Skip to content

Commit 8e4ff8f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-276w-gj4p-9x23 GHSA-287x-9rff-qvcg GHSA-78j7-w964-99fc GHSA-87hw-q9ch-hcvh GHSA-pfxq-29cx-gm9c GHSA-rxf6-323f-44fc
1 parent 6cba904 commit 8e4ff8f

File tree

6 files changed

+268
-0
lines changed

6 files changed

+268
-0
lines changed

‎advisories/unreviewed/2025/07/GHSA-276w-gj4p-9x23/GHSA-276w-gj4p-9x23.json

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-276w-gj4p-9x23",
4+
"modified": "2025-07-05T03:30:23Z",
5+
"published": "2025-07-05T03:30:23Z",
6+
"aliases": [
7+
"CVE-2025-47227"
8+
],
9+
"details": "In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47227"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/synacktiv/CVE-2025-47227_CVE-2025-47228"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.scriptcase.net/changelog"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.synacktiv.com/advisories/scriptcase-pre-authenticated-remote-command-execution"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-684"
38+
],
39+
"severity": "HIGH",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-07-05T03:15:30Z"
43+
}
44+
}

‎advisories/unreviewed/2025/07/GHSA-287x-9rff-qvcg/GHSA-287x-9rff-qvcg.json

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-287x-9rff-qvcg",
4+
"modified": "2025-07-05T03:30:23Z",
5+
"published": "2025-07-05T03:30:23Z",
6+
"aliases": [
7+
"CVE-2025-53604"
8+
],
9+
"details": "The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53604"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/pimeys/rust-web-push/pull/68"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://crates.io/crates/web-push"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0015.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-130"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-07-05T01:15:28Z"
43+
}
44+
}

‎advisories/unreviewed/2025/07/GHSA-78j7-w964-99fc/GHSA-78j7-w964-99fc.json

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-78j7-w964-99fc",
4+
"modified": "2025-07-05T03:30:23Z",
5+
"published": "2025-07-05T03:30:23Z",
6+
"aliases": [
7+
"CVE-2025-53603"
8+
],
9+
"details": "In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53603"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/Alinto/sope/pull/69"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Alinto/sope/blob/3146fbdb6ff3314e37e5c3682deeeef7d0f32064/sope-core/NGExtensions/NGHashMap.m#L790"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/Alinto/sope/compare/SOGo-2.0.1...SOGo-2.0.2"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://www.openwall.com/lists/oss-security/2025/07/02/3"
37+
}
38+
],
39+
"database_specific": {
40+
"cwe_ids": [
41+
"CWE-476"
42+
],
43+
"severity": "HIGH",
44+
"github_reviewed": false,
45+
"github_reviewed_at": null,
46+
"nvd_published_at": "2025-07-05T01:15:27Z"
47+
}
48+
}

‎advisories/unreviewed/2025/07/GHSA-87hw-q9ch-hcvh/GHSA-87hw-q9ch-hcvh.json

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-87hw-q9ch-hcvh",
4+
"modified": "2025-07-05T03:30:23Z",
5+
"published": "2025-07-05T03:30:23Z",
6+
"aliases": [
7+
"CVE-2024-58254"
8+
],
9+
"details": "The rustls crate 0.23.13 before 0.23.18 for Rust, when rustls::server::Acceptor::accept is used, allows a panic via a fragmented TLS ClientHello.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58254"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/rustls/rustls/issues/2227"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://crates.io/crates/rustls"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0399.html"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-684"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-07-05T02:15:21Z"
43+
}
44+
}

‎advisories/unreviewed/2025/07/GHSA-pfxq-29cx-gm9c/GHSA-pfxq-29cx-gm9c.json

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pfxq-29cx-gm9c",
4+
"modified": "2025-07-05T03:30:23Z",
5+
"published": "2025-07-05T03:30:23Z",
6+
"aliases": [
7+
"CVE-2025-47228"
8+
],
9+
"details": "In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47228"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/synacktiv/CVE-2025-47227_CVE-2025-47228"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://www.scriptcase.net/changelog"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://www.synacktiv.com/advisories/scriptcase-pre-authenticated-remote-command-execution"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-78"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-07-05T03:15:30Z"
43+
}
44+
}

‎advisories/unreviewed/2025/07/GHSA-rxf6-323f-44fc/GHSA-rxf6-323f-44fc.json

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rxf6-323f-44fc",
4+
"modified": "2025-07-05T03:30:23Z",
5+
"published": "2025-07-05T03:30:23Z",
6+
"aliases": [
7+
"CVE-2025-53605"
8+
],
9+
"details": "The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53605"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/stepancheg/rust-protobuf/issues/749"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://crates.io/crates/protobuf"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0437"
33+
}
34+
],
35+
"database_specific": {
36+
"cwe_ids": [
37+
"CWE-674"
38+
],
39+
"severity": "MODERATE",
40+
"github_reviewed": false,
41+
"github_reviewed_at": null,
42+
"nvd_published_at": "2025-07-05T01:15:28Z"
43+
}
44+
}

0 commit comments

Comments
 (0)