Skip to content

Commit db0a15e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2q7x-94rj-f68w GHSA-5gwr-vqfx-wj2m GHSA-8q8p-fv92-864w GHSA-fxp5-37mh-vff5 GHSA-vwhf-x6j3-3qfg GHSA-xc6x-xvx8-wqf4
1 parent 9e80d7b commit db0a15e

File tree

6 files changed

+232
-0
lines changed

6 files changed

+232
-0
lines changed

‎advisories/unreviewed/2025/12/GHSA-2q7x-94rj-f68w/GHSA-2q7x-94rj-f68w.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2q7x-94rj-f68w",
4+
"modified": "2025-12-03T09:31:12Z",
5+
"published": "2025-12-03T09:31:12Z",
6+
"aliases": [
7+
"CVE-2025-13945"
8+
],
9+
"details": "HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13945"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.com/wireshark/wireshark/-/issues/20860"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wireshark.org/security/wnpa-sec-2025-07.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-1325"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-03T08:15:47Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-5gwr-vqfx-wj2m/GHSA-5gwr-vqfx-wj2m.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5gwr-vqfx-wj2m",
4+
"modified": "2025-12-03T09:31:12Z",
5+
"published": "2025-12-03T09:31:12Z",
6+
"aliases": [
7+
"CVE-2025-13946"
8+
],
9+
"details": "MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13946"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://gitlab.com/wireshark/wireshark/-/issues/20884"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wireshark.org/security/wnpa-sec-2025-08.html"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-835"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-03T08:15:48Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-8q8p-fv92-864w/GHSA-8q8p-fv92-864w.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8q8p-fv92-864w",
4+
"modified": "2025-12-03T09:31:12Z",
5+
"published": "2025-12-03T09:31:12Z",
6+
"aliases": [
7+
"CVE-2025-13486"
8+
],
9+
"details": "The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13486"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/changeset/3400134/acf-extended"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c508cb73-53e6-4ebe-b3d0-285908b722c9?source=cve"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-94"
34+
],
35+
"severity": "CRITICAL",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-03T07:16:02Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-fxp5-37mh-vff5/GHSA-fxp5-37mh-vff5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fxp5-37mh-vff5",
4+
"modified": "2025-12-03T09:31:13Z",
5+
"published": "2025-12-03T09:31:13Z",
6+
"aliases": [
7+
"CVE-2025-13472"
8+
],
9+
"details": "A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13472"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://portal.perforce.com/s/cve/a91Qi000002bFgTIAU/missing-authorization-in-blazemeter-jenkins-plugin"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-03T09:15:47Z"
35+
}
36+
}

‎advisories/unreviewed/2025/12/GHSA-vwhf-x6j3-3qfg/GHSA-vwhf-x6j3-3qfg.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vwhf-x6j3-3qfg",
4+
"modified": "2025-12-03T09:31:13Z",
5+
"published": "2025-12-03T09:31:12Z",
6+
"aliases": [
7+
"CVE-2025-12744"
8+
],
9+
"details": "A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12744"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2025-12744"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2412467"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-78"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-12-03T09:15:46Z"
39+
}
40+
}

‎advisories/unreviewed/2025/12/GHSA-xc6x-xvx8-wqf4/GHSA-xc6x-xvx8-wqf4.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xc6x-xvx8-wqf4",
4+
"modified": "2025-12-03T09:31:13Z",
5+
"published": "2025-12-03T09:31:13Z",
6+
"aliases": [
7+
"CVE-2025-29864"
8+
],
9+
"details": "Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 before 12.29.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29864"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://altools.co.kr/product/ALZIP"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-693"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-12-03T09:15:47Z"
35+
}
36+
}

0 commit comments

Comments
 (0)