Skip to content

Commit c236b4d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-79x8-79gq-rxxc GHSA-fmpp-8f7j-vvr4 GHSA-2v7w-p95j-mfhp GHSA-4gr5-vxg2-5c62 GHSA-5gjw-c85q-72c7 GHSA-773x-pxjg-gxgx GHSA-7f2q-g84r-xq9f GHSA-942h-7wq8-4623 GHSA-9phg-gg4w-6m7h GHSA-gx24-fg4m-2f7m GHSA-j7h5-wpgx-r8m9 GHSA-mfvj-g4mp-wqx2 GHSA-phfp-9x4x-56gj GHSA-rcp3-h3cv-rfv7 GHSA-rf8c-553r-qgf7 GHSA-2j3x-fvgp-v399 GHSA-4mch-p64h-q4jf GHSA-5p4m-vh8m-vc4h GHSA-gj25-8h3h-5p86 GHSA-mc3r-j8vp-9xmx GHSA-rp7w-qpv5-65rh GHSA-rxq6-2jg5-8jc6 GHSA-w3qg-5chj-8g9g
1 parent 7a6bd91 commit c236b4d

File tree

23 files changed

+395
-24
lines changed

23 files changed

+395
-24
lines changed

‎advisories/unreviewed/2024/11/GHSA-79x8-79gq-rxxc/GHSA-79x8-79gq-rxxc.json

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-79x8-79gq-rxxc",
4-
"modified": "2024-11-20T21:30:50Z",
4+
"modified": "2025-06-11T21:30:38Z",
55
"published": "2024-11-20T21:30:50Z",
66
"aliases": [
77
"CVE-2024-45510"
88
],
99
"details": "An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper sanitization of user input. This allows an attacker to inject malicious code into specific fields of an e-mail message. When the victim adds the attacker to their contacts, the malicious code is stored and executed when viewing the contact list. This can lead to unauthorized actions such as arbitrary mail sending, mailbox exfiltration, profile picture alteration, and other malicious actions. Proper sanitization and escaping of input fields are necessary to mitigate this vulnerability.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -36,8 +41,10 @@
3641
}
3742
],
3843
"database_specific": {
39-
"cwe_ids": [],
40-
"severity": null,
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
4148
"github_reviewed": false,
4249
"github_reviewed_at": null,
4350
"nvd_published_at": "2024-11-20T20:15:18Z"

‎advisories/unreviewed/2024/11/GHSA-fmpp-8f7j-vvr4/GHSA-fmpp-8f7j-vvr4.json

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fmpp-8f7j-vvr4",
4-
"modified": "2024-11-20T21:30:50Z",
4+
"modified": "2025-06-11T21:30:37Z",
55
"published": "2024-11-20T21:30:50Z",
66
"aliases": [
77
"CVE-2024-45511"
88
],
99
"details": "An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcase module due to improper sanitization of file content by the OnlyOffice formatter. This occurs when the victim opens a crafted URL pointing to a shared folder containing a malicious file uploaded by the attacker. The vulnerability allows the attacker to execute arbitrary JavaScript in the context of the victim's session.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-79"
42+
],
43+
"severity": "MODERATE",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2024-11-20T19:15:06Z"

‎advisories/unreviewed/2025/05/GHSA-2v7w-p95j-mfhp/GHSA-2v7w-p95j-mfhp.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-4gr5-vxg2-5c62/GHSA-4gr5-vxg2-5c62.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-5gjw-c85q-72c7/GHSA-5gjw-c85q-72c7.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-89"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-773x-pxjg-gxgx/GHSA-773x-pxjg-gxgx.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-773x-pxjg-gxgx",
4-
"modified": "2025-05-30T03:30:32Z",
4+
"modified": "2025-06-11T21:30:40Z",
55
"published": "2025-05-30T03:30:32Z",
66
"aliases": [
77
"CVE-2025-48757"
@@ -31,6 +31,10 @@
3131
"type": "WEB",
3232
"url": "https://mattpalmer.io/posts/CVE-2025-48757"
3333
},
34+
{
35+
"type": "WEB",
36+
"url": "https://mattpalmer.io/posts/statement-on-CVE-2025-48757"
37+
},
3438
{
3539
"type": "WEB",
3640
"url": "https://x.com/danialasaria/status/1911862269996118272"

‎advisories/unreviewed/2025/05/GHSA-7f2q-g84r-xq9f/GHSA-7f2q-g84r-xq9f.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
2931
"severity": "HIGH",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-942h-7wq8-4623/GHSA-942h-7wq8-4623.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-9phg-gg4w-6m7h/GHSA-9phg-gg4w-6m7h.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-gx24-fg4m-2f7m/GHSA-gx24-fg4m-2f7m.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-j7h5-wpgx-r8m9/GHSA-j7h5-wpgx-r8m9.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-601"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-mfvj-g4mp-wqx2/GHSA-mfvj-g4mp-wqx2.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
2931
"severity": "HIGH",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-phfp-9x4x-56gj/GHSA-phfp-9x4x-56gj.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-rcp3-h3cv-rfv7/GHSA-rcp3-h3cv-rfv7.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-352"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/05/GHSA-rf8c-553r-qgf7/GHSA-rf8c-553r-qgf7.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
}
2626
],
2727
"database_specific": {
28-
"cwe_ids": [],
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
2931
"severity": "MODERATE",
3032
"github_reviewed": false,
3133
"github_reviewed_at": null,

‎advisories/unreviewed/2025/06/GHSA-2j3x-fvgp-v399/GHSA-2j3x-fvgp-v399.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2j3x-fvgp-v399",
4+
"modified": "2025-06-11T21:30:40Z",
5+
"published": "2025-06-11T21:30:40Z",
6+
"aliases": [
7+
"CVE-2025-30085"
8+
],
9+
"details": "Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla was discovered. The issue occurs within the submission export feature and requires administrative access to the export feature.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:L/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30085"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://rsjoomla.com"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-94"
30+
],
31+
"severity": "CRITICAL",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-06-11T20:15:22Z"
35+
}
36+
}

‎advisories/unreviewed/2025/06/GHSA-4mch-p64h-q4jf/GHSA-4mch-p64h-q4jf.json

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4mch-p64h-q4jf",
4+
"modified": "2025-06-11T21:30:39Z",
5+
"published": "2025-06-11T21:30:39Z",
6+
"aliases": [
7+
"CVE-2024-45513"
8+
],
9+
"details": "An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/contacts/print endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser when a crafted vCard (VCF) file is processed and printed. This could lead to unauthorized actions within the victim's session.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45513"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://wiki.zimbra.com/wiki/Security_Center"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2024-11-21T17:15:15Z"
51+
}
52+
}

‎advisories/unreviewed/2025/06/GHSA-5p4m-vh8m-vc4h/GHSA-5p4m-vh8m-vc4h.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5p4m-vh8m-vc4h",
4+
"modified": "2025-06-11T21:30:40Z",
5+
"published": "2025-06-11T21:30:40Z",
6+
"aliases": [
7+
"CVE-2025-32465"
8+
],
9+
"details": "A stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla was discovered. It allows attackers to perform cross-site scripting (XSS) attacks via sending crafted payload.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:L/U:Clear"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32465"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://rsjoomla.com"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-79"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2025-06-11T20:15:23Z"
35+
}
36+
}

0 commit comments

Comments
 (0)