Skip to content

Commit 935f5c6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-hp97-5x6g-q538 GHSA-6638-j9qv-jr95 GHSA-2hh4-c6pj-8p6j GHSA-483x-j2mh-6x95 GHSA-4qjg-x4v4-w4j9 GHSA-5f97-9cgp-7wqg GHSA-7vq6-w2cf-mm9v GHSA-83j7-mhw9-388w GHSA-86cj-mgp6-w7fc GHSA-8rcq-pppp-w23j GHSA-9ch4-p9xc-vmxf GHSA-f8vw-8vgh-22r9 GHSA-gjq7-wpxp-5486 GHSA-hp97-5x6g-q538 GHSA-jpfc-4529-pj3r GHSA-m5hw-rhvr-f47c GHSA-qxm8-6xvg-w483 GHSA-r7q6-6fmq-mx4c GHSA-v39q-7g48-xfwh GHSA-vgw5-5g2p-cv79 GHSA-xhf7-73h5-3689
1 parent f93a10d commit 935f5c6

File tree

21 files changed

+470
-54
lines changed

21 files changed

+470
-54
lines changed

‎advisories/github-reviewed/2025/07/GHSA-hp97-5x6g-q538/GHSA-hp97-5x6g-q538.json

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hp97-5x6g-q538",
4+
"modified": "2025-07-18T15:31:33Z",
5+
"published": "2025-07-16T12:30:22Z",
6+
"aliases": [
7+
"CVE-2024-10031"
8+
],
9+
"summary": "Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications",
10+
"details": "In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.glassfish.main.admingui:console-common"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "7.0.25"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10031"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/eclipse-ee4j/glassfish"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/41"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/229"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-79"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-07-18T15:31:22Z",
63+
"nvd_published_at": "2025-07-16T11:15:23Z"
64+
}
65+
}

‎advisories/unreviewed/2025/06/GHSA-6638-j9qv-jr95/GHSA-6638-j9qv-jr95.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-119"
49+
"CWE-119",
50+
"CWE-120"
5051
],
5152
"severity": "HIGH",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/07/GHSA-2hh4-c6pj-8p6j/GHSA-2hh4-c6pj-8p6j.json

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hh4-c6pj-8p6j",
4+
"modified": "2025-07-18T15:31:57Z",
5+
"published": "2025-07-18T15:31:57Z",
6+
"aliases": [
7+
"CVE-2025-46000"
8+
],
9+
"details": "An arbitrary file upload vulnerability in the component /rsc/filemanager.rsc.class.php of Filemanager commit c75b914 v.2.5.0 allows attackers to execute arbitrary code via uploading a crafted SVG file.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46000"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/simogeo/Filemanager/commit/c75b914"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://github.com/simogeo/Filemanager"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "https://github.com/zakumini/CVE-List/blob/main/CVE-2025-46000/CVE-2025-46000.md"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [],
32+
"severity": null,
33+
"github_reviewed": false,
34+
"github_reviewed_at": null,
35+
"nvd_published_at": "2025-07-18T15:15:27Z"
36+
}
37+
}

‎advisories/unreviewed/2025/07/GHSA-483x-j2mh-6x95/GHSA-483x-j2mh-6x95.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@
4646
],
4747
"database_specific": {
4848
"cwe_ids": [
49-
"CWE-77"
49+
"CWE-77",
50+
"CWE-78"
5051
],
5152
"severity": "HIGH",
5253
"github_reviewed": false,

‎advisories/unreviewed/2025/07/GHSA-4qjg-x4v4-w4j9/GHSA-4qjg-x4v4-w4j9.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-502"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/07/GHSA-5f97-9cgp-7wqg/GHSA-5f97-9cgp-7wqg.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-601"
30+
],
2931
"severity": "CRITICAL",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/07/GHSA-7vq6-w2cf-mm9v/GHSA-7vq6-w2cf-mm9v.json

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7vq6-w2cf-mm9v",
4+
"modified": "2025-07-18T15:31:58Z",
5+
"published": "2025-07-18T15:31:57Z",
6+
"aliases": [
7+
"CVE-2025-7788"
8+
],
9+
"details": "A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of the file src\\main\\java\\com\\xxl\\job\\executor\\service\\jobhandler\\SampleXxlJob.java. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7788"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/xuxueli/xxl-job/issues/3750"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.316849"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.316849"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.615758"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-77"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-07-18T15:15:31Z"
51+
}
52+
}

‎advisories/unreviewed/2025/07/GHSA-83j7-mhw9-388w/GHSA-83j7-mhw9-388w.json

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-83j7-mhw9-388w",
4+
"modified": "2025-07-18T15:31:57Z",
5+
"published": "2025-07-18T15:31:57Z",
6+
"aliases": [
7+
"CVE-2025-7784"
8+
],
9+
"details": "A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7784"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2025-7784"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2381861"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-269"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-07-18T14:15:26Z"
39+
}
40+
}

‎advisories/unreviewed/2025/07/GHSA-86cj-mgp6-w7fc/GHSA-86cj-mgp6-w7fc.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@
4242
],
4343
"database_specific": {
4444
"cwe_ids": [
45-
"CWE-77"
45+
"CWE-77",
46+
"CWE-78"
4647
],
4748
"severity": "MODERATE",
4849
"github_reviewed": false,

‎advisories/unreviewed/2025/07/GHSA-8rcq-pppp-w23j/GHSA-8rcq-pppp-w23j.json

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8rcq-pppp-w23j",
4-
"modified": "2025-07-17T21:32:14Z",
4+
"modified": "2025-07-18T15:31:55Z",
55
"published": "2025-07-17T21:32:14Z",
66
"aliases": [
77
"CVE-2025-50240"
88
],
99
"details": "nbcio-boot v1.0.3 was discovered to contain a SQL injection vulnerability via the userIds parameter at /sys/user/deleteRecycleBin.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2025-07-17T19:15:25Z"

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy