Skip to content

Commit e9152ea

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6q37-7866-h27j GHSA-mq8m-42gh-wq7r GHSA-rg58-xhh7-mqjw GHSA-rg58-xhh7-mqjw
1 parent 6c34bbf commit e9152ea

File tree

4 files changed

+151
-49
lines changed

4 files changed

+151
-49
lines changed

advisories/unreviewed/2025/12/GHSA-6q37-7866-h27j/GHSA-6q37-7866-h27j.json renamed to advisories/github-reviewed/2025/12/GHSA-6q37-7866-h27j/GHSA-6q37-7866-h27j.json

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,69 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6q37-7866-h27j",
4-
"modified": "2025-12-10T09:30:25Z",
4+
"modified": "2025-12-10T17:21:00Z",
55
"published": "2025-12-10T09:30:24Z",
66
"aliases": [
77
"CVE-2025-14082"
88
],
9+
"summary": "Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions",
910
"details": "A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.keycloak:keycloak-services"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "26.4.7"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14082"
2142
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/keycloak/keycloak/commit/89a8cddfd669178565ae50989c49216a945d1371"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://access.redhat.com/security/cve/CVE-2025-14082"
2550
},
2651
{
2752
"type": "WEB",
2853
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419078"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/keycloak/keycloak"
2958
}
3059
],
3160
"database_specific": {
3261
"cwe_ids": [
3362
"CWE-284"
3463
],
3564
"severity": "LOW",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-12-10T17:21:00Z",
3867
"nvd_published_at": "2025-12-10T09:15:46Z"
3968
}
4069
}

advisories/unreviewed/2025/12/GHSA-mq8m-42gh-wq7r/GHSA-mq8m-42gh-wq7r.json renamed to advisories/github-reviewed/2025/12/GHSA-mq8m-42gh-wq7r/GHSA-mq8m-42gh-wq7r.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mq8m-42gh-wq7r",
4-
"modified": "2025-12-10T15:31:24Z",
4+
"modified": "2025-12-10T17:22:12Z",
55
"published": "2025-12-10T15:31:24Z",
66
"aliases": [
77
"CVE-2025-8110"
88
],
9+
"summary": "Gogs vulnerable to a bypass of CVE-2024-55947",
910
"details": "Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "gogs.io/gogs"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.13.3"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8110"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/gogs/gogs"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit"
@@ -29,8 +54,8 @@
2954
"CWE-22"
3055
],
3156
"severity": "HIGH",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-12-10T17:22:12Z",
3459
"nvd_published_at": "2025-12-10T14:16:19Z"
3560
}
3661
}

‎advisories/github-reviewed/2025/12/GHSA-rg58-xhh7-mqjw/GHSA-rg58-xhh7-mqjw.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rg58-xhh7-mqjw",
4+
"modified": "2025-12-10T17:21:39Z",
5+
"published": "2025-12-10T12:31:27Z",
6+
"aliases": [
7+
"CVE-2025-66675"
8+
],
9+
"summary": "Apache Struts has a Denial of Service vulnerability",
10+
"details": "Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.\n\nThis issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.\n\nUsers are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.struts:struts2-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.0.0"
29+
},
30+
{
31+
"fixed": "6.8.0"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.struts:struts2-core"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "7.0.0"
48+
},
49+
{
50+
"fixed": "7.1.1"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66675"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/apache/struts/commit/831568929cfba700f790f6ebe6e335f9f33fb468"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://cve.org/CVERecord?id=CVE-2025-64775"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://cwiki.apache.org/confluence/display/WW/S2-068"
73+
},
74+
{
75+
"type": "PACKAGE",
76+
"url": "https://github.com/apache/struts"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-459"
82+
],
83+
"severity": "HIGH",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2025-12-10T17:21:39Z",
86+
"nvd_published_at": "2025-12-10T10:16:02Z"
87+
}
88+
}

‎advisories/unreviewed/2025/12/GHSA-rg58-xhh7-mqjw/GHSA-rg58-xhh7-mqjw.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

0 commit comments

Comments
 (0)