Skip to content

Commit f0bfb83

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-28jp-44vh-q42h GHSA-24hm-wm2h-h8w7 GHSA-3x39-62h4-f8j6 GHSA-4g87-9x45-cx2h GHSA-5p82-2q3r-wj3m GHSA-mp6x-97xj-9x62 GHSA-3x39-62h4-f8j6 GHSA-4g87-9x45-cx2h GHSA-mp6x-97xj-9x62
1 parent bd01c9e commit f0bfb83

File tree

9 files changed

+545
-118
lines changed

9 files changed

+545
-118
lines changed

‎advisories/github-reviewed/2025/10/GHSA-28jp-44vh-q42h/GHSA-28jp-44vh-q42h.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-28jp-44vh-q42h",
4-
"modified": "2025-10-31T17:39:47Z",
4+
"modified": "2025-12-01T23:58:20Z",
55
"published": "2025-10-30T18:31:10Z",
66
"aliases": [
77
"CVE-2025-12060"
@@ -55,6 +55,10 @@
5555
{
5656
"type": "PACKAGE",
5757
"url": "https://github.com/keras-team/keras"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://huntr.com/bounties/f94f5beb-54d8-4e6a-8bac-86d9aee103f4"
5862
}
5963
],
6064
"database_specific": {

advisories/unreviewed/2025/11/GHSA-24hm-wm2h-h8w7/GHSA-24hm-wm2h-h8w7.json renamed to advisories/github-reviewed/2025/11/GHSA-24hm-wm2h-h8w7/GHSA-24hm-wm2h-h8w7.json

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-24hm-wm2h-h8w7",
4-
"modified": "2025-11-28T06:32:06Z",
4+
"modified": "2025-12-01T23:57:53Z",
55
"published": "2025-11-28T06:32:06Z",
66
"aliases": [
77
"CVE-2025-66371"
88
],
9+
"summary": "Peppol-py is vulnerable to XXE attacks due to Saxon configuration",
910
"details": "Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "peppol_py"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.1.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,14 @@
2344
"type": "WEB",
2445
"url": "https://github.com/iterasdev/peppol-py/pull/16"
2546
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da0477abd7"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/iterasdev/peppol-py"
54+
},
2655
{
2756
"type": "WEB",
2857
"url": "https://github.com/iterasdev/peppol-py/releases/tag/1.1.1"
@@ -33,8 +62,8 @@
3362
"CWE-611"
3463
],
3564
"severity": "MODERATE",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-12-01T23:57:53Z",
3867
"nvd_published_at": "2025-11-28T04:16:01Z"
3968
}
4069
}

‎advisories/github-reviewed/2025/11/GHSA-3x39-62h4-f8j6/GHSA-3x39-62h4-f8j6.json‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3x39-62h4-f8j6",
4+
"modified": "2025-12-01T23:56:56Z",
5+
"published": "2025-11-27T18:30:25Z",
6+
"aliases": [
7+
"CVE-2025-12419"
8+
],
9+
"summary": "Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication",
10+
"details": "Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost/server/v8"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "8.0.0-20251028000919-d3ed703dc833"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/mattermost/mattermost-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "10.12.0"
48+
},
49+
{
50+
"fixed": "10.12.2"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/mattermost/mattermost-server"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "10.11.0"
67+
},
68+
{
69+
"fixed": "10.11.5"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Go",
78+
"name": "github.com/mattermost/mattermost-server"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "10.5.0"
86+
},
87+
{
88+
"fixed": "10.5.13"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "Go",
97+
"name": "github.com/mattermost/mattermost-server"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "11.0.0"
105+
},
106+
{
107+
"fixed": "11.0.4"
108+
}
109+
]
110+
}
111+
]
112+
}
113+
],
114+
"references": [
115+
{
116+
"type": "ADVISORY",
117+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12419"
118+
},
119+
{
120+
"type": "WEB",
121+
"url": "https://github.com/mattermost/mattermost/pull/34296"
122+
},
123+
{
124+
"type": "WEB",
125+
"url": "https://github.com/mattermost/mattermost/commit/15364790cc277cfaa372693d2d5442b87f70fd42"
126+
},
127+
{
128+
"type": "WEB",
129+
"url": "https://github.com/mattermost/mattermost/commit/364c2203de00fe0d8424b6b46d6f0eeb02a2539a"
130+
},
131+
{
132+
"type": "WEB",
133+
"url": "https://github.com/mattermost/mattermost/commit/46b5c436bb3093cc1da3fa2455f93d4c52389eee"
134+
},
135+
{
136+
"type": "WEB",
137+
"url": "https://github.com/mattermost/mattermost/commit/c3f4818afe46a7084740e809708ae22641c76d8d"
138+
},
139+
{
140+
"type": "WEB",
141+
"url": "https://github.com/mattermost/mattermost/commit/d3ed703dc8330684952eb8d49a375bac6ea7b0c6"
142+
},
143+
{
144+
"type": "PACKAGE",
145+
"url": "https://github.com/mattermost/mattermost"
146+
},
147+
{
148+
"type": "WEB",
149+
"url": "https://mattermost.com/security-updates"
150+
}
151+
],
152+
"database_specific": {
153+
"cwe_ids": [
154+
"CWE-287",
155+
"CWE-303"
156+
],
157+
"severity": "CRITICAL",
158+
"github_reviewed": true,
159+
"github_reviewed_at": "2025-12-01T23:56:55Z",
160+
"nvd_published_at": "2025-11-27T16:15:46Z"
161+
}
162+
}

0 commit comments

Comments
 (0)