreviewed/2022/02/GHSA-95v7-jv4x-23ww/GHSA-95v7-jv4x-23ww.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-95v7-jv4x-23ww",
4-
"modified": "2022-02-11T00:01:16Z",
4+
"modified": "2025-10-31T12:30:20Z",
55
"published": "2022-02-11T00:01:16Z",
66
"aliases": [
77
"CVE-2022-22939"
88
],
99
"details": "VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{

‎advisories/unreviewed/2022/05/GHSA-f537-rwg7-cjw7/GHSA-f537-rwg7-cjw7.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f537-rwg7-cjw7",
4-
"modified": "2022-05-24T17:34:41Z",
4+
"modified": "2025-10-31T12:30:19Z",
55
"published": "2022-05-24T17:34:41Z",
66
"aliases": [
77
"CVE-2020-4005"
88
],
99
"details": "VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when chained with another vulnerability (e.g. CVE-2020-4004)",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{

‎advisories/unreviewed/2022/05/GHSA-xqvv-5qpx-cjj8/GHSA-xqvv-5qpx-cjj8.json‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xqvv-5qpx-cjj8",
4-
"modified": "2022-05-24T17:34:41Z",
4+
"modified": "2025-10-31T12:30:19Z",
55
"published": "2022-05-24T17:34:41Z",
66
"aliases": [
77
"CVE-2020-4004"
88
],
99
"details": "VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{

‎advisories/unreviewed/2025/10/GHSA-38qg-7h9q-7h29/GHSA-38qg-7h9q-7h29.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-38qg-7h9q-7h29",
4+
"modified": "2025-10-31T12:30:21Z",
5+
"published": "2025-10-31T12:30:21Z",
6+
"aliases": [
7+
"CVE-2025-58149"
8+
],
9+
"details": "When passing through PCI devices, the detach logic in libxl won't remove\naccess permissions to any 64bit memory BARs the device might have. As a\nresult a domain can still have access any 64bit memory BAR when such\ndevice is no longer assigned to the domain.\n\nFor PV domains the permission leak allows the domain itself to map the memory\nin the page-tables. For HVM it would require a compromised device model or\nstubdomain to map the leaked memory into the HVM domain p2m.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58149"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://xenbits.xenproject.org/xsa/advisory-476.html"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-10-31T12:15:35Z"
28+
}
29+
}

‎advisories/unreviewed/2025/10/GHSA-5869-fm6w-9qxm/GHSA-5869-fm6w-9qxm.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5869-fm6w-9qxm",
4+
"modified": "2025-10-31T12:30:23Z",
5+
"published": "2025-10-31T12:30:23Z",
6+
"aliases": [
7+
"CVE-2025-64362"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen K Elements k-elements allows DOM-Based XSS.This issue affects K Elements: from n/a through < 5.5.0.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64362"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/k-elements/vulnerability/wordpress-k-elements-plugin-5-5-0-cross-site-scripting-xss-vulnerability"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-79"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2025-10-31T12:15:36Z"
30+
}
31+
}

‎advisories/unreviewed/2025/10/GHSA-5mv8-q8gm-mq6x/GHSA-5mv8-q8gm-mq6x.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5mv8-q8gm-mq6x",
4+
"modified": "2025-10-31T12:30:21Z",
5+
"published": "2025-10-31T12:30:21Z",
6+
"aliases": [
7+
"CVE-2025-64351"
8+
],
9+
"details": "Insertion of Sensitive Information Into Sent Data vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Retrieve Embedded Sensitive Data.This issue affects Rank Math SEO: from n/a through <= 1.0.252.1.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64351"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/seo-by-rank-math/vulnerability/wordpress-rank-math-seo-plugin-1-0-252-1-sensitive-data-exposure-vulnerability"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-201"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2025-10-31T12:15:35Z"
30+
}
31+
}

‎advisories/unreviewed/2025/10/GHSA-63x7-86mp-j45m/GHSA-63x7-86mp-j45m.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-63x7-86mp-j45m",
4+
"modified": "2025-10-31T12:30:23Z",
5+
"published": "2025-10-31T12:30:23Z",
6+
"aliases": [
7+
"CVE-2025-64363"
8+
],
9+
"details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeventhQueen Kleo kleo allows PHP Local File Inclusion.This issue affects Kleo: from n/a through < 5.5.0.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64363"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://vdp.patchstack.com/database/Wordpress/Theme/kleo/vulnerability/wordpress-kleo-theme-5-5-0-local-file-inclusion-vulnerability"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-98"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2025-10-31T12:15:36Z"
30+
}
31+
}

‎advisories/unreviewed/2025/10/GHSA-64c5-3xxf-ccjp/GHSA-64c5-3xxf-ccjp.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-64c5-3xxf-ccjp",
4+
"modified": "2025-10-31T12:30:21Z",
5+
"published": "2025-10-31T12:30:21Z",
6+
"aliases": [
7+
"CVE-2025-58147"
8+
],
9+
"details": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\none of three formats. Xen has boundary checking bugs with all three\nformats, which can cause out-of-bounds reads and writes while processing\nthe inputs.\n\n * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can\n cause vpmask_set() to write out of bounds when converting the bitmap\n to Xen's format.\n\n * CVE-2025-58148. Hypercalls using any input format can cause\n send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild\n vCPU pointer.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58147"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://xenbits.xenproject.org/xsa/advisory-475.html"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-10-31T12:15:34Z"
28+
}
29+
}

‎advisories/unreviewed/2025/10/GHSA-6h7h-qg92-xfgr/GHSA-6h7h-qg92-xfgr.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6h7h-qg92-xfgr",
4+
"modified": "2025-10-31T12:30:21Z",
5+
"published": "2025-10-31T12:30:21Z",
6+
"aliases": [
7+
"CVE-2025-64350"
8+
],
9+
"details": "Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through <= 1.0.252.1.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64350"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/seo-by-rank-math/vulnerability/wordpress-rank-math-seo-plugin-1-0-252-1-broken-access-control-vulnerability"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-862"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2025-10-31T12:15:35Z"
30+
}
31+
}

‎advisories/unreviewed/2025/10/GHSA-6hvg-fq9h-5pm6/GHSA-6hvg-fq9h-5pm6.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6hvg-fq9h-5pm6",
4+
"modified": "2025-10-31T12:30:21Z",
5+
"published": "2025-10-31T12:30:21Z",
6+
"aliases": [
7+
"CVE-2025-40106"
8+
],
9+
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: fix divide-by-zero in comedi_buf_munge()\n\nThe comedi_buf_munge() function performs a modulo operation\n`async->munge_chan %= async->cmd.chanlist_len` without first\nchecking if chanlist_len is zero. If a user program submits a command with\nchanlist_len set to zero, this causes a divide-by-zero error when the device\nprocesses data in the interrupt handler path.\n\nAdd a check for zero chanlist_len at the beginning of the\nfunction, similar to the existing checks for !map and\nCMDF_RAWDATA flag. When chanlist_len is zero, update\nmunge_count and return early, indicating the data was\nhandled without munging.\n\nThis prevents potential kernel panics from malformed user commands.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40106"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://git.kernel.org/stable/c/2670932f2465793fea1ef073e40883e8390fa4d9"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://git.kernel.org/stable/c/4ffea48c69cb2b96a281cb7e5e42d706996631db"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://git.kernel.org/stable/c/55520f65fd447e04099a2c44185453c18ea73b7e"
28+
},
29+
{
30+
"type": "WEB",
31+
"url": "https://git.kernel.org/stable/c/6db19822512396be1a3e1e20c16c97270285ba1a"
32+
},
33+
{
34+
"type": "WEB",
35+
"url": "https://git.kernel.org/stable/c/87b318ba81dda2ee7b603f4f6c55e78ec3e95974"
36+
},
37+
{
38+
"type": "WEB",
39+
"url": "https://git.kernel.org/stable/c/8f3e4cd9be4b47246ea73ce5e3e0fa2f57f0d10c"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://git.kernel.org/stable/c/a4bb5d1bc2f238461bcbe5303eb500466690bb2c"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://git.kernel.org/stable/c/d4854eff25efb06d0d84c13e7129bbdba4125f8c"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [],
52+
"severity": null,
53+
"github_reviewed": false,
54+
"github_reviewed_at": null,
55+
"nvd_published_at": "2025-10-31T10:15:50Z"
56+
}
57+
}

0 commit comments

Comments
 (0)