From b08202fa51e0ce3f18428c4924d24674a466384d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sun, 11 May 2025 00:35:18 +0000 Subject: [PATCH] Publish Advisories GHSA-52xv-3j2w-p329 GHSA-936r-ccvf-h37h GHSA-hwx6-437w-47vv GHSA-q35g-37c5-hjjh GHSA-q493-98vp-6cm3 --- .../GHSA-52xv-3j2w-p329.json | 36 +++++++++++++ .../GHSA-936r-ccvf-h37h.json | 52 +++++++++++++++++++ .../GHSA-hwx6-437w-47vv.json | 36 +++++++++++++ .../GHSA-q35g-37c5-hjjh.json | 44 ++++++++++++++++ .../GHSA-q493-98vp-6cm3.json | 36 +++++++++++++ 5 files changed, 204 insertions(+) create mode 100644 advisories/unreviewed/2025/05/GHSA-52xv-3j2w-p329/GHSA-52xv-3j2w-p329.json create mode 100644 advisories/unreviewed/2025/05/GHSA-936r-ccvf-h37h/GHSA-936r-ccvf-h37h.json create mode 100644 advisories/unreviewed/2025/05/GHSA-hwx6-437w-47vv/GHSA-hwx6-437w-47vv.json create mode 100644 advisories/unreviewed/2025/05/GHSA-q35g-37c5-hjjh/GHSA-q35g-37c5-hjjh.json create mode 100644 advisories/unreviewed/2025/05/GHSA-q493-98vp-6cm3/GHSA-q493-98vp-6cm3.json diff --git a/advisories/unreviewed/2025/05/GHSA-52xv-3j2w-p329/GHSA-52xv-3j2w-p329.json b/advisories/unreviewed/2025/05/GHSA-52xv-3j2w-p329/GHSA-52xv-3j2w-p329.json new file mode 100644 index 00000000000..8d537b422a7 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-52xv-3j2w-p329/GHSA-52xv-3j2w-p329.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-52xv-3j2w-p329", + "modified": "2025-05-11T00:33:45Z", + "published": "2025-05-11T00:33:45Z", + "aliases": [ + "CVE-2025-47816" + ], + "details": "libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at the end of a document.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47816" + }, + { + "type": "WEB", + "url": "https://savannah.gnu.org/bugs/?67073" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-10T22:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-936r-ccvf-h37h/GHSA-936r-ccvf-h37h.json b/advisories/unreviewed/2025/05/GHSA-936r-ccvf-h37h/GHSA-936r-ccvf-h37h.json new file mode 100644 index 00000000000..bc6323b33ea --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-936r-ccvf-h37h/GHSA-936r-ccvf-h37h.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-936r-ccvf-h37h", + "modified": "2025-05-11T00:33:45Z", + "published": "2025-05-11T00:33:45Z", + "aliases": [ + "CVE-2025-4525" + ], + "details": "A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4525" + }, + { + "type": "WEB", + "url": "https://gist.github.com/shellkraft/ac4be6a3953e2889a7bf54aea2db88c2" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.308270" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.308270" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.562788" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-426" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-10T23:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-hwx6-437w-47vv/GHSA-hwx6-437w-47vv.json b/advisories/unreviewed/2025/05/GHSA-hwx6-437w-47vv/GHSA-hwx6-437w-47vv.json new file mode 100644 index 00000000000..6ca40f893dc --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-hwx6-437w-47vv/GHSA-hwx6-437w-47vv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hwx6-437w-47vv", + "modified": "2025-05-11T00:33:45Z", + "published": "2025-05-11T00:33:45Z", + "aliases": [ + "CVE-2025-47815" + ], + "details": "libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from zip_member_read_all) in zip-reader.c.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47815" + }, + { + "type": "WEB", + "url": "https://savannah.gnu.org/bugs/?67075" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-10T22:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-q35g-37c5-hjjh/GHSA-q35g-37c5-hjjh.json b/advisories/unreviewed/2025/05/GHSA-q35g-37c5-hjjh/GHSA-q35g-37c5-hjjh.json new file mode 100644 index 00000000000..727c8abb7e4 --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-q35g-37c5-hjjh/GHSA-q35g-37c5-hjjh.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q35g-37c5-hjjh", + "modified": "2025-05-11T00:33:45Z", + "published": "2025-05-11T00:33:45Z", + "aliases": [ + "CVE-2025-47817" + ], + "details": "In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "WEB", + "url": "https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-rq7r-p9cq-5q4f" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47817" + }, + { + "type": "WEB", + "url": "https://github.com/bluewave-labs/Checkmate/pull/2161" + }, + { + "type": "WEB", + "url": "https://github.com/bluewave-labs/Checkmate/commit/b387ebaae96fc3a23b090a8baea7a9ebaa70f052" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-472" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-10T22:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-q493-98vp-6cm3/GHSA-q493-98vp-6cm3.json b/advisories/unreviewed/2025/05/GHSA-q493-98vp-6cm3/GHSA-q493-98vp-6cm3.json new file mode 100644 index 00000000000..899b74a14eb --- /dev/null +++ b/advisories/unreviewed/2025/05/GHSA-q493-98vp-6cm3/GHSA-q493-98vp-6cm3.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q493-98vp-6cm3", + "modified": "2025-05-11T00:33:45Z", + "published": "2025-05-11T00:33:45Z", + "aliases": [ + "CVE-2025-47814" + ], + "details": "libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from spv_read_xml_member) in zip-reader.c.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47814" + }, + { + "type": "WEB", + "url": "https://savannah.gnu.org/bugs/?67074" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-05-10T22:15:20Z" + } +} \ No newline at end of file