Skip to content

Commit 02a82b4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 7b94b8e commit 02a82b4

43 files changed

Lines changed: 707 additions & 102 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎advisories/github-reviewed/2022/05/GHSA-887v-xh2x-47cm/GHSA-887v-xh2x-47cm.json‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-887v-xh2x-47cm",
4+
"modified": "2026-01-12T18:30:08Z",
5+
"published": "2022-05-24T17:21:05Z",
6+
"aliases": [
7+
"CVE-2017-18893"
8+
],
9+
"summary": "Mattermost Server is vulnerable to XSS through display name field",
10+
"details": "An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.0.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/mattermost/mattermost-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "4.1.0"
48+
},
49+
{
50+
"fixed": "4.1.1"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/mattermost/mattermost-server"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "4.2.0-rc1"
67+
},
68+
{
69+
"fixed": "4.2.0"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "ADVISORY",
79+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18893"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/mattermost/mattermost/commit/2a4d88d07c5815deac103e109550d25338507151"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/mattermost/mattermost/commit/670bfbf62686ebe9f2ab332733d851a62b6950b0"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/mattermost/mattermost/commit/d0b42b9e527e93a61fd06a9b9106fc97067807e4"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/mattermost/mattermost"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://mattermost.com/security-updates"
100+
}
101+
],
102+
"database_specific": {
103+
"cwe_ids": [
104+
"CWE-79"
105+
],
106+
"severity": "MODERATE",
107+
"github_reviewed": true,
108+
"github_reviewed_at": "2026-01-12T18:30:08Z",
109+
"nvd_published_at": "2020-06-19T19:15:00Z"
110+
}
111+
}

‎advisories/unreviewed/2022/05/GHSA-887v-xh2x-47cm/GHSA-887v-xh2x-47cm.json‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎advisories/unreviewed/2025/01/GHSA-vvc3-x74m-rg8v/GHSA-vvc3-x74m-rg8v.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@
2626
],
2727
"database_specific": {
2828
"cwe_ids": [
29-
"CWE-121"
29+
"CWE-121",
30+
"CWE-787"
3031
],
3132
"severity": "HIGH",
3233
"github_reviewed": false,

‎advisories/unreviewed/2025/09/GHSA-45h6-97cw-2x6c/GHSA-45h6-97cw-2x6c.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-45h6-97cw-2x6c",
4-
"modified": "2025-11-03T18:31:39Z",
4+
"modified": "2026-01-12T18:30:19Z",
55
"published": "2025-09-05T18:31:27Z",
66
"aliases": [
77
"CVE-2025-39714"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: usbtv: Lock resolution while streaming\n\nWhen an program is streaming (ffplay) and another program (qv4l2)\nchanges the TV standard from NTSC to PAL, the kernel crashes due to trying\nto copy to unmapped memory.\n\nChanging from NTSC to PAL increases the resolution in the usbtv struct,\nbut the video plane buffer isn't adjusted, so it overflows.\n\n[hverkuil: call vb2_is_busy instead of vb2_is_streaming]",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -57,7 +62,7 @@
5762
],
5863
"database_specific": {
5964
"cwe_ids": [],
60-
"severity": null,
65+
"severity": "MODERATE",
6166
"github_reviewed": false,
6267
"github_reviewed_at": null,
6368
"nvd_published_at": "2025-09-05T18:15:48Z"

‎advisories/unreviewed/2025/09/GHSA-cvwp-768v-w5r3/GHSA-cvwp-768v-w5r3.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cvwp-768v-w5r3",
4-
"modified": "2025-11-03T18:31:39Z",
4+
"modified": "2026-01-12T18:30:19Z",
55
"published": "2025-09-05T18:31:27Z",
66
"aliases": [
77
"CVE-2025-39710"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: Add a check for packet size after reading from shared memory\n\nAdd a check to ensure that the packet size does not exceed the number of\navailable words after reading the packet header from shared memory. This\nensures that the size provided by the firmware is safe to process and\nprevent potential out-of-bounds memory access.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -56,8 +61,10 @@
5661
}
5762
],
5863
"database_specific": {
59-
"cwe_ids": [],
60-
"severity": null,
64+
"cwe_ids": [
65+
"CWE-125"
66+
],
67+
"severity": "HIGH",
6168
"github_reviewed": false,
6269
"github_reviewed_at": null,
6370
"nvd_published_at": "2025-09-05T18:15:48Z"

‎advisories/unreviewed/2025/09/GHSA-frvj-f982-mfmx/GHSA-frvj-f982-mfmx.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-frvj-f982-mfmx",
4-
"modified": "2025-11-03T18:31:40Z",
4+
"modified": "2026-01-12T18:30:19Z",
55
"published": "2025-09-07T18:31:27Z",
66
"aliases": [
77
"CVE-2025-39730"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix filehandle bounds checking in nfs_fh_to_dentry()\n\nThe function needs to check the minimal filehandle length before it can\naccess the embedded filehandle.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -61,7 +66,7 @@
6166
],
6267
"database_specific": {
6368
"cwe_ids": [],
64-
"severity": null,
69+
"severity": "HIGH",
6570
"github_reviewed": false,
6671
"github_reviewed_at": null,
6772
"nvd_published_at": "2025-09-07T16:15:48Z"

‎advisories/unreviewed/2025/09/GHSA-jx3q-xcpc-36h3/GHSA-jx3q-xcpc-36h3.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jx3q-xcpc-36h3",
4-
"modified": "2025-11-03T18:31:40Z",
4+
"modified": "2026-01-12T18:30:19Z",
55
"published": "2025-09-05T18:31:27Z",
66
"aliases": [
77
"CVE-2025-39724"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: fix panic due to PSLVERR\n\nWhen the PSLVERR_RESP_EN parameter is set to 1, the device generates\nan error response if an attempt is made to read an empty RBR (Receive\nBuffer Register) while the FIFO is enabled.\n\nIn serial8250_do_startup(), calling serial_port_out(port, UART_LCR,\nUART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes\ndw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter\nfunction enables the FIFO via serial_out(p, UART_FCR, p->fcr).\nExecution proceeds to the serial_port_in(port, UART_RX).\nThis satisfies the PSLVERR trigger condition.\n\nWhen another CPU (e.g., using printk()) is accessing the UART (UART\nis busy), the current CPU fails the check (value & ~UART_LCR_SPAR) ==\n(lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter\ndw8250_force_idle().\n\nPut serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock\nto fix this issue.\n\nPanic backtrace:\n[ 0.442336] Oops - unknown exception [#1]\n[ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a\n[ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e\n...\n[ 0.442416] console_on_rootfs+0x26/0x70",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -57,7 +62,7 @@
5762
],
5863
"database_specific": {
5964
"cwe_ids": [],
60-
"severity": null,
65+
"severity": "MODERATE",
6166
"github_reviewed": false,
6267
"github_reviewed_at": null,
6368
"nvd_published_at": "2025-09-05T18:15:50Z"

‎advisories/unreviewed/2025/09/GHSA-wh65-53hg-mxpv/GHSA-wh65-53hg-mxpv.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wh65-53hg-mxpv",
4-
"modified": "2025-11-03T18:31:40Z",
4+
"modified": "2026-01-12T18:30:19Z",
55
"published": "2025-09-07T18:31:27Z",
66
"aliases": [
77
"CVE-2025-39734"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"fs/ntfs3: Replace inode_trylock with inode_lock\"\n\nThis reverts commit 69505fe98f198ee813898cbcaf6770949636430b.\n\nInitially, conditional lock acquisition was removed to fix an xfstest bug\nthat was observed during internal testing. The deadlock reported by syzbot\nis resolved by reintroducing conditional acquisition. The xfstest bug no\nlonger occurs on kernel version 6.16-rc1 during internal testing. I\nassume that changes in other modules may have contributed to this.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -49,7 +54,7 @@
4954
],
5055
"database_specific": {
5156
"cwe_ids": [],
52-
"severity": null,
57+
"severity": "MODERATE",
5358
"github_reviewed": false,
5459
"github_reviewed_at": null,
5560
"nvd_published_at": "2025-09-07T16:15:50Z"

‎advisories/unreviewed/2025/12/GHSA-9247-4234-vwrq/GHSA-9247-4234-vwrq.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9247-4234-vwrq",
4-
"modified": "2025-12-10T12:31:27Z",
4+
"modified": "2026-01-12T18:30:20Z",
55
"published": "2025-12-10T12:31:27Z",
66
"aliases": [
77
"CVE-2025-7073"
88
],
99
"details": "A local privilege escalation vulnerability in Bitdefender Total Security 27.0.46.231 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\\ProgramData\\Atc\\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation during network events and a filter driver bypass via DLL injection to achieve arbitrary file copy and code execution as elevated user.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

‎advisories/unreviewed/2025/12/GHSA-mhwg-hvw8-9w84/GHSA-mhwg-hvw8-9w84.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mhwg-hvw8-9w84",
4-
"modified": "2025-12-12T00:30:20Z",
4+
"modified": "2026-01-12T18:30:21Z",
55
"published": "2025-12-12T00:30:20Z",
66
"aliases": [
77
"CVE-2024-58289"
88
],
99
"details": "Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields. Attackers can input script payloads in the first name field that will execute when the profile is viewed by other users, potentially stealing session cookies and executing arbitrary JavaScript.",
1010
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
},
1115
{
1216
"type": "CVSS_V4",
1317
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"

0 commit comments

Comments
 (0)