Skip to content

Commit e6c4ff3

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent e36b52b commit e6c4ff3

File tree

73 files changed

+2102
-335
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

73 files changed

+2102
-335
lines changed

‎advisories/github-reviewed/2025/11/GHSA-7p63-w6x9-6gr7/GHSA-7p63-w6x9-6gr7.json‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7p63-w6x9-6gr7",
4+
"modified": "2025-11-18T20:38:31Z",
5+
"published": "2025-11-18T18:32:51Z",
6+
"aliases": [
7+
"CVE-2025-12383"
8+
],
9+
"summary": "Eclipse Jersey has a Race Condition",
10+
"details": "In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.glassfish.jersey.core:jersey-client"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.46"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.glassfish.jersey.core:jersey-client"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "3.0.0-M1"
48+
},
49+
{
50+
"fixed": "3.0.17"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.glassfish.jersey.core:jersey-client"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "3.1.0-M1"
67+
},
68+
{
69+
"fixed": "3.1.10"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Maven",
78+
"name": "org.glassfish.jersey.core:jersey-client"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "4.0.0-M1"
86+
},
87+
{
88+
"fixed": "4.0.0-M2"
89+
}
90+
]
91+
}
92+
],
93+
"versions": [
94+
"4.0.0-M1"
95+
]
96+
}
97+
],
98+
"references": [
99+
{
100+
"type": "ADVISORY",
101+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12383"
102+
},
103+
{
104+
"type": "WEB",
105+
"url": "https://github.com/eclipse-ee4j/jersey/pull/5749"
106+
},
107+
{
108+
"type": "WEB",
109+
"url": "https://github.com/eclipse-ee4j/jersey/pull/5794"
110+
},
111+
{
112+
"type": "WEB",
113+
"url": "https://github.com/dtbaum/jerseyCveCandidate"
114+
},
115+
{
116+
"type": "PACKAGE",
117+
"url": "https://github.com/eclipse-ee4j/jersey"
118+
},
119+
{
120+
"type": "WEB",
121+
"url": "https://github.com/eclipse-ee4j/jersey/releases/tag/2.46"
122+
},
123+
{
124+
"type": "WEB",
125+
"url": "https://github.com/eclipse-ee4j/jersey/releases/tag/3.0.17"
126+
},
127+
{
128+
"type": "WEB",
129+
"url": "https://github.com/eclipse-ee4j/jersey/releases/tag/3.1.10"
130+
},
131+
{
132+
"type": "WEB",
133+
"url": "https://github.com/eclipse-ee4j/jersey/releases/tag/4.0.0-M2"
134+
},
135+
{
136+
"type": "WEB",
137+
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/74"
138+
},
139+
{
140+
"type": "WEB",
141+
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/253"
142+
}
143+
],
144+
"database_specific": {
145+
"cwe_ids": [
146+
"CWE-362"
147+
],
148+
"severity": "CRITICAL",
149+
"github_reviewed": true,
150+
"github_reviewed_at": "2025-11-18T20:38:31Z",
151+
"nvd_published_at": "2025-11-18T16:15:42Z"
152+
}
153+
}

‎advisories/github-reviewed/2025/11/GHSA-83v7-c2cf-p9c2/GHSA-83v7-c2cf-p9c2.json‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-83v7-c2cf-p9c2",
4+
"modified": "2025-11-18T21:39:05Z",
5+
"published": "2025-11-18T18:32:53Z",
6+
"aliases": [
7+
"CVE-2025-13080"
8+
],
9+
"summary": "Drupal core allows Forceful Browsing",
10+
"details": "Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "drupal/core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "8.0.0"
29+
},
30+
{
31+
"fixed": "10.4.9"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "drupal/core"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "10.5.0"
48+
},
49+
{
50+
"fixed": "10.5.6"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Packagist",
59+
"name": "drupal/core"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "11.0.0"
67+
},
68+
{
69+
"fixed": "11.1.9"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Packagist",
78+
"name": "drupal/core"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "11.2.0"
86+
},
87+
{
88+
"fixed": "11.2.8"
89+
}
90+
]
91+
}
92+
]
93+
}
94+
],
95+
"references": [
96+
{
97+
"type": "ADVISORY",
98+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13080"
99+
},
100+
{
101+
"type": "PACKAGE",
102+
"url": "https://github.com/drupal/core"
103+
},
104+
{
105+
"type": "WEB",
106+
"url": "https://www.drupal.org/sa-core-2025-005"
107+
}
108+
],
109+
"database_specific": {
110+
"cwe_ids": [
111+
"CWE-754"
112+
],
113+
"severity": "LOW",
114+
"github_reviewed": true,
115+
"github_reviewed_at": "2025-11-18T21:39:05Z",
116+
"nvd_published_at": "2025-11-18T17:15:58Z"
117+
}
118+
}

‎advisories/github-reviewed/2025/11/GHSA-9hh7-6558-qfp2/GHSA-9hh7-6558-qfp2.json‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9hh7-6558-qfp2",
4+
"modified": "2025-11-18T21:03:28Z",
5+
"published": "2025-11-18T18:32:52Z",
6+
"aliases": [
7+
"CVE-2025-55074"
8+
],
9+
"summary": "Mattermost allows other users to determine when users had read channels via channel member objects",
10+
"details": "Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "10.11.0"
29+
},
30+
{
31+
"fixed": "10.11.4"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/mattermost/mattermost-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "10.5.0"
48+
},
49+
{
50+
"fixed": "10.5.12"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/mattermost/mattermost/server/v8"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "8.0.0-20250905150616-ba86dfc5876b6"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "ADVISORY",
79+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55074"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/mattermost/mattermost/pull/33835"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/mattermost/mattermost/pull/33905"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/mattermost/mattermost/commit/98acefe911dd9de7edf47a7d825dd99f53141a52"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://github.com/mattermost/mattermost/commit/ba86dfc5876b354b9d3c20ff45c08ca6f8426149"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://github.com/mattermost/mattermost/commit/d72d437f1567ba0b639b6e4fd73bab06c51baab5"
100+
},
101+
{
102+
"type": "PACKAGE",
103+
"url": "https://github.com/mattermost/mattermost"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://mattermost.com/security-updates"
108+
}
109+
],
110+
"database_specific": {
111+
"cwe_ids": [
112+
"CWE-276"
113+
],
114+
"severity": "LOW",
115+
"github_reviewed": true,
116+
"github_reviewed_at": "2025-11-18T21:03:28Z",
117+
"nvd_published_at": "2025-11-18T16:15:44Z"
118+
}
119+
}

0 commit comments

Comments
 (0)