Skip to content

Commit fa1e4e8

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3v3q-fq2w-23r5 GHSA-4wvq-85hg-6256 GHSA-6pxh-4m7f-85qj GHSA-fg22-jf8j-5mrr GHSA-g668-5fqc-6qj6 GHSA-hvh2-99r5-r38q GHSA-jr9h-pqhx-vmgq GHSA-mhfg-pwjv-5jjq GHSA-r7j2-9m2h-fq95 GHSA-v554-gp5g-23rq GHSA-vrjm-xv6p-hpjc GHSA-x6fh-7qmf-69xh
1 parent 5c001ea commit fa1e4e8

File tree

12 files changed

+480
-0
lines changed

12 files changed

+480
-0
lines changed

‎advisories/unreviewed/2025/10/GHSA-3v3q-fq2w-23r5/GHSA-3v3q-fq2w-23r5.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3v3q-fq2w-23r5",
4+
"modified": "2025-10-23T06:31:00Z",
5+
"published": "2025-10-23T06:30:59Z",
6+
"aliases": [
7+
"CVE-2025-47699"
8+
],
9+
"details": "Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. \n\nThis issue affects Command Centre Server:\n\n9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47699"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-47699"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-497"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-23T04:16:40Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-4wvq-85hg-6256/GHSA-4wvq-85hg-6256.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4wvq-85hg-6256",
4+
"modified": "2025-10-23T06:31:00Z",
5+
"published": "2025-10-23T06:31:00Z",
6+
"aliases": [
7+
"CVE-2025-54856"
8+
],
9+
"details": "Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with \"ContentType Management\" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54856"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN24333679"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://movabletype.org/news/2025/10/mt-880-released.html"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-10-23T05:15:32Z"
47+
}
48+
}

‎advisories/unreviewed/2025/10/GHSA-6pxh-4m7f-85qj/GHSA-6pxh-4m7f-85qj.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6pxh-4m7f-85qj",
4+
"modified": "2025-10-23T06:31:00Z",
5+
"published": "2025-10-23T06:30:59Z",
6+
"aliases": [
7+
"CVE-2025-48428"
8+
],
9+
"details": "Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site. \nThis issue affects Command Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48428"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-48428"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-312"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-23T04:16:40Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-fg22-jf8j-5mrr/GHSA-fg22-jf8j-5mrr.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fg22-jf8j-5mrr",
4+
"modified": "2025-10-23T06:30:59Z",
5+
"published": "2025-10-23T06:30:59Z",
6+
"aliases": [
7+
"CVE-2025-12104"
8+
],
9+
"details": "Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12104"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://azure-access.com/security-advisories"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-1104"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-23T04:15:52Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-g668-5fqc-6qj6/GHSA-g668-5fqc-6qj6.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g668-5fqc-6qj6",
4+
"modified": "2025-10-23T06:31:00Z",
5+
"published": "2025-10-23T06:31:00Z",
6+
"aliases": [
7+
"CVE-2025-61865"
8+
],
9+
"details": "NarSuS App registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61865"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN03295012"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.iodata.jp/support/information/2025/10_NarSuS_App"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-428"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-23T05:15:32Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-hvh2-99r5-r38q/GHSA-hvh2-99r5-r38q.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hvh2-99r5-r38q",
4+
"modified": "2025-10-23T06:30:59Z",
5+
"published": "2025-10-23T06:30:59Z",
6+
"aliases": [
7+
"CVE-2025-41402"
8+
],
9+
"details": "Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. \n\nThis issue affects Command Centre Server: \n\n 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41402"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-41402"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-602"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-23T04:16:40Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-jr9h-pqhx-vmgq/GHSA-jr9h-pqhx-vmgq.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jr9h-pqhx-vmgq",
4+
"modified": "2025-10-23T06:30:59Z",
5+
"published": "2025-10-23T06:30:59Z",
6+
"aliases": [
7+
"CVE-2025-35981"
8+
],
9+
"details": "Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. \n\nThis issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6).",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35981"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-35981"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-359"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-10-23T04:16:39Z"
35+
}
36+
}

‎advisories/unreviewed/2025/10/GHSA-mhfg-pwjv-5jjq/GHSA-mhfg-pwjv-5jjq.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mhfg-pwjv-5jjq",
4+
"modified": "2025-10-23T06:31:00Z",
5+
"published": "2025-10-23T06:31:00Z",
6+
"aliases": [
7+
"CVE-2025-54806"
8+
],
9+
"details": "GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54806"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://growi.co.jp/news/38"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://jvn.jp/en/jp/JVN46526244"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-10-23T05:15:32Z"
43+
}
44+
}

‎advisories/unreviewed/2025/10/GHSA-r7j2-9m2h-fq95/GHSA-r7j2-9m2h-fq95.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-r7j2-9m2h-fq95",
4+
"modified": "2025-10-23T06:31:00Z",
5+
"published": "2025-10-23T06:31:00Z",
6+
"aliases": [
7+
"CVE-2025-62813"
8+
],
9+
"details": "LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62813"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/lz4/lz4/pull/1593"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-158"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-10-23T04:17:26Z"
39+
}
40+
}

0 commit comments

Comments
 (0)