Publish Advisories

GHSA-36qw-697c-h8mq GHSA-6mmm-jmjg-qxjf GHSA-xrrr-c6cx-2756
2026-05-22 18:04:22 -07:00 · 2025-05-25 03:32:08 +00:00
parent e1696c0515
commit 16863aa995
3 changed files with 160 additions and 0 deletions
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-36qw-697c-h8mq",
+  "modified": "2025-05-25T03:30:30Z",
+  "published": "2025-05-25T03:30:30Z",
+  "aliases": [
+    "CVE-2025-5138"
+  ],
+  "details": "A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5138"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/YZS17/CVE/blob/main/PDF%20XSS%20vulnerability%20in%20file%20upload%20function%20of%20%20Bitwarden.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310219"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310219"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.572263"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-25T01:15:22Z"
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6mmm-jmjg-qxjf",
+  "modified": "2025-05-25T03:30:30Z",
+  "published": "2025-05-25T03:30:30Z",
+  "aliases": [
+    "CVE-2025-5139"
+  ],
+  "details": "A vulnerability was found in Qualitor 8.20. It has been rated as critical. Affected by this issue is some unknown functionality of the file /html/ad/adconexaooffice365/request/testaConexaoOffice365.php. The manipulation of the argument nmconexao leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5139"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.githubusercontent.com/MatheuZSecurity/fe221fd5b2e5393abf76be42f11f52c3/raw/e8d9c63885f0b83b3374db3d31dbe2c69c868334/poc.sh"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310220"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310220"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.572477"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.youtube.com/watch?v=Dq4C5s9Uwyo"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-25T01:15:23Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xrrr-c6cx-2756",
+  "modified": "2025-05-25T03:30:30Z",
+  "published": "2025-05-25T03:30:30Z",
+  "aliases": [
+    "CVE-2025-5140"
+  ],
+  "details": "A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2. This affects the function this.oursNetService.getData of the file com\\ours\\www\\ehr\\openPlatform1\\open4ClientType\\controller\\ThirdMenuController.class. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5140"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310221"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310221"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.574440"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wx.mail.qq.com/s?k=i0-p-2N4MHcFOeM00E"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-918"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-25T02:15:22Z"
+  }
+}