Publish Advisories

GHSA-2r74-wx33-5rv3 GHSA-3r6r-wrcf-h8fq GHSA-4328-m55p-39r7 GHSA-4www-5p9h-95mh GHSA-5pxh-8mph-4xwx GHSA-62m9-x279-9599 GHSA-6979-hxmm-g3gw GHSA-7225-rpgx-xc83 GHSA-8g4v-c2f9-p89g GHSA-9gqv-wp59-fq42 GHSA-9p6j-4hfc-5pxp GHSA-9pv6-23hr-9f4x GHSA-p64p-v53q-vrgx GHSA-qcc9-6f3g-6mqp GHSA-wrf4-cx47-5mmh
2026-05-22 18:04:22 -07:00 · 2025-04-15 03:32:28 +00:00
parent 8ef729767c
commit e19e99fa59
15 changed files with 501 additions and 0 deletions
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2r74-wx33-5rv3",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-3613"
+  ],
+  "details": "A vulnerability has been found in Demtec Graphytics 5.0.7 and classified as problematic. This vulnerability affects unknown code of the file /visualization. The manipulation of the argument description leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3613"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/HexC0d3/graphlytic-xss-exploits/blob/main/stored_xss.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.304672"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.304672"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.551172"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:19Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3r6r-wrcf-h8fq",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32937"
+  ],
+  "details": "Rejected reason: Not used",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32937"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:17Z"
+  }
+}
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4328-m55p-39r7",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-3612"
+  ],
+  "details": "A vulnerability, which was classified as problematic, was found in Demtec Graphytics 5.0.7. This affects an unknown part of the file /visualization of the component HTTP GET Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3612"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/HexC0d3/graphlytic-xss-exploits/blob/main/reflected_xss.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.304671"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.304671"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.551123"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:18Z"
+  }
+}
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4www-5p9h-95mh",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32996"
+  ],
+  "details": "In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because \"else if\" is not used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32996"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chimurai/http-proxy-middleware/pull/1089"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chimurai/http-proxy-middleware/commit/020976044d113fc0bcbbaf995e91d05e2829a145"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.8"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.4"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-670"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:18Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5pxh-8mph-4xwx",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32933"
+  ],
+  "details": "Rejected reason: Not used",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32933"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:17Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-62m9-x279-9599",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32941"
+  ],
+  "details": "Rejected reason: Not used",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32941"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:18Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6979-hxmm-g3gw",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32935"
+  ],
+  "details": "Rejected reason: Not used",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32935"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:17Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7225-rpgx-xc83",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32934"
+  ],
+  "details": "Rejected reason: Not used",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32934"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:17Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8g4v-c2f9-p89g",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32987"
+  ],
+  "details": "Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in EVSearcher.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32987"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.veritas.com/support/en_US/security/ARC25-005"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-214"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T02:15:13Z"
+  }
+}
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9gqv-wp59-fq42",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32997"
+  ],
+  "details": "In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32997"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chimurai/http-proxy-middleware/pull/1096"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chimurai/http-proxy-middleware/commit/1bdccbeec243850f1d2bb50ea0ff2151e725d67e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.9"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-754"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:18Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9p6j-4hfc-5pxp",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32936"
+  ],
+  "details": "Rejected reason: Not used",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32936"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:17Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9pv6-23hr-9f4x",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32938"
+  ],
+  "details": "Rejected reason: Not used",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32938"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:17Z"
+  }
+}
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-p64p-v53q-vrgx",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-3470"
+  ],
+  "details": "The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the s parameter in all versions up to, and including, 2.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3470"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/poll-wp/tags/2.4.6/admin/class-ts_poll_list.php#L27"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e2dab05-97ce-4f53-8069-2577c5c25b16?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:18Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qcc9-6f3g-6mqp",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32940"
+  ],
+  "details": "Rejected reason: Not used",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32940"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:18Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wrf4-cx47-5mmh",
+  "modified": "2025-04-15T03:30:34Z",
+  "published": "2025-04-15T03:30:34Z",
+  "aliases": [
+    "CVE-2025-32939"
+  ],
+  "details": "Rejected reason: Not used",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32939"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-15T03:15:17Z"
+  }
+}