Skip to content

Commit a7a1ae9

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 81f2550 commit a7a1ae9

File tree

29 files changed

+476
-74
lines changed

29 files changed

+476
-74
lines changed

‎advisories/github-reviewed/2022/03/GHSA-ffmm-5ww2-g3q4/GHSA-ffmm-5ww2-g3q4.json

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ffmm-5ww2-g3q4",
4+
"modified": "2025-07-15T18:32:01Z",
5+
"published": "2022-03-04T00:00:20Z",
6+
"aliases": [
7+
"CVE-2021-38263"
8+
],
9+
"summary": "Liferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script console",
10+
"details": "Liferay Server Admin Web before 4.0.12 from Liferay Portal v7.3.2 and below and Liferay DXP v7.0 and below were discovered to contain a cross-site scripting (XSS) vulnerability via the script console under the Server module.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.liferay:com.liferay.server.admin.web"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.0.12"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "com.liferay.portal:release.dxp.bom"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"last_affected": "7.0"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38263"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/liferay/liferay-portal/commit/1abb1bfc96242065f97c2828a02350ea2174f5f6"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/liferay/liferay-portal/commit/771d99805b7ca69fecfcf67be5e24f2c1af1d0bb"
69+
},
70+
{
71+
"type": "PACKAGE",
72+
"url": "https://github.com/liferay/liferay-portal"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://issues.liferay.com/browse/LPE-17061"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38263-reflected-xss-with-script-page?p_r_p_assetEntryId=121611737&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611737%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"
81+
},
82+
{
83+
"type": "WEB",
84+
"url": "http://liferay.com"
85+
}
86+
],
87+
"database_specific": {
88+
"cwe_ids": [
89+
"CWE-79"
90+
],
91+
"severity": "MODERATE",
92+
"github_reviewed": true,
93+
"github_reviewed_at": "2025-07-15T18:32:01Z",
94+
"nvd_published_at": "2022-03-03T00:15:00Z"
95+
}
96+
}

‎advisories/unreviewed/2022/03/GHSA-ffmm-5ww2-g3q4/GHSA-ffmm-5ww2-g3q4.json

Lines changed: 0 additions & 44 deletions
This file was deleted.

‎advisories/unreviewed/2024/06/GHSA-2q7f-pr29-qfh5/GHSA-2q7f-pr29-qfh5.json

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2q7f-pr29-qfh5",
4-
"modified": "2024-07-03T18:44:41Z",
4+
"modified": "2025-07-15T18:31:10Z",
55
"published": "2024-06-11T00:30:40Z",
66
"aliases": [
77
"CVE-2024-36471"
88
],
9-
"details": "Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them.\n\nThis issue affects Apache Allura from 1.0.1 through 1.16.0.\n\nUsers are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set \"disable_entry_points.allura.importers = forge-tracker, forge-discussion\" in your .ini config file.\n\n",
9+
"details": "Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them.\n\nThis issue affects Apache Allura from 1.0.1 through 1.16.0.\n\nUsers are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set \"disable_entry_points.allura.importers = forge-tracker, forge-discussion\" in your .ini config file.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",
@@ -22,6 +22,10 @@
2222
{
2323
"type": "WEB",
2424
"url": "https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "http://www.openwall.com/lists/oss-security/2024/06/10/1"
2529
}
2630
],
2731
"database_specific": {

‎advisories/unreviewed/2025/05/GHSA-rmx6-3w23-whmj/GHSA-rmx6-3w23-whmj.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rmx6-3w23-whmj",
4-
"modified": "2025-05-13T18:30:53Z",
4+
"modified": "2025-07-15T18:31:15Z",
55
"published": "2025-05-13T18:30:53Z",
66
"aliases": [
77
"CVE-2024-6364"
88
],
99
"details": "A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both physical access to the device, and full hostile network control, to initiate OS commands on the device. To remediate this vulnerability, update the device firmware to the latest available version. Please contact the device manufacturer for upgrade instructions or contact Absolute Security, see reference below.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:P/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/06/GHSA-cw23-897m-qmhx/GHSA-cw23-897m-qmhx.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cw23-897m-qmhx",
4-
"modified": "2025-06-06T09:30:25Z",
4+
"modified": "2025-07-15T18:31:16Z",
55
"published": "2025-06-06T09:30:25Z",
66
"aliases": [
77
"CVE-2025-5703"

‎advisories/unreviewed/2025/07/GHSA-25r2-9vcc-j43c/GHSA-25r2-9vcc-j43c.json

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-25r2-9vcc-j43c",
4+
"modified": "2025-07-15T18:31:26Z",
5+
"published": "2025-07-15T18:31:26Z",
6+
"aliases": [
7+
"CVE-2025-52080"
8+
],
9+
"details": "In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing the share_name parameter.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52080"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/lafdrew/IOT/blob/main/Netgear%20XR300/share_name%20of%20usb_device.cgi/buffer%20overflow%20in%20share_neme%20of%20usb_device.cgi.md"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [],
24+
"severity": null,
25+
"github_reviewed": false,
26+
"github_reviewed_at": null,
27+
"nvd_published_at": "2025-07-15T16:15:37Z"
28+
}
29+
}

‎advisories/unreviewed/2025/07/GHSA-2w98-h9rr-xfqq/GHSA-2w98-h9rr-xfqq.json

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2w98-h9rr-xfqq",
4+
"modified": "2025-07-15T18:31:26Z",
5+
"published": "2025-07-15T18:31:26Z",
6+
"aliases": [
7+
"CVE-2024-42650"
8+
],
9+
"details": "NanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq/pub_handler.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42650"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/emqx/nanomq/issues/1168"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/nanomq/nanomq/pull/1170"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/nanomq/nanomq"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2025-07-15T16:15:36Z"
36+
}
37+
}

‎advisories/unreviewed/2025/07/GHSA-43hc-f4q4-g3vc/GHSA-43hc-f4q4-g3vc.json

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-43hc-f4q4-g3vc",
4+
"modified": "2025-07-15T18:31:26Z",
5+
"published": "2025-07-15T18:31:26Z",
6+
"aliases": [
7+
"CVE-2025-26186"
8+
],
9+
"details": "SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26186"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/OS4ED/openSIS-Classic/pull/330"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.os4ed.com"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-07-15T17:15:26Z"
39+
}
40+
}

‎advisories/unreviewed/2025/07/GHSA-56rg-32wr-38cm/GHSA-56rg-32wr-38cm.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-119"
49+
"CWE-119",
50+
"CWE-120"
5051
],
5152
"severity": "HIGH",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/07/GHSA-577h-64qr-v55r/GHSA-577h-64qr-v55r.json

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-577h-64qr-v55r",
4-
"modified": "2025-07-14T12:30:28Z",
4+
"modified": "2025-07-15T18:31:23Z",
55
"published": "2025-07-14T12:30:28Z",
66
"aliases": [
77
"CVE-2024-51770"
88
],
99
"details": "An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -20,8 +25,10 @@
2025
}
2126
],
2227
"database_specific": {
23-
"cwe_ids": [],
24-
"severity": null,
28+
"cwe_ids": [
29+
"CWE-497"
30+
],
31+
"severity": "HIGH",
2532
"github_reviewed": false,
2633
"github_reviewed_at": null,
2734
"nvd_published_at": "2025-07-14T11:15:22Z"

0 commit comments

Comments
 (0)