Skip to content

Commit d2cf2c6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-c3q2-jc4g-3q9g GHSA-46hf-65mw-6fg3 GHSA-9567-rh6q-rf53 GHSA-9jpw-f7gq-pv94 GHSA-frwr-8p82-qrjm GHSA-r4wh-whpg-rc2q
1 parent 1803278 commit d2cf2c6

File tree

6 files changed

+210
-1
lines changed

6 files changed

+210
-1
lines changed

‎advisories/unreviewed/2025/09/GHSA-c3q2-jc4g-3q9g/GHSA-c3q2-jc4g-3q9g.json‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-c3q2-jc4g-3q9g",
4-
"modified": "2025-09-04T21:31:39Z",
4+
"modified": "2025-11-18T06:30:25Z",
55
"published": "2025-09-04T21:31:38Z",
66
"aliases": [
77
"CVE-2025-48581"
@@ -19,9 +19,25 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48581"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://android.googlesource.com/platform/build/+/cda08bfbf55aed1e4c79efe6a66bb930d19a8a13"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://android.googlesource.com/platform/system/apex/+/13bbfe3ef2953e9805d57d3219cc122e485ba90f"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://android.googlesource.com/platform/system/apex/+/5a33fa4202cb5f06d7f02f3a2b8d13780d7cb3f5"
33+
},
2234
{
2335
"type": "WEB",
2436
"url": "https://source.android.com/security/bulletin/2025-09-01"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://source.android.com/security/bulletin/2025-11-01"
2541
}
2642
],
2743
"database_specific": {

‎advisories/unreviewed/2025/11/GHSA-46hf-65mw-6fg3/GHSA-46hf-65mw-6fg3.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-46hf-65mw-6fg3",
4+
"modified": "2025-11-18T06:30:25Z",
5+
"published": "2025-11-18T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-52457"
8+
],
9+
"details": "Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. \n\nThis issue affects Command Centre Server:\n\n9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52457"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-208"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-18T04:15:44Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-9567-rh6q-rf53/GHSA-9567-rh6q-rf53.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9567-rh6q-rf53",
4+
"modified": "2025-11-18T06:30:25Z",
5+
"published": "2025-11-18T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-52578"
8+
],
9+
"details": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications.\n\nThis issue affects Command Centre Server: \n\n9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52578"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52578"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-335"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-18T04:15:44Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-9jpw-f7gq-pv94/GHSA-9jpw-f7gq-pv94.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9jpw-f7gq-pv94",
4+
"modified": "2025-11-18T06:30:25Z",
5+
"published": "2025-11-18T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-12974"
8+
],
9+
"details": "The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through the chunked upload mechanism. This makes it possible for unauthenticated attackers to upload executable .phar files and achieve remote code execution on the server, granted they can discover or enumerate the upload path. In order for an attacker to achieve RCE, the web server needs to be set up to process .phar file as PHP via file handler mapping or similar.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12974"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://docs.gravityforms.com/gravityforms-change-log"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/common/common.php#L4178"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/includes/upload.php#L97"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6395439-da45-4b64-8e30-b106dffd46c1?source=cve"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-434"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-11-18T04:15:43Z"
47+
}
48+
}

‎advisories/unreviewed/2025/11/GHSA-frwr-8p82-qrjm/GHSA-frwr-8p82-qrjm.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-frwr-8p82-qrjm",
4+
"modified": "2025-11-18T06:30:25Z",
5+
"published": "2025-11-18T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-48593"
8+
],
9+
"details": "In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48593"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5ed63461b44198c80d5aff7e1af1df812f782abb"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c69c78d7c4f623201f35831d32e6c401156e76cc"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://source.android.com/security/bulletin/2025-11-01"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2025-11-18T05:16:10Z"
36+
}
37+
}

‎advisories/unreviewed/2025/11/GHSA-r4wh-whpg-rc2q/GHSA-r4wh-whpg-rc2q.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r4wh-whpg-rc2q",
4+
"modified": "2025-11-18T06:30:25Z",
5+
"published": "2025-11-18T06:30:25Z",
6+
"aliases": [
7+
"CVE-2025-64734"
8+
],
9+
"details": "Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack against that specific reader, preventing cardholders from badging for entry. \n\nThis issue affects Command Centre Server: \n\n9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)),  all versions of 9.00 and prior.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64734"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-64734"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-772"
30+
],
31+
"severity": "LOW",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-18T04:15:44Z"
35+
}
36+
}

0 commit comments

Comments
 (0)