Skip to content

Commit 03932fd

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-rw99-6hrh-fmjr GHSA-2pfj-366p-4h7w GHSA-4cgv-84wm-gp2c GHSA-79wq-mgjf-5cc2 GHSA-9hqr-fq7x-7p43 GHSA-cqhp-94c2-gjjc GHSA-ffqv-44jp-mf9x GHSA-ffwc-xvf2-hgr5 GHSA-hj7x-hmf2-hc2p GHSA-jvjc-r7p7-fpch GHSA-m3q8-9565-h52h GHSA-q8c9-jmgv-gvcc GHSA-rhgj-mg62-rmgh GHSA-xwf4-w8f7-pwr9
1 parent d61e1c7 commit 03932fd

14 files changed

Lines changed: 242 additions & 19 deletions

File tree

‎advisories/unreviewed/2024/11/GHSA-rw99-6hrh-fmjr/GHSA-rw99-6hrh-fmjr.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rw99-6hrh-fmjr",
4-
"modified": "2025-02-06T06:31:25Z",
4+
"modified": "2026-03-24T18:31:25Z",
55
"published": "2024-11-07T18:31:23Z",
66
"aliases": [
77
"CVE-2024-10963"
@@ -19,6 +19,14 @@
1919
"type": "ADVISORY",
2020
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10963"
2121
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/linux-pam/linux-pam/issues/834"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/linux-pam/linux-pam/pull/835"
29+
},
2230
{
2331
"type": "WEB",
2432
"url": "https://access.redhat.com/errata/RHSA-2024:10232"

‎advisories/unreviewed/2026/03/GHSA-2pfj-366p-4h7w/GHSA-2pfj-366p-4h7w.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2pfj-366p-4h7w",
4+
"modified": "2026-03-24T18:31:37Z",
5+
"published": "2026-03-24T18:31:37Z",
6+
"aliases": [
7+
"CVE-2026-26809"
8+
],
9+
"details": "Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26809"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2026-03-24T18:16:08Z"
24+
}
25+
}

‎advisories/unreviewed/2026/03/GHSA-4cgv-84wm-gp2c/GHSA-4cgv-84wm-gp2c.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4cgv-84wm-gp2c",
4+
"modified": "2026-03-24T18:31:35Z",
5+
"published": "2026-03-24T18:31:35Z",
6+
"aliases": [
7+
"CVE-2025-71275"
8+
],
9+
"details": "Zimbra Collaboration Suite (ZCS) PostJournal service version 8.8.15 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by exploiting improper sanitization of the RCPT TO parameter via SMTP injection. Attackers can inject shell expansion syntax through the RCPT TO parameter to achieve remote code execution under the Zimbra service context.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71275"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://packetstorm.news/files/id/212108"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.vulncheck.com/advisories/zimbra-collaboration-suite-postjournal-unauthenticated-remote-code-execution-via-smtp-injection"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.zimbra.com"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-78"
42+
],
43+
"severity": "CRITICAL",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2026-03-24T16:16:27Z"
47+
}
48+
}

‎advisories/unreviewed/2026/03/GHSA-79wq-mgjf-5cc2/GHSA-79wq-mgjf-5cc2.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-79wq-mgjf-5cc2",
4-
"modified": "2026-03-23T21:30:51Z",
4+
"modified": "2026-03-24T18:31:28Z",
55
"published": "2026-03-23T21:30:51Z",
66
"aliases": [
77
"CVE-2025-52204"
88
],
99
"details": "A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-03-23T20:16:23Z"

‎advisories/unreviewed/2026/03/GHSA-9hqr-fq7x-7p43/GHSA-9hqr-fq7x-7p43.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@
3030
],
3131
"database_specific": {
3232
"cwe_ids": [
33-
"CWE-122"
33+
"CWE-122",
34+
"CWE-787"
3435
],
3536
"severity": "HIGH",
3637
"github_reviewed": false,

‎advisories/unreviewed/2026/03/GHSA-cqhp-94c2-gjjc/GHSA-cqhp-94c2-gjjc.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cqhp-94c2-gjjc",
4-
"modified": "2026-03-23T21:30:51Z",
4+
"modified": "2026-03-24T18:31:28Z",
55
"published": "2026-03-23T21:30:51Z",
66
"aliases": [
77
"CVE-2024-46879"
88
],
99
"details": "A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in Tiki version 21.2. This vulnerability allows attackers to execute arbitrary JavaScript code via a crafted payload, leading to potential access to sensitive information or unauthorized actions.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-03-23T20:16:22Z"

‎advisories/unreviewed/2026/03/GHSA-ffqv-44jp-mf9x/GHSA-ffqv-44jp-mf9x.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ffqv-44jp-mf9x",
4+
"modified": "2026-03-24T18:31:35Z",
5+
"published": "2026-03-24T18:31:35Z",
6+
"aliases": [
7+
"CVE-2026-29840"
8+
],
9+
"details": "JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering <script> tags but fails to recursively remove dangerous event handlers in other HTML tags (such as onerror in <img> tags). This allows an authenticated remote attacker to inject arbitrary web script or HTML via the body parameter in a POST request to /user/release.html.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29840"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://gist.github.com/w-p-man/790f51f918499798180a8def3a6fdfb0"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "http://www.demo.com/user/release/molds/article.html"
24+
}
25+
],
26+
"database_specific": {
27+
"cwe_ids": [],
28+
"severity": null,
29+
"github_reviewed": false,
30+
"github_reviewed_at": null,
31+
"nvd_published_at": "2026-03-24T16:16:30Z"
32+
}
33+
}

‎advisories/unreviewed/2026/03/GHSA-ffwc-xvf2-hgr5/GHSA-ffwc-xvf2-hgr5.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
],
3131
"database_specific": {
3232
"cwe_ids": [
33+
"CWE-190",
3334
"CWE-472"
3435
],
3536
"severity": "HIGH",

‎advisories/unreviewed/2026/03/GHSA-hj7x-hmf2-hc2p/GHSA-hj7x-hmf2-hc2p.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hj7x-hmf2-hc2p",
4-
"modified": "2026-03-23T18:30:31Z",
4+
"modified": "2026-03-24T18:31:27Z",
55
"published": "2026-03-23T15:30:44Z",
66
"aliases": [
77
"CVE-2026-4404"
@@ -34,6 +34,10 @@
3434
{
3535
"type": "WEB",
3636
"url": "https://goharbor.io/docs/1.10/install-config/run-installer-script/#:~:text=If%20you%20did%20not%20change%20them%20in%20harbor.yml,%20the%20default%20administrator%20username%20and%20password%20are%20admin%20and%20Harbor12345"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.kb.cert.org/vuls/id/577436"
3741
}
3842
],
3943
"database_specific": {

‎advisories/unreviewed/2026/03/GHSA-jvjc-r7p7-fpch/GHSA-jvjc-r7p7-fpch.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jvjc-r7p7-fpch",
4-
"modified": "2026-03-23T21:30:51Z",
4+
"modified": "2026-03-24T18:31:28Z",
55
"published": "2026-03-23T21:30:51Z",
66
"aliases": [
77
"CVE-2024-46878"
88
],
99
"details": "A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier. This vulnerability allows attackers to execute arbitrary JavaScript code via a crafted payload, leading to potential access to sensitive information or unauthorized actions.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-79"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2026-03-23T20:16:22Z"

0 commit comments

Comments
 (0)