Skip to content

Commit a901f76

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2jx2-cgj2-48wc GHSA-4wg5-h4j2-p56c GHSA-568g-56p5-cj7r GHSA-c8jf-qq3r-v2h7 GHSA-jm7r-f6p7-h29v GHSA-m3rx-6qww-mhm3
1 parent 97b2293 commit a901f76

File tree

6 files changed

+210
-0
lines changed

6 files changed

+210
-0
lines changed

‎advisories/unreviewed/2025/05/GHSA-2jx2-cgj2-48wc/GHSA-2jx2-cgj2-48wc.json

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2jx2-cgj2-48wc",
4+
"modified": "2025-05-23T00:30:19Z",
5+
"published": "2025-05-23T00:30:19Z",
6+
"aliases": [
7+
"CVE-2025-4338"
8+
],
9+
"details": "Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4338"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-142-01"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.lantronix.com/products/lantronix-provisioning-manager"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-611"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-05-22T23:15:19Z"
43+
}
44+
}

‎advisories/unreviewed/2025/05/GHSA-4wg5-h4j2-p56c/GHSA-4wg5-h4j2-p56c.json

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4wg5-h4j2-p56c",
4+
"modified": "2025-05-23T00:30:19Z",
5+
"published": "2025-05-23T00:30:19Z",
6+
"aliases": [
7+
"CVE-2025-4642"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4642"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-05-22T23:15:19Z"
24+
}
25+
}

‎advisories/unreviewed/2025/05/GHSA-568g-56p5-cj7r/GHSA-568g-56p5-cj7r.json

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-568g-56p5-cj7r",
4+
"modified": "2025-05-23T00:30:19Z",
5+
"published": "2025-05-23T00:30:19Z",
6+
"aliases": [
7+
"CVE-2025-4975"
8+
],
9+
"details": "When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4975"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://play.google.com/store/apps/details?id=com.tplink.iot&hl=en_US"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.tp-link.com/us/support/faq/4464"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-269"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-05-22T22:15:31Z"
39+
}
40+
}

‎advisories/unreviewed/2025/05/GHSA-c8jf-qq3r-v2h7/GHSA-c8jf-qq3r-v2h7.json

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c8jf-qq3r-v2h7",
4+
"modified": "2025-05-23T00:30:20Z",
5+
"published": "2025-05-23T00:30:19Z",
6+
"aliases": [
7+
"CVE-2025-4692"
8+
],
9+
"details": "Actors can use a maliciously crafted JavaScript object notation (JSON) web token (JWT) to perform privilege escalation by submitting the malicious JWT to a vulnerable method exposed on the cloud platform. If the exploit is successful, the user can escalate privileges to access any device managed by the \n\nABUP Cloud Update Platform.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4692"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-01"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-266"
34+
],
35+
"severity": "MODERATE",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2025-05-23T00:15:20Z"
39+
}
40+
}

‎advisories/unreviewed/2025/05/GHSA-jm7r-f6p7-h29v/GHSA-jm7r-f6p7-h29v.json

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jm7r-f6p7-h29v",
4+
"modified": "2025-05-23T00:30:19Z",
5+
"published": "2025-05-23T00:30:19Z",
6+
"aliases": [
7+
"CVE-2025-4562"
8+
],
9+
"details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
10+
"severity": [],
11+
"affected": [],
12+
"references": [
13+
{
14+
"type": "ADVISORY",
15+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4562"
16+
}
17+
],
18+
"database_specific": {
19+
"cwe_ids": [],
20+
"severity": null,
21+
"github_reviewed": false,
22+
"github_reviewed_at": null,
23+
"nvd_published_at": "2025-05-22T23:15:19Z"
24+
}
25+
}

‎advisories/unreviewed/2025/05/GHSA-m3rx-6qww-mhm3/GHSA-m3rx-6qww-mhm3.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m3rx-6qww-mhm3",
4+
"modified": "2025-05-23T00:30:19Z",
5+
"published": "2025-05-23T00:30:19Z",
6+
"aliases": [
7+
"CVE-2025-47181"
8+
],
9+
"details": "Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47181"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47181"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-59"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-05-22T22:15:30Z"
35+
}
36+
}

0 commit comments

Comments
 (0)