Skip to content

Commit 4aba296

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7q9f-ppr5-2mfg GHSA-m236-84g9-jvrg GHSA-w3g9-vqjw-3qr3 GHSA-w5qj-7xqm-q39c GHSA-xfvg-p8x9-f25q
1 parent e4bc123 commit 4aba296

5 files changed

Lines changed: 188 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/01/GHSA-7q9f-ppr5-2mfg/GHSA-7q9f-ppr5-2mfg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7q9f-ppr5-2mfg",
4+
"modified": "2026-01-22T03:31:28Z",
5+
"published": "2026-01-22T03:31:28Z",
6+
"aliases": [
7+
"CVE-2025-27380"
8+
],
9+
"details": "HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27380"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.altium.com/platform/security-compliance/security-advisories"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T02:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-m236-84g9-jvrg/GHSA-m236-84g9-jvrg.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m236-84g9-jvrg",
4+
"modified": "2026-01-22T03:31:27Z",
5+
"published": "2026-01-22T03:31:27Z",
6+
"aliases": [
7+
"CVE-2025-27378"
8+
],
9+
"details": "AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execute arbitrary SQL queries.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27378"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.altium.com/platform/security-compliance/security-advisories"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-20"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T01:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-w3g9-vqjw-3qr3/GHSA-w3g9-vqjw-3qr3.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w3g9-vqjw-3qr3",
4+
"modified": "2026-01-22T03:31:28Z",
5+
"published": "2026-01-22T03:31:28Z",
6+
"aliases": [
7+
"CVE-2026-23699"
8+
],
9+
"details": "AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23699"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://jvn.jp/en/jp/JVN86850670"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.ruijie.co.jp/products/rg-ap180-pe_p432111650928590848.html#productDocument"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2026-01-22T02:15:52Z"
43+
}
44+
}

‎advisories/unreviewed/2026/01/GHSA-w5qj-7xqm-q39c/GHSA-w5qj-7xqm-q39c.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w5qj-7xqm-q39c",
4+
"modified": "2026-01-22T03:31:28Z",
5+
"published": "2026-01-22T03:31:28Z",
6+
"aliases": [
7+
"CVE-2025-27379"
8+
],
9+
"details": "A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27379"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.altium.com/platform/security-compliance/security-advisories"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T02:15:51Z"
35+
}
36+
}

‎advisories/unreviewed/2026/01/GHSA-xfvg-p8x9-f25q/GHSA-xfvg-p8x9-f25q.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xfvg-p8x9-f25q",
4+
"modified": "2026-01-22T03:31:27Z",
5+
"published": "2026-01-22T03:31:27Z",
6+
"aliases": [
7+
"CVE-2025-27377"
8+
],
9+
"details": "Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capable of performing a man-in-the-middle (MITM) attack could exploit this issue to intercept or manipulate network traffic, potentially exposing authentication credentials or sensitive design data.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27377"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.altium.com/platform/security-compliance/security-advisories"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-295"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-01-22T01:15:50Z"
35+
}
36+
}

0 commit comments

Comments
 (0)