From 3fb87ed10d58b6eb5fe4cfdee61cfa5e64e95f50 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 13 May 2025 06:31:49 +0000 Subject: [PATCH] Publish Advisories GHSA-2r69-79fj-p7wm GHSA-5j75-c795-3gj8 GHSA-6gcv-j9fh-mcvr GHSA-6hh2-gf7j-rr53 GHSA-7p5g-33rr-j8rp GHSA-cmww-723f-496g GHSA-f42p-pxc9-254g GHSA-g6vf-vqr8-r8hg GHSA-jr24-26mj-cvxg GHSA-m7xr-5pwr-wf2f GHSA-mqmq-2p8r-q32f GHSA-pc76-c4h2-349r --- .../GHSA-2r69-79fj-p7wm.json | 34 ++++++++++++ .../GHSA-5j75-c795-3gj8.json | 25 +++++++++ .../GHSA-6gcv-j9fh-mcvr.json | 25 +++++++++ .../GHSA-6hh2-gf7j-rr53.json | 25 +++++++++ .../GHSA-7p5g-33rr-j8rp.json | 25 +++++++++ .../GHSA-cmww-723f-496g.json | 36 +++++++++++++ .../GHSA-f42p-pxc9-254g.json | 34 ++++++++++++ .../GHSA-g6vf-vqr8-r8hg.json | 52 +++++++++++++++++++ .../GHSA-jr24-26mj-cvxg.json | 25 +++++++++ .../GHSA-m7xr-5pwr-wf2f.json | 25 +++++++++ .../GHSA-mqmq-2p8r-q32f.json | 6 ++- .../GHSA-pc76-c4h2-349r.json | 25 +++++++++ 12 files changed, 336 insertions(+), 1 deletion(-) create mode 100644 advisories/unreviewed/2025/05/GHSA-2r69-79fj-p7wm/GHSA-2r69-79fj-p7wm.json create mode 100644 advisories/unreviewed/2025/05/GHSA-5j75-c795-3gj8/GHSA-5j75-c795-3gj8.json create mode 100644 advisories/unreviewed/2025/05/GHSA-6gcv-j9fh-mcvr/GHSA-6gcv-j9fh-mcvr.json create mode 100644 advisories/unreviewed/2025/05/GHSA-6hh2-gf7j-rr53/GHSA-6hh2-gf7j-rr53.json create mode 100644 advisories/unreviewed/2025/05/GHSA-7p5g-33rr-j8rp/GHSA-7p5g-33rr-j8rp.json create mode 100644 advisories/unreviewed/2025/05/GHSA-cmww-723f-496g/GHSA-cmww-723f-496g.json create mode 100644 advisories/unreviewed/2025/05/GHSA-f42p-pxc9-254g/GHSA-f42p-pxc9-254g.json create mode 100644 advisories/unreviewed/2025/05/GHSA-g6vf-vqr8-r8hg/GHSA-g6vf-vqr8-r8hg.json create mode 100644 advisories/unreviewed/2025/05/GHSA-jr24-26mj-cvxg/GHSA-jr24-26mj-cvxg.json create mode 100644 advisories/unreviewed/2025/05/GHSA-m7xr-5pwr-wf2f/GHSA-m7xr-5pwr-wf2f.json create mode 100644 advisories/unreviewed/2025/05/GHSA-pc76-c4h2-349r/GHSA-pc76-c4h2-349r.json diff --git a/advisories/unreviewed/2025/05/GHSA-2r69-79fj-p7wm/GHSA-2r69-79fj-p7wm.json b/advisories/unreviewed/2025/05/GHSA-2r69-79fj-p7wm/GHSA-2r69-79fj-p7wm.json new file mode 100644 index 00000000000..c74a95a9960 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-2r69-79fj-p7wm/GHSA-2r69-79fj-p7wm.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2r69-79fj-p7wm", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-22249" + ], + "details": "VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious crafted payload URL.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22249" + }, + { + "type": "WEB", + "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25711" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T06:15:36Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-5j75-c795-3gj8/GHSA-5j75-c795-3gj8.json b/advisories/unreviewed/2025/05/GHSA-5j75-c795-3gj8/GHSA-5j75-c795-3gj8.json new file mode 100644 index 00000000000..15fb20c9870 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-5j75-c795-3gj8/GHSA-5j75-c795-3gj8.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5j75-c795-3gj8", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-47860" + ], + "details": "Rejected reason: Not used", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47860" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T04:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-6gcv-j9fh-mcvr/GHSA-6gcv-j9fh-mcvr.json b/advisories/unreviewed/2025/05/GHSA-6gcv-j9fh-mcvr/GHSA-6gcv-j9fh-mcvr.json new file mode 100644 index 00000000000..ae0c0effb88 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-6gcv-j9fh-mcvr/GHSA-6gcv-j9fh-mcvr.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6gcv-j9fh-mcvr", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-47858" + ], + "details": "Rejected reason: Not used", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47858" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T04:16:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-6hh2-gf7j-rr53/GHSA-6hh2-gf7j-rr53.json b/advisories/unreviewed/2025/05/GHSA-6hh2-gf7j-rr53/GHSA-6hh2-gf7j-rr53.json new file mode 100644 index 00000000000..ea345f081fb --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-6hh2-gf7j-rr53/GHSA-6hh2-gf7j-rr53.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6hh2-gf7j-rr53", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-47862" + ], + "details": "Rejected reason: Not used", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47862" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T04:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-7p5g-33rr-j8rp/GHSA-7p5g-33rr-j8rp.json b/advisories/unreviewed/2025/05/GHSA-7p5g-33rr-j8rp/GHSA-7p5g-33rr-j8rp.json new file mode 100644 index 00000000000..58443065b83 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-7p5g-33rr-j8rp/GHSA-7p5g-33rr-j8rp.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7p5g-33rr-j8rp", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-47864" + ], + "details": "Rejected reason: Not used", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47864" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T04:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-cmww-723f-496g/GHSA-cmww-723f-496g.json b/advisories/unreviewed/2025/05/GHSA-cmww-723f-496g/GHSA-cmww-723f-496g.json new file mode 100644 index 00000000000..a118d5c9058 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-cmww-723f-496g/GHSA-cmww-723f-496g.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cmww-723f-496g", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-4632" + ], + "details": "Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4632" + }, + { + "type": "WEB", + "url": "https://security.samsungtv.com/securityUpdates#SVP-MAY-2025" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T06:15:36Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-f42p-pxc9-254g/GHSA-f42p-pxc9-254g.json b/advisories/unreviewed/2025/05/GHSA-f42p-pxc9-254g/GHSA-f42p-pxc9-254g.json new file mode 100644 index 00000000000..6f566a026b2 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-f42p-pxc9-254g/GHSA-f42p-pxc9-254g.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f42p-pxc9-254g", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-22246" + ], + "details": "Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22246" + }, + { + "type": "WEB", + "url": "https://www.cloudfoundry.org/blog/cve-2025-22246-uaa-private-key-exposure" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T06:15:35Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-g6vf-vqr8-r8hg/GHSA-g6vf-vqr8-r8hg.json b/advisories/unreviewed/2025/05/GHSA-g6vf-vqr8-r8hg/GHSA-g6vf-vqr8-r8hg.json new file mode 100644 index 00000000000..2074a349c6f --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-g6vf-vqr8-r8hg/GHSA-g6vf-vqr8-r8hg.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g6vf-vqr8-r8hg", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-4396" + ], + "details": "The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and <= 2.27.4 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4396" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.4/lib/search-tax-query.php#L371" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.4/lib/search-tax-query.php#L409" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.4/lib/search.php#L1016" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.4/lib/search.php#L982" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/197be163-4504-4caa-b729-c3293463cfb5?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T04:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-jr24-26mj-cvxg/GHSA-jr24-26mj-cvxg.json b/advisories/unreviewed/2025/05/GHSA-jr24-26mj-cvxg/GHSA-jr24-26mj-cvxg.json new file mode 100644 index 00000000000..8bda8a3ce1c --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-jr24-26mj-cvxg/GHSA-jr24-26mj-cvxg.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jr24-26mj-cvxg", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-47859" + ], + "details": "Rejected reason: Not used", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47859" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T04:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-m7xr-5pwr-wf2f/GHSA-m7xr-5pwr-wf2f.json b/advisories/unreviewed/2025/05/GHSA-m7xr-5pwr-wf2f/GHSA-m7xr-5pwr-wf2f.json new file mode 100644 index 00000000000..c241ff37cb6 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-m7xr-5pwr-wf2f/GHSA-m7xr-5pwr-wf2f.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m7xr-5pwr-wf2f", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-47863" + ], + "details": "Rejected reason: Not used", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47863" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T04:16:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-mqmq-2p8r-q32f/GHSA-mqmq-2p8r-q32f.json b/advisories/unreviewed/2025/05/GHSA-mqmq-2p8r-q32f/GHSA-mqmq-2p8r-q32f.json index 97a337ab783..bf269fd67d1 100644 --- a/advisories/unreviewed/2025/05/GHSA-mqmq-2p8r-q32f/GHSA-mqmq-2p8r-q32f.json +++ b/advisories/unreviewed/2025/05/GHSA-mqmq-2p8r-q32f/GHSA-mqmq-2p8r-q32f.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mqmq-2p8r-q32f", - "modified": "2025-05-12T21:31:08Z", + "modified": "2025-05-13T06:30:23Z", "published": "2025-05-12T12:30:25Z", "aliases": [ "CVE-2025-22247" @@ -26,6 +26,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2025/05/12/2" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/05/13/2" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-pc76-c4h2-349r/GHSA-pc76-c4h2-349r.json b/advisories/unreviewed/2025/05/GHSA-pc76-c4h2-349r/GHSA-pc76-c4h2-349r.json new file mode 100644 index 00000000000..9a5e4811784 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-pc76-c4h2-349r/GHSA-pc76-c4h2-349r.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pc76-c4h2-349r", + "modified": "2025-05-13T06:30:24Z", + "published": "2025-05-13T06:30:24Z", + "aliases": [ + "CVE-2025-47861" + ], + "details": "Rejected reason: Not used", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47861" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-13T04:16:27Z" + } +} \ No newline at end of file