From cd1952ddecefb4ebc04240bf6342a9c0c8fc3cef Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 11 Jun 2025 12:31:49 +0000 Subject: [PATCH] Publish Advisories GHSA-7rph-qq97-wqp5 GHSA-fjj5-r59g-88g7 GHSA-h36q-jch3-f9mw GHSA-hf6r-227w-qwf9 GHSA-jc7v-r8h6-xr5c GHSA-m885-h2wc-h2w3 GHSA-pjg4-cx24-6mjc GHSA-qjw8-8452-9587 GHSA-xg8q-ggjx-6hx2 GHSA-xv7q-j96c-5r6v GHSA-4r67-4x4p-fprg GHSA-64mp-f6ff-c8jm GHSA-7rjr-qv3w-fhmx GHSA-8q89-xxwh-r8m4 GHSA-h4m7-pg92-x2q8 GHSA-jwhw-xf5v-qgxc GHSA-p5g7-573c-m74m GHSA-q7fj-77gc-45xq --- .../GHSA-7rph-qq97-wqp5.json | 10 ++- .../GHSA-fjj5-r59g-88g7.json | 10 ++- .../GHSA-h36q-jch3-f9mw.json | 6 +- .../GHSA-hf6r-227w-qwf9.json | 6 +- .../GHSA-jc7v-r8h6-xr5c.json | 6 +- .../GHSA-m885-h2wc-h2w3.json | 10 ++- .../GHSA-pjg4-cx24-6mjc.json | 10 ++- .../GHSA-qjw8-8452-9587.json | 6 +- .../GHSA-xg8q-ggjx-6hx2.json | 10 ++- .../GHSA-xv7q-j96c-5r6v.json | 10 ++- .../GHSA-4r67-4x4p-fprg.json | 36 ++++++++++ .../GHSA-64mp-f6ff-c8jm.json | 33 +++++++++ .../GHSA-7rjr-qv3w-fhmx.json | 44 ++++++++++++ .../GHSA-8q89-xxwh-r8m4.json | 68 +++++++++++++++++++ .../GHSA-h4m7-pg92-x2q8.json | 33 +++++++++ .../GHSA-jwhw-xf5v-qgxc.json | 36 ++++++++++ .../GHSA-p5g7-573c-m74m.json | 33 +++++++++ .../GHSA-q7fj-77gc-45xq.json | 37 ++++++++++ 18 files changed, 394 insertions(+), 10 deletions(-) create mode 100644 advisories/unreviewed/2025/06/GHSA-4r67-4x4p-fprg/GHSA-4r67-4x4p-fprg.json create mode 100644 advisories/unreviewed/2025/06/GHSA-64mp-f6ff-c8jm/GHSA-64mp-f6ff-c8jm.json create mode 100644 advisories/unreviewed/2025/06/GHSA-7rjr-qv3w-fhmx/GHSA-7rjr-qv3w-fhmx.json create mode 100644 advisories/unreviewed/2025/06/GHSA-8q89-xxwh-r8m4/GHSA-8q89-xxwh-r8m4.json create mode 100644 advisories/unreviewed/2025/06/GHSA-h4m7-pg92-x2q8/GHSA-h4m7-pg92-x2q8.json create mode 100644 advisories/unreviewed/2025/06/GHSA-jwhw-xf5v-qgxc/GHSA-jwhw-xf5v-qgxc.json create mode 100644 advisories/unreviewed/2025/06/GHSA-p5g7-573c-m74m/GHSA-p5g7-573c-m74m.json create mode 100644 advisories/unreviewed/2025/06/GHSA-q7fj-77gc-45xq/GHSA-q7fj-77gc-45xq.json diff --git a/advisories/unreviewed/2025/05/GHSA-7rph-qq97-wqp5/GHSA-7rph-qq97-wqp5.json b/advisories/unreviewed/2025/05/GHSA-7rph-qq97-wqp5/GHSA-7rph-qq97-wqp5.json index 532543095bd..f44eb7eed70 100644 --- a/advisories/unreviewed/2025/05/GHSA-7rph-qq97-wqp5/GHSA-7rph-qq97-wqp5.json +++ b/advisories/unreviewed/2025/05/GHSA-7rph-qq97-wqp5/GHSA-7rph-qq97-wqp5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7rph-qq97-wqp5", - "modified": "2025-05-27T18:30:49Z", + "modified": "2025-06-11T12:30:35Z", "published": "2025-05-27T15:31:26Z", "aliases": [ "CVE-2025-5264" @@ -34,6 +34,14 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-44" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-45" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-46" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-fjj5-r59g-88g7/GHSA-fjj5-r59g-88g7.json b/advisories/unreviewed/2025/05/GHSA-fjj5-r59g-88g7/GHSA-fjj5-r59g-88g7.json index dee0e2b6d4a..ff0260bd331 100644 --- a/advisories/unreviewed/2025/05/GHSA-fjj5-r59g-88g7/GHSA-fjj5-r59g-88g7.json +++ b/advisories/unreviewed/2025/05/GHSA-fjj5-r59g-88g7/GHSA-fjj5-r59g-88g7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fjj5-r59g-88g7", - "modified": "2025-05-27T18:30:50Z", + "modified": "2025-06-11T12:30:35Z", "published": "2025-05-27T15:31:27Z", "aliases": [ "CVE-2025-5265" @@ -34,6 +34,14 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-44" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-45" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-46" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-h36q-jch3-f9mw/GHSA-h36q-jch3-f9mw.json b/advisories/unreviewed/2025/05/GHSA-h36q-jch3-f9mw/GHSA-h36q-jch3-f9mw.json index 2d03f44531b..3b492e83f9e 100644 --- a/advisories/unreviewed/2025/05/GHSA-h36q-jch3-f9mw/GHSA-h36q-jch3-f9mw.json +++ b/advisories/unreviewed/2025/05/GHSA-h36q-jch3-f9mw/GHSA-h36q-jch3-f9mw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h36q-jch3-f9mw", - "modified": "2025-05-27T15:31:28Z", + "modified": "2025-06-11T12:30:36Z", "published": "2025-05-27T15:31:28Z", "aliases": [ "CVE-2025-5272" @@ -26,6 +26,10 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-42" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-45" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-hf6r-227w-qwf9/GHSA-hf6r-227w-qwf9.json b/advisories/unreviewed/2025/05/GHSA-hf6r-227w-qwf9/GHSA-hf6r-227w-qwf9.json index 7cc484a7ddf..9080eec8488 100644 --- a/advisories/unreviewed/2025/05/GHSA-hf6r-227w-qwf9/GHSA-hf6r-227w-qwf9.json +++ b/advisories/unreviewed/2025/05/GHSA-hf6r-227w-qwf9/GHSA-hf6r-227w-qwf9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hf6r-227w-qwf9", - "modified": "2025-05-27T18:30:50Z", + "modified": "2025-06-11T12:30:36Z", "published": "2025-05-27T15:31:27Z", "aliases": [ "CVE-2025-5270" @@ -26,6 +26,10 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-42" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-45" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-jc7v-r8h6-xr5c/GHSA-jc7v-r8h6-xr5c.json b/advisories/unreviewed/2025/05/GHSA-jc7v-r8h6-xr5c/GHSA-jc7v-r8h6-xr5c.json index 08068dff5be..9be14f71dcb 100644 --- a/advisories/unreviewed/2025/05/GHSA-jc7v-r8h6-xr5c/GHSA-jc7v-r8h6-xr5c.json +++ b/advisories/unreviewed/2025/05/GHSA-jc7v-r8h6-xr5c/GHSA-jc7v-r8h6-xr5c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jc7v-r8h6-xr5c", - "modified": "2025-05-27T18:30:50Z", + "modified": "2025-06-11T12:30:36Z", "published": "2025-05-27T15:31:27Z", "aliases": [ "CVE-2025-5271" @@ -26,6 +26,10 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-42" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-45" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-m885-h2wc-h2w3/GHSA-m885-h2wc-h2w3.json b/advisories/unreviewed/2025/05/GHSA-m885-h2wc-h2w3/GHSA-m885-h2wc-h2w3.json index 7fbd21277d6..ad427ec6352 100644 --- a/advisories/unreviewed/2025/05/GHSA-m885-h2wc-h2w3/GHSA-m885-h2wc-h2w3.json +++ b/advisories/unreviewed/2025/05/GHSA-m885-h2wc-h2w3/GHSA-m885-h2wc-h2w3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m885-h2wc-h2w3", - "modified": "2025-05-27T18:30:50Z", + "modified": "2025-06-11T12:30:36Z", "published": "2025-05-27T15:31:27Z", "aliases": [ "CVE-2025-5268" @@ -30,6 +30,14 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-44" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-45" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-46" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-pjg4-cx24-6mjc/GHSA-pjg4-cx24-6mjc.json b/advisories/unreviewed/2025/05/GHSA-pjg4-cx24-6mjc/GHSA-pjg4-cx24-6mjc.json index 30eb4ec7ed7..2c551ce2c3e 100644 --- a/advisories/unreviewed/2025/05/GHSA-pjg4-cx24-6mjc/GHSA-pjg4-cx24-6mjc.json +++ b/advisories/unreviewed/2025/05/GHSA-pjg4-cx24-6mjc/GHSA-pjg4-cx24-6mjc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pjg4-cx24-6mjc", - "modified": "2025-05-27T18:30:49Z", + "modified": "2025-06-11T12:30:35Z", "published": "2025-05-27T15:31:26Z", "aliases": [ "CVE-2025-5263" @@ -34,6 +34,14 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-44" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-45" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-46" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-qjw8-8452-9587/GHSA-qjw8-8452-9587.json b/advisories/unreviewed/2025/05/GHSA-qjw8-8452-9587/GHSA-qjw8-8452-9587.json index a9896cba297..4c4d31980db 100644 --- a/advisories/unreviewed/2025/05/GHSA-qjw8-8452-9587/GHSA-qjw8-8452-9587.json +++ b/advisories/unreviewed/2025/05/GHSA-qjw8-8452-9587/GHSA-qjw8-8452-9587.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qjw8-8452-9587", - "modified": "2025-05-27T18:30:50Z", + "modified": "2025-06-11T12:30:36Z", "published": "2025-05-27T15:31:27Z", "aliases": [ "CVE-2025-5269" @@ -26,6 +26,10 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-44" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-46" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-xg8q-ggjx-6hx2/GHSA-xg8q-ggjx-6hx2.json b/advisories/unreviewed/2025/05/GHSA-xg8q-ggjx-6hx2/GHSA-xg8q-ggjx-6hx2.json index 560706fc7d8..6d8e4ff0a05 100644 --- a/advisories/unreviewed/2025/05/GHSA-xg8q-ggjx-6hx2/GHSA-xg8q-ggjx-6hx2.json +++ b/advisories/unreviewed/2025/05/GHSA-xg8q-ggjx-6hx2/GHSA-xg8q-ggjx-6hx2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xg8q-ggjx-6hx2", - "modified": "2025-05-27T18:30:50Z", + "modified": "2025-06-11T12:30:36Z", "published": "2025-05-27T15:31:27Z", "aliases": [ "CVE-2025-5267" @@ -30,6 +30,14 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-44" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-45" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-46" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/05/GHSA-xv7q-j96c-5r6v/GHSA-xv7q-j96c-5r6v.json b/advisories/unreviewed/2025/05/GHSA-xv7q-j96c-5r6v/GHSA-xv7q-j96c-5r6v.json index cb69c250b67..f5de7ac08d1 100644 --- a/advisories/unreviewed/2025/05/GHSA-xv7q-j96c-5r6v/GHSA-xv7q-j96c-5r6v.json +++ b/advisories/unreviewed/2025/05/GHSA-xv7q-j96c-5r6v/GHSA-xv7q-j96c-5r6v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xv7q-j96c-5r6v", - "modified": "2025-05-27T18:30:50Z", + "modified": "2025-06-11T12:30:35Z", "published": "2025-05-27T15:31:27Z", "aliases": [ "CVE-2025-5266" @@ -30,6 +30,14 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2025-44" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-45" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-46" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/06/GHSA-4r67-4x4p-fprg/GHSA-4r67-4x4p-fprg.json b/advisories/unreviewed/2025/06/GHSA-4r67-4x4p-fprg/GHSA-4r67-4x4p-fprg.json new file mode 100644 index 00000000000..130b5ccdeb7 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-4r67-4x4p-fprg/GHSA-4r67-4x4p-fprg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4r67-4x4p-fprg", + "modified": "2025-06-11T12:30:36Z", + "published": "2025-06-11T12:30:36Z", + "aliases": [ + "CVE-2025-4573" + ], + "details": "Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4573" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-90" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T11:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-64mp-f6ff-c8jm/GHSA-64mp-f6ff-c8jm.json b/advisories/unreviewed/2025/06/GHSA-64mp-f6ff-c8jm/GHSA-64mp-f6ff-c8jm.json new file mode 100644 index 00000000000..1df672eec02 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-64mp-f6ff-c8jm/GHSA-64mp-f6ff-c8jm.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-64mp-f6ff-c8jm", + "modified": "2025-06-11T12:30:36Z", + "published": "2025-06-11T12:30:36Z", + "aliases": [ + "CVE-2025-49710" + ], + "details": "An integer overflow was present in `OrderedHashTable` used by the JavaScript engine This vulnerability affects Firefox < 139.0.4.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49710" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1970095" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-47" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T12:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-7rjr-qv3w-fhmx/GHSA-7rjr-qv3w-fhmx.json b/advisories/unreviewed/2025/06/GHSA-7rjr-qv3w-fhmx/GHSA-7rjr-qv3w-fhmx.json new file mode 100644 index 00000000000..354cf6571da --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-7rjr-qv3w-fhmx/GHSA-7rjr-qv3w-fhmx.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7rjr-qv3w-fhmx", + "modified": "2025-06-11T12:30:36Z", + "published": "2025-06-11T12:30:36Z", + "aliases": [ + "CVE-2025-4315" + ], + "details": "The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.23/cube/classes/class-cubewp-rest-api.php#L691" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3306925/cubewp-framework#file2" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/430b7e72-72b8-4cf8-99f4-ee1d1d4b4f24?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T10:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-8q89-xxwh-r8m4/GHSA-8q89-xxwh-r8m4.json b/advisories/unreviewed/2025/06/GHSA-8q89-xxwh-r8m4/GHSA-8q89-xxwh-r8m4.json new file mode 100644 index 00000000000..4f93ea3b66a --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-8q89-xxwh-r8m4/GHSA-8q89-xxwh-r8m4.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8q89-xxwh-r8m4", + "modified": "2025-06-11T12:30:36Z", + "published": "2025-06-11T12:30:36Z", + "aliases": [ + "CVE-2025-3302" + ], + "details": "The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTP_REFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.1.0.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3302" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/models/xagio_log404.php#L263" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/models/xagio_log404.php#L335" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/redirects.js#L554" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/redirects.js#L662" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3281174" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3305780" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/xagio-seo" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e2afd66-c896-47c8-bf56-84a086087d55?source=cve" + }, + { + "type": "WEB", + "url": "https://xagio.com/redirects" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T12:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-h4m7-pg92-x2q8/GHSA-h4m7-pg92-x2q8.json b/advisories/unreviewed/2025/06/GHSA-h4m7-pg92-x2q8/GHSA-h4m7-pg92-x2q8.json new file mode 100644 index 00000000000..c96e49ce44b --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-h4m7-pg92-x2q8/GHSA-h4m7-pg92-x2q8.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h4m7-pg92-x2q8", + "modified": "2025-06-11T12:30:36Z", + "published": "2025-06-11T12:30:36Z", + "aliases": [ + "CVE-2025-5687" + ], + "details": "A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root.\n*This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.28.0 < (macOS).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5687" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1953736" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-48" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T12:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-jwhw-xf5v-qgxc/GHSA-jwhw-xf5v-qgxc.json b/advisories/unreviewed/2025/06/GHSA-jwhw-xf5v-qgxc/GHSA-jwhw-xf5v-qgxc.json new file mode 100644 index 00000000000..8253acff235 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-jwhw-xf5v-qgxc/GHSA-jwhw-xf5v-qgxc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jwhw-xf5v-qgxc", + "modified": "2025-06-11T12:30:36Z", + "published": "2025-06-11T12:30:36Z", + "aliases": [ + "CVE-2025-4128" + ], + "details": "Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4128" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T11:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-p5g7-573c-m74m/GHSA-p5g7-573c-m74m.json b/advisories/unreviewed/2025/06/GHSA-p5g7-573c-m74m/GHSA-p5g7-573c-m74m.json new file mode 100644 index 00000000000..4769926fe19 --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-p5g7-573c-m74m/GHSA-p5g7-573c-m74m.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p5g7-573c-m74m", + "modified": "2025-06-11T12:30:36Z", + "published": "2025-06-11T12:30:36Z", + "aliases": [ + "CVE-2025-49709" + ], + "details": "Certain canvas operations could have lead to memory corruption. This vulnerability affects Firefox < 139.0.4.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49709" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966083" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-47" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T12:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/06/GHSA-q7fj-77gc-45xq/GHSA-q7fj-77gc-45xq.json b/advisories/unreviewed/2025/06/GHSA-q7fj-77gc-45xq/GHSA-q7fj-77gc-45xq.json new file mode 100644 index 00000000000..80abd54ecdb --- /dev/null +++ b/advisories/unreviewed/2025/06/GHSA-q7fj-77gc-45xq/GHSA-q7fj-77gc-45xq.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7fj-77gc-45xq", + "modified": "2025-06-11T12:30:36Z", + "published": "2025-06-11T12:30:36Z", + "aliases": [ + "CVE-2025-5986" + ], + "details": "A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5986" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1958580%2C1968012" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-49" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2025-50" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-06-11T12:15:29Z" + } +} \ No newline at end of file