Skip to content

Commit 86830f2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-78cg-fc6c-w44w GHSA-9m3c-qcxr-9x87 GHSA-gcvm-c75m-h4p4 GHSA-wqxq-w68r-wg85 GHSA-78cg-fc6c-w44w GHSA-9m3c-qcxr-9x87
1 parent 4420e77 commit 86830f2

6 files changed

Lines changed: 358 additions & 86 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-78cg-fc6c-w44w/GHSA-78cg-fc6c-w44w.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-78cg-fc6c-w44w",
4+
"modified": "2026-04-10T21:24:13Z",
5+
"published": "2026-04-09T18:31:26Z",
6+
"aliases": [
7+
"CVE-2026-33005"
8+
],
9+
"summary": "Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability",
10+
"details": "Sny registered user can query web service with their credentials and get files/sub-folders of any folder by ID (metadata only NOT contents). Metadata includes id, type, name and some other field. Full list of fields get be checked at FileItemDTO object.\n\nThis issue affects Apache OpenMeetings: from 3.10 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.openmeetings:openmeetings-parent"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "3.10"
29+
},
30+
{
31+
"fixed": "9.0.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33005"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/openmeetings"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://lists.apache.org/thread/pttoprd628g3xr6lpp3bm1z8m3z8t4p7"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://openmeetings.apache.org/openmeetings-db/apidocs/org.apache.openmeetings.db/org/apache/openmeetings/db/dto/file/FileItemDTO.html"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "http://www.openwall.com/lists/oss-security/2026/04/09/10"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-274"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-04-10T21:24:13Z",
67+
"nvd_published_at": "2026-04-09T16:16:26Z"
68+
}
69+
}

‎advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json‎

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9m3c-qcxr-9x87",
4+
"modified": "2026-04-10T21:25:28Z",
5+
"published": "2026-04-09T21:31:29Z",
6+
"aliases": [
7+
"CVE-2026-25854"
8+
],
9+
"summary": "Apache Tomcat has an Open Redirect vulnerability",
10+
"details": "Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.\nOther, unsupported versions may also be affected\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.tomcat:tomcat-catalina"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0.M23"
29+
},
30+
{
31+
"fixed": "9.0.116"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.tomcat:tomcat-catalina"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "10.1.0-M1"
48+
},
49+
{
50+
"fixed": "10.1.53"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.apache.tomcat:tomcat-catalina"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "11.0.0-M1"
67+
},
68+
{
69+
"fixed": "11.0.20"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Maven",
78+
"name": "org.apache.tomcat:tomcat"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "9.0.0.M23"
86+
},
87+
{
88+
"fixed": "9.0.116"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "Maven",
97+
"name": "org.apache.tomcat:tomcat"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "10.1.0-M1"
105+
},
106+
{
107+
"fixed": "10.1.53"
108+
}
109+
]
110+
}
111+
]
112+
},
113+
{
114+
"package": {
115+
"ecosystem": "Maven",
116+
"name": "org.apache.tomcat:tomcat"
117+
},
118+
"ranges": [
119+
{
120+
"type": "ECOSYSTEM",
121+
"events": [
122+
{
123+
"introduced": "11.0.0-M1"
124+
},
125+
{
126+
"fixed": "11.0.20"
127+
}
128+
]
129+
}
130+
]
131+
},
132+
{
133+
"package": {
134+
"ecosystem": "Maven",
135+
"name": "org.apache.tomcat.embed:tomcat-embed-core"
136+
},
137+
"ranges": [
138+
{
139+
"type": "ECOSYSTEM",
140+
"events": [
141+
{
142+
"introduced": "9.0.0.M23"
143+
},
144+
{
145+
"fixed": "9.0.116"
146+
}
147+
]
148+
}
149+
]
150+
},
151+
{
152+
"package": {
153+
"ecosystem": "Maven",
154+
"name": "org.apache.tomcat.embed:tomcat-embed-core"
155+
},
156+
"ranges": [
157+
{
158+
"type": "ECOSYSTEM",
159+
"events": [
160+
{
161+
"introduced": "10.1.0-M1"
162+
},
163+
{
164+
"fixed": "10.1.53"
165+
}
166+
]
167+
}
168+
]
169+
},
170+
{
171+
"package": {
172+
"ecosystem": "Maven",
173+
"name": "org.apache.tomcat.embed:tomcat-embed-core"
174+
},
175+
"ranges": [
176+
{
177+
"type": "ECOSYSTEM",
178+
"events": [
179+
{
180+
"introduced": "11.0.0-M1"
181+
},
182+
{
183+
"fixed": "11.0.20"
184+
}
185+
]
186+
}
187+
]
188+
}
189+
],
190+
"references": [
191+
{
192+
"type": "ADVISORY",
193+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25854"
194+
},
195+
{
196+
"type": "PACKAGE",
197+
"url": "https://github.com/apache/tomcat"
198+
},
199+
{
200+
"type": "WEB",
201+
"url": "https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0"
202+
},
203+
{
204+
"type": "WEB",
205+
"url": "http://www.openwall.com/lists/oss-security/2026/04/09/21"
206+
}
207+
],
208+
"database_specific": {
209+
"cwe_ids": [
210+
"CWE-601"
211+
],
212+
"severity": "MODERATE",
213+
"github_reviewed": true,
214+
"github_reviewed_at": "2026-04-10T21:25:28Z",
215+
"nvd_published_at": "2026-04-09T20:16:24Z"
216+
}
217+
}

advisories/unreviewed/2026/04/GHSA-gcvm-c75m-h4p4/GHSA-gcvm-c75m-h4p4.json renamed to advisories/github-reviewed/2026/04/GHSA-gcvm-c75m-h4p4/GHSA-gcvm-c75m-h4p4.json

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gcvm-c75m-h4p4",
4-
"modified": "2026-04-09T18:31:27Z",
4+
"modified": "2026-04-10T21:24:43Z",
55
"published": "2026-04-09T18:31:27Z",
66
"aliases": [
77
"CVE-2026-34020"
88
],
9+
"summary": "Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings ",
910
"details": "Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.\n\nThe REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact\n\n\nThis issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.",
10-
"severity": [],
11-
"affected": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.openmeetings:openmeetings-parent"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "3.1.3"
29+
},
30+
{
31+
"fixed": "9.0.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
1541
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34020"
1642
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/openmeetings"
46+
},
1747
{
1848
"type": "WEB",
1949
"url": "https://lists.apache.org/thread/2h3h9do5tp17xldr0nps1yjmkx4vs3db"
@@ -31,9 +61,9 @@
3161
"cwe_ids": [
3262
"CWE-598"
3363
],
34-
"severity": null,
35-
"github_reviewed": false,
36-
"github_reviewed_at": null,
64+
"severity": "HIGH",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-04-10T21:24:43Z",
3767
"nvd_published_at": "2026-04-09T16:16:27Z"
3868
}
3969
}

0 commit comments

Comments
 (0)