Skip to content

Commit 0b3c2e6

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5fvg-qwcp-r325 GHSA-6w86-wgwq-rgq8 GHSA-7gmj-h9xc-mcxc GHSA-c87w-642h-m97h
1 parent 7dbf507 commit 0b3c2e6

4 files changed

Lines changed: 149 additions & 15 deletions

File tree

advisories/unreviewed/2026/03/GHSA-5fvg-qwcp-r325/GHSA-5fvg-qwcp-r325.json renamed to advisories/github-reviewed/2026/03/GHSA-5fvg-qwcp-r325/GHSA-5fvg-qwcp-r325.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5fvg-qwcp-r325",
4-
"modified": "2026-03-03T15:31:40Z",
4+
"modified": "2026-03-04T20:17:28Z",
55
"published": "2026-03-03T12:31:27Z",
66
"aliases": [
77
"CVE-2025-59060"
88
],
9+
"summary": "Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch",
910
"details": "Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions <= 2.7.0.\n\nUsers are recommended to upgrade to version 2.8.0, which fixes this issue.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.ranger:ranger-nifi-registry-plugin"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.8.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59060"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/ranger"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://lists.apache.org/thread/c4plx81z3xs86vgl3fd95y3q7hhtff05"
@@ -33,8 +58,8 @@
3358
"CWE-297"
3459
],
3560
"severity": "MODERATE",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-04T20:17:28Z",
3863
"nvd_published_at": "2026-03-03T11:16:14Z"
3964
}
4065
}

‎advisories/github-reviewed/2026/03/GHSA-6w86-wgwq-rgq8/GHSA-6w86-wgwq-rgq8.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6w86-wgwq-rgq8",
4+
"modified": "2026-03-04T20:16:26Z",
5+
"published": "2026-03-04T20:16:26Z",
6+
"aliases": [],
7+
"summary": "neqo-qpack has iInteger overflow in qpack dynamic table indexing",
8+
"details": "### Summary\n\nAn unsanitized qpack index can lead to an integer overflow, panicing in debug mode, accessing the wrong or no dynamic table entry in release mode.\n\nWhat does this mean for Firefox? Firefox runs Neqo in release mode. A malicious remote can cause its own QUIC connection to fail to use qpack, i.e. compression, or enter an inconsistent state. The remote can not crash Firefox, nor affect other QUIC connections. \n\n### Details\n\nSee fuzz report in https://github.com/mozilla/neqo/issues/3406.\n\n### PoC\nSee test in pull request.\n\n### Impact\nAll Firefox users. Though vulnerability likely scoped to same connection, i.e. low impact.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "crates.io",
19+
"name": "neqo-qpack"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "0.22.2"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/mozilla/neqo/security/advisories/GHSA-6w86-wgwq-rgq8"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/mozilla/neqo/issues/3406"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/mozilla/neqo"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-190"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-04T20:16:26Z",
57+
"nvd_published_at": null
58+
}
59+
}

advisories/unreviewed/2026/03/GHSA-7gmj-h9xc-mcxc/GHSA-7gmj-h9xc-mcxc.json renamed to advisories/github-reviewed/2026/03/GHSA-7gmj-h9xc-mcxc/GHSA-7gmj-h9xc-mcxc.json

Lines changed: 31 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7gmj-h9xc-mcxc",
4-
"modified": "2026-03-03T06:31:14Z",
4+
"modified": "2026-03-04T20:15:58Z",
55
"published": "2026-03-03T06:31:14Z",
66
"aliases": [
77
"CVE-2026-3455"
88
],
9+
"summary": "mailparser vulnerable to Cross-site Scripting",
910
"details": "Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote \" to the URL with embedded malicious JavaScript code.",
1011
"severity": [
1112
{
@@ -14,10 +15,30 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "mailparser"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "3.9.3"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
@@ -35,6 +56,10 @@
3556
"type": "WEB",
3657
"url": "https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a"
3758
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/nodemailer/mailparser"
62+
},
3863
{
3964
"type": "WEB",
4065
"url": "https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032"
@@ -44,9 +69,9 @@
4469
"cwe_ids": [
4570
"CWE-79"
4671
],
47-
"severity": "MODERATE",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
72+
"severity": "LOW",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-03-04T20:15:58Z",
5075
"nvd_published_at": "2026-03-03T05:17:25Z"
5176
}
5277
}

advisories/unreviewed/2026/03/GHSA-c87w-642h-m97h/GHSA-c87w-642h-m97h.json renamed to advisories/github-reviewed/2026/03/GHSA-c87w-642h-m97h/GHSA-c87w-642h-m97h.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-c87w-642h-m97h",
4-
"modified": "2026-03-03T15:31:40Z",
4+
"modified": "2026-03-04T20:17:02Z",
55
"published": "2026-03-03T12:31:27Z",
66
"aliases": [
77
"CVE-2025-59059"
88
],
9-
"details": "Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.\nUsers are recommended to upgrade to version 2.8.0, which fixes this issue.",
9+
"summary": "Apache Ranger has a Code Injection vulnerability",
10+
"details": "Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.\n\nUsers are recommended to upgrade to version 2.8.0, which fixes this issue.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.ranger:ranger-plugins-common"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.8.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59059"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/ranger"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://lists.apache.org/thread/z47q86rho80390lf2qcmoc2josvs0gtv"
@@ -33,8 +58,8 @@
3358
"CWE-94"
3459
],
3560
"severity": "CRITICAL",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-04T20:17:02Z",
3863
"nvd_published_at": "2026-03-03T11:16:14Z"
3964
}
4065
}

0 commit comments

Comments
 (0)