Skip to content

Commit 82d542a

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2hxg-84pv-j2pg GHSA-9x53-gr7p-4qf5 GHSA-gg23-wpg2-g99p GHSA-jrg5-jw7r-rxg9 GHSA-mpgj-hch9-5rvx GHSA-qg5r-cf83-38vj GHSA-v2wx-jg5q-pj8q GHSA-vmm8-7mqp-x9cx
1 parent 8cc6f2c commit 82d542a

8 files changed

Lines changed: 330 additions & 0 deletions

File tree

‎advisories/unreviewed/2025/06/GHSA-2hxg-84pv-j2pg/GHSA-2hxg-84pv-j2pg.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2hxg-84pv-j2pg",
4+
"modified": "2025-06-19T12:30:34Z",
5+
"published": "2025-06-19T12:30:34Z",
6+
"aliases": [
7+
"CVE-2025-6266"
8+
],
9+
"details": "A vulnerability was found in FLIR AX8 up to 1.46. It has been declared as critical. This vulnerability affects unknown code of the file /upload.php. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6266"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/YZS17/CVE/blob/main/FLIR-AX8/Unauthority_file_upload_vulnerabililty.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.313270"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.313270"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.586692"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-284"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-06-19T12:15:20Z"
51+
}
52+
}

‎advisories/unreviewed/2025/06/GHSA-9x53-gr7p-4qf5/GHSA-9x53-gr7p-4qf5.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9x53-gr7p-4qf5",
4+
"modified": "2025-06-19T12:30:34Z",
5+
"published": "2025-06-19T12:30:34Z",
6+
"aliases": [
7+
"CVE-2025-32896"
8+
],
9+
"details": "# Summary\n\nUnauthorized users can perform Arbitrary File Read and Deserialization\nattack by submit job using restful api-v1.\n\n# Details\nUnauthorized users can access `/hazelcast/rest/maps/submit-job` to submit\njob.\nAn attacker can set extra params in mysql url to perform Arbitrary File\nRead and Deserialization attack.\n\nThis issue affects Apache SeaTunnel: <=2.3.10\n\n# Fixed\n\nUsers are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32896"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://github.com/apache/seatunnel/pull/9010"
20+
},
21+
{
22+
"type": "WEB",
23+
"url": "https://lists.apache.org/thread/qvh3zyt1jr25rgvw955rb8qjrnbxfro9"
24+
},
25+
{
26+
"type": "WEB",
27+
"url": "http://www.openwall.com/lists/oss-security/2025/04/12/1"
28+
}
29+
],
30+
"database_specific": {
31+
"cwe_ids": [
32+
"CWE-306"
33+
],
34+
"severity": null,
35+
"github_reviewed": false,
36+
"github_reviewed_at": null,
37+
"nvd_published_at": "2025-06-19T11:15:24Z"
38+
}
39+
}

‎advisories/unreviewed/2025/06/GHSA-gg23-wpg2-g99p/GHSA-gg23-wpg2-g99p.json‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gg23-wpg2-g99p",
4+
"modified": "2025-06-19T12:30:34Z",
5+
"published": "2025-06-19T12:30:34Z",
6+
"aliases": [
7+
"CVE-2025-5071"
8+
],
9+
"details": "The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like 'wp_create_user', 'wp_update_user' and 'wp_update_option', which can be used for privilege escalation, and 'wp_update_post', 'wp_delete_post', 'wp_update_comment' and 'wp_delete_comment', which can be used to edit and delete posts and comments.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5071"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.8.1/labs/mcp.php#L43"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3313554/ai-engine#file21"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7654a1-0020-4bf1-86be-bdb238a9fe0d?source=cve"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-863"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-06-19T10:15:22Z"
43+
}
44+
}

‎advisories/unreviewed/2025/06/GHSA-jrg5-jw7r-rxg9/GHSA-jrg5-jw7r-rxg9.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jrg5-jw7r-rxg9",
4+
"modified": "2025-06-19T12:30:33Z",
5+
"published": "2025-06-19T12:30:33Z",
6+
"aliases": [
7+
"CVE-2025-49763"
8+
],
9+
"details": "ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.\n\nUsers can use a new setting for the plugin (--max-inclusion-depth) to limit it.\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.\n\nUsers are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49763"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-400"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2025-06-19T10:15:21Z"
30+
}
31+
}

‎advisories/unreviewed/2025/06/GHSA-mpgj-hch9-5rvx/GHSA-mpgj-hch9-5rvx.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mpgj-hch9-5rvx",
4+
"modified": "2025-06-19T12:30:34Z",
5+
"published": "2025-06-19T12:30:34Z",
6+
"aliases": [
7+
"CVE-2025-6019"
8+
],
9+
"details": "A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the \"allow_active\" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an \"allow_active\" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6019"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://access.redhat.com/security/cve/CVE-2025-6019"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370051"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00018.html"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "http://www.openwall.com/lists/oss-security/2025/06/17/5"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "http://www.openwall.com/lists/oss-security/2025/06/17/6"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "http://www.openwall.com/lists/oss-security/2025/06/18/1"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-250"
50+
],
51+
"severity": "HIGH",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2025-06-19T12:15:19Z"
55+
}
56+
}

‎advisories/unreviewed/2025/06/GHSA-qg5r-cf83-38vj/GHSA-qg5r-cf83-38vj.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qg5r-cf83-38vj",
4+
"modified": "2025-06-19T12:30:34Z",
5+
"published": "2025-06-19T12:30:34Z",
6+
"aliases": [
7+
"CVE-2005-2347"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2347"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-06-19T11:15:23Z"
24+
}
25+
}

‎advisories/unreviewed/2025/06/GHSA-v2wx-jg5q-pj8q/GHSA-v2wx-jg5q-pj8q.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v2wx-jg5q-pj8q",
4+
"modified": "2025-06-19T12:30:33Z",
5+
"published": "2025-06-19T12:30:33Z",
6+
"aliases": [
7+
"CVE-2025-31698"
8+
],
9+
"details": "ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol.\n\nUsers can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. \nThis issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10.\n\nUsers are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31698"
16+
},
17+
{
18+
"type": "WEB",
19+
"url": "https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8"
20+
}
21+
],
22+
"database_specific": {
23+
"cwe_ids": [
24+
"CWE-284"
25+
],
26+
"severity": null,
27+
"github_reviewed": false,
28+
"github_reviewed_at": null,
29+
"nvd_published_at": "2025-06-19T10:15:20Z"
30+
}
31+
}

‎advisories/unreviewed/2025/06/GHSA-vmm8-7mqp-x9cx/GHSA-vmm8-7mqp-x9cx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vmm8-7mqp-x9cx",
4+
"modified": "2025-06-19T12:30:34Z",
5+
"published": "2025-06-19T12:30:34Z",
6+
"aliases": [
7+
"CVE-2025-5234"
8+
],
9+
"details": "The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/gutenverse-news/tags/1.0.4/include/class/block/class-grab.php#L71"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/changeset/3313123"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/changeset/3313123/gutenverse-news/trunk/include/class/block/class-grab.php"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://wordpress.org/plugins/gutenverse-news/#developers"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b1f60a-3a13-4679-af3e-d6f95fd83cea?source=cve"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-06-19T10:15:22Z"
51+
}
52+
}

0 commit comments

Comments
 (0)