From 44f6cdc1def5f53470a1868c663edeace85af600 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 14 Apr 2025 09:32:14 +0000 Subject: [PATCH] Publish Advisories GHSA-27p4-6mmr-736m GHSA-2cmf-6gx5-m9c2 GHSA-322v-vh2g-qvpv GHSA-4764-r75x-h867 GHSA-7v2h-rq4p-4hhc GHSA-8x88-3cxw-8x7g GHSA-fqfw-5jc9-hw27 GHSA-fwxj-c833-3v48 GHSA-rpw6-c888-qg9m GHSA-w8hx-xwgf-2m86 --- .../GHSA-27p4-6mmr-736m.json | 52 ++++++++++++++ .../GHSA-2cmf-6gx5-m9c2.json | 56 +++++++++++++++ .../GHSA-322v-vh2g-qvpv.json | 36 ++++++++++ .../GHSA-4764-r75x-h867.json | 72 +++++++++++++++++++ .../GHSA-7v2h-rq4p-4hhc.json | 52 ++++++++++++++ .../GHSA-8x88-3cxw-8x7g.json | 52 ++++++++++++++ .../GHSA-fqfw-5jc9-hw27.json | 44 ++++++++++++ .../GHSA-fwxj-c833-3v48.json | 52 ++++++++++++++ .../GHSA-rpw6-c888-qg9m.json | 52 ++++++++++++++ .../GHSA-w8hx-xwgf-2m86.json | 36 ++++++++++ 10 files changed, 504 insertions(+) create mode 100644 advisories/unreviewed/2025/04/GHSA-27p4-6mmr-736m/GHSA-27p4-6mmr-736m.json create mode 100644 advisories/unreviewed/2025/04/GHSA-2cmf-6gx5-m9c2/GHSA-2cmf-6gx5-m9c2.json create mode 100644 advisories/unreviewed/2025/04/GHSA-322v-vh2g-qvpv/GHSA-322v-vh2g-qvpv.json create mode 100644 advisories/unreviewed/2025/04/GHSA-4764-r75x-h867/GHSA-4764-r75x-h867.json create mode 100644 advisories/unreviewed/2025/04/GHSA-7v2h-rq4p-4hhc/GHSA-7v2h-rq4p-4hhc.json create mode 100644 advisories/unreviewed/2025/04/GHSA-8x88-3cxw-8x7g/GHSA-8x88-3cxw-8x7g.json create mode 100644 advisories/unreviewed/2025/04/GHSA-fqfw-5jc9-hw27/GHSA-fqfw-5jc9-hw27.json create mode 100644 advisories/unreviewed/2025/04/GHSA-fwxj-c833-3v48/GHSA-fwxj-c833-3v48.json create mode 100644 advisories/unreviewed/2025/04/GHSA-rpw6-c888-qg9m/GHSA-rpw6-c888-qg9m.json create mode 100644 advisories/unreviewed/2025/04/GHSA-w8hx-xwgf-2m86/GHSA-w8hx-xwgf-2m86.json diff --git a/advisories/unreviewed/2025/04/GHSA-27p4-6mmr-736m/GHSA-27p4-6mmr-736m.json b/advisories/unreviewed/2025/04/GHSA-27p4-6mmr-736m/GHSA-27p4-6mmr-736m.json new file mode 100644 index 00000000000..7711885aebf --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-27p4-6mmr-736m/GHSA-27p4-6mmr-736m.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-27p4-6mmr-736m", + "modified": "2025-04-14T09:30:24Z", + "published": "2025-04-14T09:30:24Z", + "aliases": [ + "CVE-2025-3554" + ], + "details": "A vulnerability was found in phpshe 1.8. It has been rated as problematic. This issue affects some unknown processing of the file api.php?mod=cron&act=buyer. The manipulation of the argument act leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3554" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.304595" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.304595" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.548411" + }, + { + "type": "WEB", + "url": "https://www.yuque.com/baimatangseng-iyusa/qwwm81/zwhcyq1585ec8g37?singleDoc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T07:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-2cmf-6gx5-m9c2/GHSA-2cmf-6gx5-m9c2.json b/advisories/unreviewed/2025/04/GHSA-2cmf-6gx5-m9c2/GHSA-2cmf-6gx5-m9c2.json new file mode 100644 index 00000000000..bbbca94dca0 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-2cmf-6gx5-m9c2/GHSA-2cmf-6gx5-m9c2.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2cmf-6gx5-m9c2", + "modified": "2025-04-14T09:30:24Z", + "published": "2025-04-14T09:30:24Z", + "aliases": [ + "CVE-2025-3557" + ], + "details": "A vulnerability, which was classified as problematic, has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3557" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.304598" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.304598" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.551053" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/04/script-and-tools-ecommerce-30_3.html" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/04/script-and-tools-ecommerce-30_79.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T08:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-322v-vh2g-qvpv/GHSA-322v-vh2g-qvpv.json b/advisories/unreviewed/2025/04/GHSA-322v-vh2g-qvpv/GHSA-322v-vh2g-qvpv.json new file mode 100644 index 00000000000..2376d67f450 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-322v-vh2g-qvpv/GHSA-322v-vh2g-qvpv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-322v-vh2g-qvpv", + "modified": "2025-04-14T09:30:24Z", + "published": "2025-04-14T09:30:24Z", + "aliases": [ + "CVE-2025-32093" + ], + "details": "Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the \"Edit Other Users\" permission to perform unauthorized modifications to system administrators via improper permission validation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32093" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T07:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-4764-r75x-h867/GHSA-4764-r75x-h867.json b/advisories/unreviewed/2025/04/GHSA-4764-r75x-h867/GHSA-4764-r75x-h867.json new file mode 100644 index 00000000000..7092fc6390d --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-4764-r75x-h867/GHSA-4764-r75x-h867.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4764-r75x-h867", + "modified": "2025-04-14T09:30:25Z", + "published": "2025-04-14T09:30:25Z", + "aliases": [ + "CVE-2025-31344" + ], + "details": "Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.\n\nThis issue affects giflib: through 5.2.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31344" + }, + { + "type": "WEB", + "url": "https://gitee.com/src-openeuler/giflib/pulls/54" + }, + { + "type": "WEB", + "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1292" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/07/3" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/07/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/07/5" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/07/6" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/08/1" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/09/5" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/09/7" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/10/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T08:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-7v2h-rq4p-4hhc/GHSA-7v2h-rq4p-4hhc.json b/advisories/unreviewed/2025/04/GHSA-7v2h-rq4p-4hhc/GHSA-7v2h-rq4p-4hhc.json new file mode 100644 index 00000000000..e3c063687fd --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-7v2h-rq4p-4hhc/GHSA-7v2h-rq4p-4hhc.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7v2h-rq4p-4hhc", + "modified": "2025-04-14T09:30:25Z", + "published": "2025-04-14T09:30:25Z", + "aliases": [ + "CVE-2025-3559" + ], + "details": "A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of the file /mall/product/0/20. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3559" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.304600" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.304600" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.549260" + }, + { + "type": "WEB", + "url": "https://wiki.shikangsi.com/post/share/ba8925f0-0480-4356-9b32-4543d0ea8671" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T09:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-8x88-3cxw-8x7g/GHSA-8x88-3cxw-8x7g.json b/advisories/unreviewed/2025/04/GHSA-8x88-3cxw-8x7g/GHSA-8x88-3cxw-8x7g.json new file mode 100644 index 00000000000..7fc4c7931b6 --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-8x88-3cxw-8x7g/GHSA-8x88-3cxw-8x7g.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8x88-3cxw-8x7g", + "modified": "2025-04-14T09:30:25Z", + "published": "2025-04-14T09:30:25Z", + "aliases": [ + "CVE-2025-3558" + ], + "details": "A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3558" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.304599" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.304599" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.549259" + }, + { + "type": "WEB", + "url": "https://wiki.shikangsi.com/post/share/2f5fafb5-63d3-4784-8866-5592547a71a4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T09:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-fqfw-5jc9-hw27/GHSA-fqfw-5jc9-hw27.json b/advisories/unreviewed/2025/04/GHSA-fqfw-5jc9-hw27/GHSA-fqfw-5jc9-hw27.json new file mode 100644 index 00000000000..30e00c9dfbb --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-fqfw-5jc9-hw27/GHSA-fqfw-5jc9-hw27.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fqfw-5jc9-hw27", + "modified": "2025-04-14T09:30:24Z", + "published": "2025-04-14T09:30:24Z", + "aliases": [ + "CVE-2025-24859" + ], + "details": "A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised.\n\nThis issue affects Apache Roller versions up to and including 6.1.4.\n\nThe vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24859" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/4j906k16v21kdx8hk87gl7663sw7lg7f" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/vxv52vdr8nhtjlj6v02w43fdvo0cxw23" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/11/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-613" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T09:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-fwxj-c833-3v48/GHSA-fwxj-c833-3v48.json b/advisories/unreviewed/2025/04/GHSA-fwxj-c833-3v48/GHSA-fwxj-c833-3v48.json new file mode 100644 index 00000000000..4d7aa8f6d4a --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-fwxj-c833-3v48/GHSA-fwxj-c833-3v48.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fwxj-c833-3v48", + "modified": "2025-04-14T09:30:25Z", + "published": "2025-04-14T09:30:24Z", + "aliases": [ + "CVE-2025-3555" + ], + "details": "A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3555" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.304596" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.304596" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.549168" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/04/script-and-tools-ecommerce-30-loginphp.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-307" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T07:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-rpw6-c888-qg9m/GHSA-rpw6-c888-qg9m.json b/advisories/unreviewed/2025/04/GHSA-rpw6-c888-qg9m/GHSA-rpw6-c888-qg9m.json new file mode 100644 index 00000000000..4dc73f1444b --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-rpw6-c888-qg9m/GHSA-rpw6-c888-qg9m.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rpw6-c888-qg9m", + "modified": "2025-04-14T09:30:24Z", + "published": "2025-04-14T09:30:24Z", + "aliases": [ + "CVE-2025-3556" + ], + "details": "A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3556" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.304597" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.304597" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.549187" + }, + { + "type": "WEB", + "url": "https://www.websecurityinsights.my.id/2025/04/script-and-tools-ecommerce-30.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-307" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T08:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-w8hx-xwgf-2m86/GHSA-w8hx-xwgf-2m86.json b/advisories/unreviewed/2025/04/GHSA-w8hx-xwgf-2m86/GHSA-w8hx-xwgf-2m86.json new file mode 100644 index 00000000000..8907ca4ae3b --- /dev/null +++ b/advisories/unreviewed/2025/04/GHSA-w8hx-xwgf-2m86/GHSA-w8hx-xwgf-2m86.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w8hx-xwgf-2m86", + "modified": "2025-04-14T09:30:24Z", + "published": "2025-04-14T09:30:24Z", + "aliases": [ + "CVE-2025-30516" + ], + "details": "Mattermost Mobile Apps versions <=2.25.0  fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized users on shared devices to access sensitive notification content via continued mobile notifications", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30516" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-613" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-04-14T07:15:14Z" + } +} \ No newline at end of file