netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7rph-qq97-wqp5
GHSA-fjj5-r59g-88g7
GHSA-h36q-jch3-f9mw
GHSA-hf6r-227w-qwf9
GHSA-jc7v-r8h6-xr5c
GHSA-m885-h2wc-h2w3
GHSA-pjg4-cx24-6mjc
GHSA-qjw8-8452-9587
GHSA-xg8q-ggjx-6hx2
GHSA-xv7q-j96c-5r6v
GHSA-4r67-4x4p-fprg
GHSA-64mp-f6ff-c8jm
GHSA-7rjr-qv3w-fhmx
GHSA-8q89-xxwh-r8m4
GHSA-h4m7-pg92-x2q8
GHSA-jwhw-xf5v-qgxc
GHSA-p5g7-573c-m74m
GHSA-q7fj-77gc-45xq
This commit is contained in:
advisory-database[bot]
2025-06-11 12:31:49 +00:00
parent 87a3695f9a
commit cd1952ddec
18 changed files with 394 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/05/GHSA-7rph-qq97-wqp5/GHSA-7rph-qq97-wqp5.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7rph-qq97-wqp5",
"modified": "2025-05-27T18:30:49Z",
"modified": "2025-06-11T12:30:35Z",
"published": "2025-05-27T15:31:26Z",
"aliases": [
"CVE-2025-5264"
@@ -34,6 +34,14 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-fjj5-r59g-88g7/GHSA-fjj5-r59g-88g7.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fjj5-r59g-88g7",
"modified": "2025-05-27T18:30:50Z",
"modified": "2025-06-11T12:30:35Z",
"published": "2025-05-27T15:31:27Z",
"aliases": [
"CVE-2025-5265"
@@ -34,6 +34,14 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-h36q-jch3-f9mw/GHSA-h36q-jch3-f9mw.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h36q-jch3-f9mw",
"modified": "2025-05-27T15:31:28Z",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-05-27T15:31:28Z",
"aliases": [
"CVE-2025-5272"
@@ -26,6 +26,10 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-42"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-hf6r-227w-qwf9/GHSA-hf6r-227w-qwf9.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hf6r-227w-qwf9",
"modified": "2025-05-27T18:30:50Z",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-05-27T15:31:27Z",
"aliases": [
"CVE-2025-5270"
@@ -26,6 +26,10 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-42"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-jc7v-r8h6-xr5c/GHSA-jc7v-r8h6-xr5c.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jc7v-r8h6-xr5c",
"modified": "2025-05-27T18:30:50Z",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-05-27T15:31:27Z",
"aliases": [
"CVE-2025-5271"
@@ -26,6 +26,10 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-42"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-m885-h2wc-h2w3/GHSA-m885-h2wc-h2w3.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m885-h2wc-h2w3",
"modified": "2025-05-27T18:30:50Z",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-05-27T15:31:27Z",
"aliases": [
"CVE-2025-5268"
@@ -30,6 +30,14 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-pjg4-cx24-6mjc/GHSA-pjg4-cx24-6mjc.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pjg4-cx24-6mjc",
"modified": "2025-05-27T18:30:49Z",
"modified": "2025-06-11T12:30:35Z",
"published": "2025-05-27T15:31:26Z",
"aliases": [
"CVE-2025-5263"
@@ -34,6 +34,14 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-qjw8-8452-9587/GHSA-qjw8-8452-9587.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qjw8-8452-9587",
"modified": "2025-05-27T18:30:50Z",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-05-27T15:31:27Z",
"aliases": [
"CVE-2025-5269"
@@ -26,6 +26,10 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-xg8q-ggjx-6hx2/GHSA-xg8q-ggjx-6hx2.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xg8q-ggjx-6hx2",
"modified": "2025-05-27T18:30:50Z",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-05-27T15:31:27Z",
"aliases": [
"CVE-2025-5267"
@@ -30,6 +30,14 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46"
}
],
"database_specific": {
advisories/unreviewed/2025/05/GHSA-xv7q-j96c-5r6v/GHSA-xv7q-j96c-5r6v.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xv7q-j96c-5r6v",
"modified": "2025-05-27T18:30:50Z",
"modified": "2025-06-11T12:30:35Z",
"published": "2025-05-27T15:31:27Z",
"aliases": [
"CVE-2025-5266"
@@ -30,6 +30,14 @@
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46"
}
],
"database_specific": {
advisories/unreviewed/2025/06/GHSA-4r67-4x4p-fprg/GHSA-4r67-4x4p-fprg.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4r67-4x4p-fprg",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-06-11T12:30:36Z",
"aliases": [
"CVE-2025-4573"
],
"details": "Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4573"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T11:15:23Z"
}
}
advisories/unreviewed/2025/06/GHSA-64mp-f6ff-c8jm/GHSA-64mp-f6ff-c8jm.json
+33
View File
@@ -0,0 +1,33 @@
{
"schema_version": "1.4.0",
"id": "GHSA-64mp-f6ff-c8jm",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-06-11T12:30:36Z",
"aliases": [
"CVE-2025-49710"
],
"details": "An integer overflow was present in `OrderedHashTable` used by the JavaScript engine This vulnerability affects Firefox < 139.0.4.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49710"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1970095"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-47"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T12:15:27Z"
}
}
advisories/unreviewed/2025/06/GHSA-7rjr-qv3w-fhmx/GHSA-7rjr-qv3w-fhmx.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7rjr-qv3w-fhmx",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-06-11T12:30:36Z",
"aliases": [
"CVE-2025-4315"
],
"details": "The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.23/cube/classes/class-cubewp-rest-api.php#L691"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3306925/cubewp-framework#file2"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/430b7e72-72b8-4cf8-99f4-ee1d1d4b4f24?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T10:15:21Z"
}
}
advisories/unreviewed/2025/06/GHSA-8q89-xxwh-r8m4/GHSA-8q89-xxwh-r8m4.json
+68
View File
@@ -0,0 +1,68 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8q89-xxwh-r8m4",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-06-11T12:30:36Z",
"aliases": [
"CVE-2025-3302"
],
"details": "The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTP_REFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.1.0.0.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3302"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/models/xagio_log404.php#L263"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/models/xagio_log404.php#L335"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/redirects.js#L554"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/redirects.js#L662"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3281174"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3305780"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/xagio-seo"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e2afd66-c896-47c8-bf56-84a086087d55?source=cve"
},
{
"type": "WEB",
"url": "https://xagio.com/redirects"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T12:15:25Z"
}
}
advisories/unreviewed/2025/06/GHSA-h4m7-pg92-x2q8/GHSA-h4m7-pg92-x2q8.json
+33
View File
@@ -0,0 +1,33 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h4m7-pg92-x2q8",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-06-11T12:30:36Z",
"aliases": [
"CVE-2025-5687"
],
"details": "A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root.\n*This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.28.0 < (macOS).",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5687"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1953736"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-48"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T12:15:29Z"
}
}
advisories/unreviewed/2025/06/GHSA-jwhw-xf5v-qgxc/GHSA-jwhw-xf5v-qgxc.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jwhw-xf5v-qgxc",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-06-11T12:30:36Z",
"aliases": [
"CVE-2025-4128"
],
"details": "Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4128"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T11:15:23Z"
}
}
advisories/unreviewed/2025/06/GHSA-p5g7-573c-m74m/GHSA-p5g7-573c-m74m.json
+33
View File
@@ -0,0 +1,33 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p5g7-573c-m74m",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-06-11T12:30:36Z",
"aliases": [
"CVE-2025-49709"
],
"details": "Certain canvas operations could have lead to memory corruption. This vulnerability affects Firefox < 139.0.4.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49709"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966083"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-47"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T12:15:26Z"
}
}
advisories/unreviewed/2025/06/GHSA-q7fj-77gc-45xq/GHSA-q7fj-77gc-45xq.json
+37
View File
@@ -0,0 +1,37 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q7fj-77gc-45xq",
"modified": "2025-06-11T12:30:36Z",
"published": "2025-06-11T12:30:36Z",
"aliases": [
"CVE-2025-5986"
],
"details": "A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5986"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1958580%2C1968012"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-49"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-50"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T12:15:29Z"
}
}