From 51227ec4aa20d3a8b981710489ba8d68b56f45f2 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 15 May 2025 00:32:35 +0000
Subject: [PATCH] Publish Advisories

GHSA-qq9f-q439-2574
GHSA-25wx-48p7-wfpx
GHSA-4q54-mrqq-qq67
GHSA-99pf-wjvr-5q4j
GHSA-9ppr-22gc-5w96
GHSA-mrg2-jr6m-xfj9
GHSA-x6c2-8j4w-4vxx
---
 .../GHSA-qq9f-q439-2574.json                  |  6 ++-
 .../GHSA-25wx-48p7-wfpx.json                  | 29 ++++++++++++++
 .../GHSA-4q54-mrqq-qq67.json                  | 40 +++++++++++++++++++
 .../GHSA-99pf-wjvr-5q4j.json                  | 29 ++++++++++++++
 .../GHSA-9ppr-22gc-5w96.json                  | 29 ++++++++++++++
 .../GHSA-mrg2-jr6m-xfj9.json                  | 29 ++++++++++++++
 .../GHSA-x6c2-8j4w-4vxx.json                  | 29 ++++++++++++++
 7 files changed, 190 insertions(+), 1 deletion(-)
 create mode 100644 advisories/unreviewed/2025/05/GHSA-25wx-48p7-wfpx/GHSA-25wx-48p7-wfpx.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-4q54-mrqq-qq67/GHSA-4q54-mrqq-qq67.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-99pf-wjvr-5q4j/GHSA-99pf-wjvr-5q4j.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-9ppr-22gc-5w96/GHSA-9ppr-22gc-5w96.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-mrg2-jr6m-xfj9/GHSA-mrg2-jr6m-xfj9.json
 create mode 100644 advisories/unreviewed/2025/05/GHSA-x6c2-8j4w-4vxx/GHSA-x6c2-8j4w-4vxx.json

diff --git a/advisories/github-reviewed/2025/01/GHSA-qq9f-q439-2574/GHSA-qq9f-q439-2574.json b/advisories/github-reviewed/2025/01/GHSA-qq9f-q439-2574/GHSA-qq9f-q439-2574.json
index 2891707afe2..54da9c14b22 100644
--- a/advisories/github-reviewed/2025/01/GHSA-qq9f-q439-2574/GHSA-qq9f-q439-2574.json
+++ b/advisories/github-reviewed/2025/01/GHSA-qq9f-q439-2574/GHSA-qq9f-q439-2574.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qq9f-q439-2574",
-  "modified": "2025-03-28T00:31:28Z",
+  "modified": "2025-05-15T00:30:26Z",
   "published": "2025-01-02T21:31:42Z",
   "aliases": [
     "CVE-2024-8447"
@@ -56,6 +56,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2025:3358"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:7620"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2024-8447"
diff --git a/advisories/unreviewed/2025/05/GHSA-25wx-48p7-wfpx/GHSA-25wx-48p7-wfpx.json b/advisories/unreviewed/2025/05/GHSA-25wx-48p7-wfpx/GHSA-25wx-48p7-wfpx.json
new file mode 100644
index 00000000000..bdbc4b479c2
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-25wx-48p7-wfpx/GHSA-25wx-48p7-wfpx.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-25wx-48p7-wfpx",
+  "modified": "2025-05-15T00:30:26Z",
+  "published": "2025-05-15T00:30:26Z",
+  "aliases": [
+    "CVE-2025-29691"
+  ],
+  "details": "A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29691"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitee.com/hailey888/oa_system/issues/IBRQYI"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-14T22:15:17Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-4q54-mrqq-qq67/GHSA-4q54-mrqq-qq67.json b/advisories/unreviewed/2025/05/GHSA-4q54-mrqq-qq67/GHSA-4q54-mrqq-qq67.json
new file mode 100644
index 00000000000..df0946a0d40
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-4q54-mrqq-qq67/GHSA-4q54-mrqq-qq67.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4q54-mrqq-qq67",
+  "modified": "2025-05-15T00:30:26Z",
+  "published": "2025-05-15T00:30:26Z",
+  "aliases": [
+    "CVE-2024-45067"
+  ],
+  "details": "Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentially enable escalation of privilege via local access.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45067"
+    },
+    {
+      "type": "WEB",
+      "url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01271.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-276"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-14T23:15:47Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-99pf-wjvr-5q4j/GHSA-99pf-wjvr-5q4j.json b/advisories/unreviewed/2025/05/GHSA-99pf-wjvr-5q4j/GHSA-99pf-wjvr-5q4j.json
new file mode 100644
index 00000000000..989cd41278b
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-99pf-wjvr-5q4j/GHSA-99pf-wjvr-5q4j.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-99pf-wjvr-5q4j",
+  "modified": "2025-05-15T00:30:26Z",
+  "published": "2025-05-15T00:30:26Z",
+  "aliases": [
+    "CVE-2025-29686"
+  ],
+  "details": "A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29686"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitee.com/hailey888/oa_system/issues/IBRQWG"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-14T22:15:17Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-9ppr-22gc-5w96/GHSA-9ppr-22gc-5w96.json b/advisories/unreviewed/2025/05/GHSA-9ppr-22gc-5w96/GHSA-9ppr-22gc-5w96.json
new file mode 100644
index 00000000000..aadfcef8b0d
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-9ppr-22gc-5w96/GHSA-9ppr-22gc-5w96.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9ppr-22gc-5w96",
+  "modified": "2025-05-15T00:30:26Z",
+  "published": "2025-05-15T00:30:26Z",
+  "aliases": [
+    "CVE-2025-29688"
+  ],
+  "details": "A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /daymanager/daymanageabilitycontroller.java.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29688"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitee.com/hailey888/oa_system/issues/IBRRZX"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-14T22:15:17Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-mrg2-jr6m-xfj9/GHSA-mrg2-jr6m-xfj9.json b/advisories/unreviewed/2025/05/GHSA-mrg2-jr6m-xfj9/GHSA-mrg2-jr6m-xfj9.json
new file mode 100644
index 00000000000..ecc036c9d8f
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-mrg2-jr6m-xfj9/GHSA-mrg2-jr6m-xfj9.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mrg2-jr6m-xfj9",
+  "modified": "2025-05-15T00:30:26Z",
+  "published": "2025-05-15T00:30:26Z",
+  "aliases": [
+    "CVE-2025-29689"
+  ],
+  "details": "A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29689"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitee.com/hailey888/oa_system/issues/IBRQZ9"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-14T22:15:17Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-x6c2-8j4w-4vxx/GHSA-x6c2-8j4w-4vxx.json b/advisories/unreviewed/2025/05/GHSA-x6c2-8j4w-4vxx/GHSA-x6c2-8j4w-4vxx.json
new file mode 100644
index 00000000000..9ad07b32868
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-x6c2-8j4w-4vxx/GHSA-x6c2-8j4w-4vxx.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x6c2-8j4w-4vxx",
+  "modified": "2025-05-15T00:30:26Z",
+  "published": "2025-05-15T00:30:26Z",
+  "aliases": [
+    "CVE-2025-29690"
+  ],
+  "details": "A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29690"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gitee.com/hailey888/oa_system/issues/IBRRX3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-14T22:15:17Z"
+  }
+}
\ No newline at end of file