Skip to content

Commit d2af2b9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent ca33223 commit d2af2b9

File tree

94 files changed

+1258
-194
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

94 files changed

+1258
-194
lines changed

‎advisories/unreviewed/2024/03/GHSA-6pc8-76w2-c62h/GHSA-6pc8-76w2-c62h.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6pc8-76w2-c62h",
4-
"modified": "2024-03-08T18:30:30Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2024-03-08T18:30:30Z",
66
"aliases": [
77
"CVE-2023-34980"
88
],
9-
"details": "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 4.5.4.2627 build 20231225 and later\nQuTS hero h4.5.4.2626 build 20231225 and later\n",
9+
"details": "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 4.5.4.2627 build 20231225 and later\nQuTS hero h4.5.4.2626 build 20231225 and later",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2024/04/GHSA-p7j9-7qwr-c4hr/GHSA-p7j9-7qwr-c4hr.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-p7j9-7qwr-c4hr",
4-
"modified": "2024-04-26T15:30:33Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2024-04-26T15:30:33Z",
66
"aliases": [
77
"CVE-2023-51365"
88
],
9-
"details": "A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.4.2596 build 20231128 and later\nQTS 4.5.4.2627 build 20231225 and later\nQuTS hero h5.1.3.2578 build 20231110 and later\nQuTS hero h4.5.4.2626 build 20231225 and later\nQuTScloud c5.1.5.2651 and later\n\n",
9+
"details": "A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.4.2596 build 20231128 and later\nQTS 4.5.4.2627 build 20231225 and later\nQuTS hero h5.1.3.2578 build 20231110 and later\nQuTS hero h4.5.4.2626 build 20231225 and later\nQuTScloud c5.1.5.2651 and later",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2024/04/GHSA-pvq7-259f-j6f4/GHSA-pvq7-259f-j6f4.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pvq7-259f-j6f4",
4-
"modified": "2024-04-26T15:30:33Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2024-04-26T15:30:33Z",
66
"aliases": [
77
"CVE-2023-51364"
88
],
9-
"details": "A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.4.2596 build 20231128 and later\nQTS 4.5.4.2627 build 20231225 and later\nQuTS hero h5.1.3.2578 build 20231110 and later\nQuTS hero h4.5.4.2626 build 20231225 and later\nQuTScloud c5.1.5.2651 and later\n",
9+
"details": "A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.4.2596 build 20231128 and later\nQTS 4.5.4.2627 build 20231225 and later\nQuTS hero h5.1.3.2578 build 20231110 and later\nQuTS hero h4.5.4.2626 build 20231225 and later\nQuTScloud c5.1.5.2651 and later",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",

‎advisories/unreviewed/2024/12/GHSA-f4rv-5346-m4jx/GHSA-f4rv-5346-m4jx.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f4rv-5346-m4jx",
4-
"modified": "2024-12-06T18:30:46Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2024-12-06T18:30:46Z",
66
"aliases": [
77
"CVE-2024-50404"
88
],
99
"details": "A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.\n\nWe have already fixed the vulnerability in the following versions:\nQsync Central 4.4.0.16_20240819 ( 2024/08/19 ) and later",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/08/GHSA-fjh8-m5r5-9wrm/GHSA-fjh8-m5r5-9wrm.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fjh8-m5r5-9wrm",
4-
"modified": "2025-08-29T18:30:54Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2025-08-29T18:30:54Z",
66
"aliases": [
77
"CVE-2025-52856"
88
],
99
"details": "An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nVioStor 5.1.6 build 20250621 and later",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/10/GHSA-435v-f8gv-q7r4/GHSA-435v-f8gv-q7r4.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-435v-f8gv-q7r4",
4-
"modified": "2025-10-03T21:30:58Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2025-10-03T21:30:58Z",
66
"aliases": [
77
"CVE-2025-54154"
88
],
99
"details": "An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulnerability to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following version:\nQNAP Authenticator 1.3.1.1227 and later",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/10/GHSA-7jh2-8xqp-qc8p/GHSA-7jh2-8xqp-qc8p.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7jh2-8xqp-qc8p",
4-
"modified": "2025-10-01T09:30:25Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2025-10-01T09:30:25Z",
66
"aliases": [
77
"CVE-2025-39927"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix race condition validating r_parent before applying state\n\nAdd validation to ensure the cached parent directory inode matches the\ndirectory info in MDS replies. This prevents client-side race conditions\nwhere concurrent operations (e.g. rename) cause r_parent to become stale\nbetween request initiation and reply processing, which could lead to\napplying state changes to incorrect directory inodes.\n\n[ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to\n move CEPH_CAP_PIN reference when r_parent is updated:\n\n When the parent directory lock is not held, req->r_parent can become\n stale and is updated to point to the correct inode. However, the\n associated CEPH_CAP_PIN reference was not being adjusted. The\n CEPH_CAP_PIN is a reference on an inode that is tracked for\n accounting purposes. Moving this pin is important to keep the\n accounting balanced. When the pin was not moved from the old parent\n to the new one, it created two problems: The reference on the old,\n stale parent was never released, causing a reference leak.\n A reference for the new parent was never acquired, creating the risk\n of a reference underflow later in ceph_mdsc_release_request(). This\n patch corrects the logic by releasing the pin from the old parent and\n acquiring it for the new parent when r_parent is switched. This\n ensures reference accounting stays balanced. ]",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-362"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2025-10-01T08:15:36Z"

‎advisories/unreviewed/2025/10/GHSA-m43q-hvcx-4pxc/GHSA-m43q-hvcx-4pxc.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-m43q-hvcx-4pxc",
4-
"modified": "2025-10-01T09:30:25Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2025-10-01T09:30:25Z",
66
"aliases": [
77
"CVE-2025-39928"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: rtl9300: ensure data length is within supported range\n\nAdd an explicit check for the xfer length to 'rtl9300_i2c_config_xfer'\nto ensure the data length isn't within the supported range. In\nparticular a data length of 0 is not supported by the hardware and\ncauses unintended or destructive behaviour.\n\nThis limitation becomes obvious when looking at the register\ndocumentation [1]. 4 bits are reserved for DATA_WIDTH and the value\nof these 4 bits is used as N + 1, allowing a data length range of\n1 <= len <= 16.\n\nAffected by this is the SMBus Quick Operation which works with a data\nlength of 0. Passing 0 as the length causes an underflow of the value\ndue to:\n\n(len - 1) & 0xf\n\nand effectively specifying a transfer length of 16 via the registers.\nThis causes a 16-byte write operation instead of a Quick Write. For\nexample, on SFP modules without write-protected EEPROM this soft-bricks\nthem by overwriting some initial bytes.\n\nFor completeness, also add a quirk for the zero length.\n\n[1] https://svanheule.net/realtek/longan/register/i2c_mst1_ctrl2",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-191"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-10-01T08:15:36Z"

‎advisories/unreviewed/2025/11/GHSA-2cpf-j432-984q/GHSA-2cpf-j432-984q.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2cpf-j432-984q",
4-
"modified": "2025-11-26T21:31:26Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2025-11-26T21:31:26Z",
66
"aliases": [
77
"CVE-2025-6195"
@@ -23,6 +23,10 @@
2323
"type": "WEB",
2424
"url": "https://hackerone.com/reports/3155693"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://about.gitlab.com/releases/2025/11/26/patch-release-gitlab-18-6-1-released"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/549937"

‎advisories/unreviewed/2025/11/GHSA-2v4g-65gf-w58f/GHSA-2v4g-65gf-w58f.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2v4g-65gf-w58f",
4-
"modified": "2025-11-26T21:31:26Z",
4+
"modified": "2025-12-11T00:30:26Z",
55
"published": "2025-11-26T21:31:26Z",
66
"aliases": [
77
"CVE-2025-12653"
@@ -23,6 +23,10 @@
2323
"type": "WEB",
2424
"url": "https://hackerone.com/reports/3370245"
2525
},
26+
{
27+
"type": "WEB",
28+
"url": "https://about.gitlab.com/releases/2025/11/26/patch-release-gitlab-18-6-1-released"
29+
},
2630
{
2731
"type": "WEB",
2832
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/579372"

0 commit comments

Comments
 (0)