Publish Advisories

GHSA-ff9h-848c-4xfj
GHSA-px2c-r924-mwcc

Author: advisory-database[bot]

…-ff9h-848c-4xfj/GHSA-ff9h-848c-4xfj.json …-ff9h-848c-4xfj/GHSA-ff9h-848c-4xfj.jsonadvisories/unreviewed/2025/06/GHSA-ff9h-848c-4xfj/GHSA-ff9h-848c-4xfj.json renamed to advisories/github-reviewed/2025/06/GHSA-ff9h-848c-4xfj/GHSA-ff9h-848c-4xfj.json advisories/unreviewed/2025/06/GHSA-ff9h-848c-4xfj/GHSA-ff9h-848c-4xfj.json renamed to advisories/github-reviewed/2025/06/GHSA-ff9h-848c-4xfj/GHSA-ff9h-848c-4xfj.json

@@ -1,24 +1,49 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ff9h-848c-4xfj",
-  "modified": "2025-06-17T21:32:08Z",
+  "modified": "2025-06-18T19:41:42Z",
   "published": "2025-06-12T18:31:48Z",
   "aliases": [
     "CVE-2025-29744"
   ],
+  "summary": "pg-promise SQL Injection vulnerability",
   "details": "pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "pg-promise"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "11.5.5"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29744"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/vitaly-t/pg-promise"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/vitaly-t/pg-promise/discussions/911"
@@ -33,8 +58,8 @@
       "CWE-89"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-06-18T19:41:41Z",
     "nvd_published_at": "2025-06-12T16:15:22Z"
   }
 }

…-px2c-r924-mwcc/GHSA-px2c-r924-mwcc.json …-px2c-r924-mwcc/GHSA-px2c-r924-mwcc.jsonadvisories/unreviewed/2025/06/GHSA-px2c-r924-mwcc/GHSA-px2c-r924-mwcc.json renamed to advisories/github-reviewed/2025/06/GHSA-px2c-r924-mwcc/GHSA-px2c-r924-mwcc.json advisories/unreviewed/2025/06/GHSA-px2c-r924-mwcc/GHSA-px2c-r924-mwcc.json renamed to advisories/github-reviewed/2025/06/GHSA-px2c-r924-mwcc/GHSA-px2c-r924-mwcc.json

@@ -1,24 +1,49 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-px2c-r924-mwcc",
-  "modified": "2025-06-18T15:31:15Z",
+  "modified": "2025-06-18T19:42:25Z",
   "published": "2025-06-18T15:31:15Z",
   "aliases": [
     "CVE-2025-49015"
   ],
+  "summary": "Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates",
   "details": "The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "NuGet",
+        "name": "CouchbaseNetClient"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "< 3.7.1"
+      }
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49015"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/couchbase/couchbase-net-client/commit/04d1679b2178f922036be6e595b3d91f972c5ba3"
+    },
     {
       "type": "WEB",
       "url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html"
@@ -27,6 +52,10 @@
       "type": "WEB",
       "url": "https://forums.couchbase.com/tags/security"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/couchbase/couchbase-net-client"
+    },
     {
       "type": "WEB",
       "url": "https://www.couchbase.com/alerts"
@@ -37,8 +66,8 @@
       "CWE-297"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-06-18T19:42:25Z",
     "nvd_published_at": "2025-06-18T14:15:44Z"
   }
 }