Skip to content

Commit f2965e9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2h5q-w7wv-63r9 GHSA-fc36-5gc3-jmhx GHSA-g9vf-m9qr-pwpw GHSA-h39j-jmch-w2w5 GHSA-h42r-cm34-m49j GHSA-r6gm-832c-gjj8 GHSA-wq4c-57mh-5f7g
1 parent f413463 commit f2965e9

File tree

7 files changed

+260
-0
lines changed

7 files changed

+260
-0
lines changed

‎advisories/unreviewed/2025/11/GHSA-2h5q-w7wv-63r9/GHSA-2h5q-w7wv-63r9.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2h5q-w7wv-63r9",
4+
"modified": "2025-11-19T12:30:21Z",
5+
"published": "2025-11-19T12:30:21Z",
6+
"aliases": [
7+
"CVE-2025-12472"
8+
],
9+
"details": "An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, leading to arbitrary command execution on the Looker instance.\n\n\n\nLooker-hosted and Self-hosted were found to be vulnerable.\nThis issue has already been mitigated for Looker-hosted instances. No user action is required for these.\n\n\nSelf-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.\nThe versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page https://download.looker.com/ :\n * 24.12.103+\n * 24.18.195+\n * 25.0.72+\n * 25.6.60+\n * 25.8.42+\n * 25.10.22+",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12472"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://cloud.google.com/support/bulletins#gcp-2025-052"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-362"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-19T11:15:44Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-fc36-5gc3-jmhx/GHSA-fc36-5gc3-jmhx.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fc36-5gc3-jmhx",
4+
"modified": "2025-11-19T12:30:20Z",
5+
"published": "2025-11-19T12:30:20Z",
6+
"aliases": [
7+
"CVE-2025-11230"
8+
],
9+
"details": "Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11230"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-407"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-19T10:15:45Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-g9vf-m9qr-pwpw/GHSA-g9vf-m9qr-pwpw.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g9vf-m9qr-pwpw",
4+
"modified": "2025-11-19T12:30:20Z",
5+
"published": "2025-11-19T12:30:20Z",
6+
"aliases": [
7+
"CVE-2025-58412"
8+
],
9+
"details": "A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58412"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-736"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-80"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-19T10:15:45Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-h39j-jmch-w2w5/GHSA-h39j-jmch-w2w5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h39j-jmch-w2w5",
4+
"modified": "2025-11-19T12:30:21Z",
5+
"published": "2025-11-19T12:30:21Z",
6+
"aliases": [
7+
"CVE-2025-10437"
8+
],
9+
"details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection.This issue affects Webpack Management System: through 20251119.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10437"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.usom.gov.tr/bildirim/tr-25-0401"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-11-19T12:15:47Z"
35+
}
36+
}

‎advisories/unreviewed/2025/11/GHSA-h42r-cm34-m49j/GHSA-h42r-cm34-m49j.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h42r-cm34-m49j",
4+
"modified": "2025-11-19T12:30:20Z",
5+
"published": "2025-11-19T12:30:20Z",
6+
"aliases": [
7+
"CVE-2025-0351"
8+
],
9+
"details": "Rejected reason: Voluntarily withdrawn",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0351"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-11-19T10:15:44Z"
24+
}
25+
}

‎advisories/unreviewed/2025/11/GHSA-r6gm-832c-gjj8/GHSA-r6gm-832c-gjj8.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r6gm-832c-gjj8",
4+
"modified": "2025-11-19T12:30:21Z",
5+
"published": "2025-11-19T12:30:21Z",
6+
"aliases": [
7+
"CVE-2025-13395"
8+
],
9+
"details": "A security flaw has been discovered in codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8. The impacted element is the function Login of the file /function.php. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13395"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/codehub666/94list/issues/63"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/codehub666/94list/issues/63#issue-3607918945"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.332923"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.332923"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.692095"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-11-19T11:15:47Z"
55+
}
56+
}

‎advisories/unreviewed/2025/11/GHSA-wq4c-57mh-5f7g/GHSA-wq4c-57mh-5f7g.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wq4c-57mh-5f7g",
4+
"modified": "2025-11-19T12:30:21Z",
5+
"published": "2025-11-19T12:30:21Z",
6+
"aliases": [
7+
"CVE-2025-64408"
8+
],
9+
"details": "Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. \n\nThis issue affects all current versions.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64408"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.openwall.com/lists/oss-security/2025/11/19/1"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [
28+
"CWE-502"
29+
],
30+
"severity": null,
31+
"github_reviewed": false,
32+
"github_reviewed_at": null,
33+
"nvd_published_at": "2025-11-19T11:15:47Z"
34+
}
35+
}

0 commit comments

Comments
 (0)