Publish Advisories

GHSA-2m3f-82cc-h56x
GHSA-4mxw-7rp7-fhjr
GHSA-6935-g2xg-qvf4

advisories/unreviewed/2025/04/GHSA-2m3f-82cc-h56x/GHSA-2m3f-82cc-h56x.json

@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2m3f-82cc-h56x",
+  "modified": "2025-04-22T09:30:35Z",
+  "published": "2025-04-22T09:30:35Z",
+  "aliases": [
+    "CVE-2025-3519"
+  ],
+  "details": "An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file.\n\nEvery uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3519"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-639"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-22T09:15:15Z"
+  }
+}

advisories/unreviewed/2025/04/GHSA-4mxw-7rp7-fhjr/GHSA-4mxw-7rp7-fhjr.json

@@ -0,0 +1,34 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4mxw-7rp7-fhjr",
+  "modified": "2025-04-22T09:30:35Z",
+  "published": "2025-04-22T09:30:35Z",
+  "aliases": [
+    "CVE-2025-3518"
+  ],
+  "details": "It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.\n\nThe file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless allows files to be uploaded through direct API requests. During the upload file, interception and allowed file type rules are still applied correctly.\n\nIf file sharing is generally enabled, this issue is not of concern.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3518"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-002"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-22T09:15:15Z"
+  }
+}

advisories/unreviewed/2025/04/GHSA-6935-g2xg-qvf4/GHSA-6935-g2xg-qvf4.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6935-g2xg-qvf4",
+  "modified": "2025-04-22T09:30:35Z",
+  "published": "2025-04-22T09:30:35Z",
+  "aliases": [
+    "CVE-2025-26413"
+  ],
+  "details": "Improper Input Validation vulnerability in Apache Kvrocks.\n\nThe SETRANGE command didn't check if the `offset` input is a positive integer and use it as an index\nof a string. So it will cause the server to crash due to its index is  out of range.\nThis issue affects Apache Kvrocks: through 2.11.1.\n\nUsers are recommended to upgrade to version 2.12.0, which fixes the issue.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26413"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/388743qrr8yq8qm0go8tls6rf1kog8dw"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2025/04/22/1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-04-22T08:15:28Z"
+  }
+}