Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-34303 State: PUBLISHED Published: 2025-10-28T14:32:25.557Z Last Updated: 2025-10-28T19:55:14.149Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the IGNORE_ENTRY_REMARK parameter when adding a whitelisted host. When a whitelisted host is added, an HTTP POST request is sent to the Request-URI /cgi-bin/ids.cgi and the remark for the entry is provided in the IGNORE_ENTRY_REMARK parameter. The value of this parameter is stored and later rendered in the web interface wit
in the IGNORE_ENTRY_REMARK parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitization or encoding, allowing injected scripts to execute in the context of other users who view the affected whitelist entry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13878 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-whitelisted-host-creation
CVE ID: CVE-2025-34304 State: PUBLISHED Published: 2025-10-28T14:37:29.929Z Last Updated: 2025-10-28T15:18:27.982Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-89 Description: IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker to manipulate the SQL query used when viewing OpenVPN connection logs via the CONNECTION_NAME parameter. When viewing a range of OpenVPN connection logs, the application issues an HTTP POST request to the Request-URI /cgi-bin/logs.cgi/ovpnclients.dat and inserts the value of the CONNECTION_NAME parameter directly into the WHERE clause without proper sanitization or parameterization. The
lue of the CONNECTION_NAME parameter directly into the WHERE clause without proper sanitization or parameterization. The unsanitized value can alter the executed query and be used to disclose sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13879 - https://www.vulncheck.com/advisories/ipfire-sqli-via-openvpn-connection-logs
CVE ID: CVE-2025-34305 State: PUBLISHED Published: 2025-10-28T14:34:36.345Z Last Updated: 2025-10-29T18:09:14.373Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function (/var/ipfire/header.pl) that fails to apply HTML-entity encoding to user input. When an authenticated user submits data to affected endpoints - for example, POST /cgi-bin/wakeonlan.cgi (CLIENT_COMMENT), /cgi-bin/dhcp.cgi (ADVOPT_DATA, FIX_REMARK, FIX_FILENAME, FIX_ROOTPATH), /cgi-bin/connscheduler.cgi (ACTION_COMMENT), /cgi-bin/dnsforward.cgi (REMARK),
FIX_REMARK, FIX_FILENAME, FIX_ROOTPATH), /cgi-bin/connscheduler.cgi (ACTION_COMMENT), /cgi-bin/dnsforward.cgi (REMARK), /cgi-bin/vpnmain.cgi (REMARK), or /cgi-bin/dns.cgi (REMARK) - the application calls escape() and HTML::Entities::encode_entities() but never assigns the sanitized result back to the output variable. The original unsanitized value is therefore stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected entries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipf
ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13880 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-multiple-methods-in-cleanhtml
CVE ID: CVE-2025-34306 State: PUBLISHED Published: 2025-10-28T14:36:54.996Z Last Updated: 2025-10-28T15:18:55.649Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the default firewall IP search values. When a user updates these defaults, the application issues an HTTP POST request to /cgi-bin/logs.cgi/firewalllogip.dat with the default number of IPs in the pienumber parameter. The value of this parameter is stored and later rendered in the web in
default number of IPs in the pienumber parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13881 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-default-ip-search-value
CVE ID: CVE-2025-34307 State: PUBLISHED Published: 2025-10-28T14:37:12.722Z Last Updated: 2025-10-28T15:18:44.969Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the firewall country search defaults. When a user updates the default values for the firewall country search, the application issues an HTTP POST request to /cgi-bin/logs.cgi/firewalllogcountry.dat and the default number of countries to display is provided in the pienumber parameter. Th
ogs.cgi/firewalllogcountry.dat and the default number of countries to display is provided in the pienumber parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected firewall country search settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13882 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-default-country-search
CVE ID: CVE-2025-34308 State: PUBLISHED Published: 2025-10-28T14:36:37.471Z Last Updated: 2025-10-28T15:19:08.097Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the UPDATE_VALUE parameter when updating the default time synchronization settings. When the default values displayed on the Time Server page are updated, the application issues an HTTP POST request to /cgi-bin/time.cgi, and the synchronization value is provided in the UPDATE_VALUE parameter. The value of this parameter is
i-bin/time.cgi, and the synchronization value is provided in the UPDATE_VALUE parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected Time Server configuration page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13883 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-default-time-sync
CVE ID: CVE-2025-34309 State: PUBLISHED Published: 2025-10-28T14:35:36.088Z Last Updated: 2025-10-28T15:19:40.678Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SERVICE, LOGIN, and PASSWORD parameters when creating or editing a Dynamic DNS host. When a new Dynamic DNS host is added, the application issues an HTTP POST request to /cgi-bin/ddns.cgi and saves the values of the LOGIN, PASSWORD, and SERVICE parameters. The SERVICE value is displayed after the host entry is created,
values of the LOGIN, PASSWORD, and SERVICE parameters. The SERVICE value is displayed after the host entry is created, and the LOGIN and PASSWORD values are displayed when that host entry is edited. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view or edit the affected Dynamic DNS entries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13884 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-dynamic-dns-host
CVE ID: CVE-2025-34310 State: PUBLISHED Published: 2025-10-28T14:34:18.157Z Last Updated: 2025-10-29T18:12:26.568Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the INC_SPD, OUT_SPD, DEFCLASS_INC, and DEFCLASS_OUT parameters when updating Quality of Service (QoS) settings. When a user updates speeds or classes, the application issues an HTTP POST request to /cgi-bin/qos.cgi and the values for incoming/outgoing speeds and default classes are provided in the INC_SPD, OUT_SPD, DEFCLAS
in/qos.cgi and the values for incoming/outgoing speeds and default classes are provided in the INC_SPD, OUT_SPD, DEFCLASS_INC, and DEFCLASS_OUT parameters. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected QoS entries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13883 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-quality-of-service-settings
CVE ID: CVE-2025-34311 State: PUBLISHED Published: 2025-10-28T14:43:31.324Z Last Updated: 2025-10-28T15:16:34.491Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-78 Description: IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_U
EGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13886 - https://www.vulncheck.com/advisories/ipfire-command-injection-via-proxy-repor
ugzilla.ipfire.org/show_bug.cgi?id=13886 - https://www.vulncheck.com/advisories/ipfire-command-injection-via-proxy-report-creation
CVE ID: CVE-2025-34312 State: PUBLISHED Published: 2025-10-28T14:37:47.417Z Last Updated: 2025-10-28T15:17:00.706Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-78 Description: IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command executio
ion without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the 'nobody' user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13887 - https://www.vulncheck.com/advisories/ipfire-command-injection-via-url-filter-blacklist
CVE ID: CVE-2025-34313 State: PUBLISHED Published: 2025-10-28T14:32:47.658Z Last Updated: 2025-10-28T20:02:22.245Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the QUOTA_USERS parameter when creating a user quota rule. When a user adds a new user quota rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set to USERQUOTA and the assigned user(s) provided in the QUOTA_USERS parameter. The value of this parameter is stored and later rend
OTA and the assigned user(s) provided in the QUOTA_USERS parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected quota entry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13888 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-user-quota-rule-url-filter
CVE ID: CVE-2025-34314 State: PUBLISHED Published: 2025-10-28T14:33:09.667Z Last Updated: 2025-10-29T18:26:57.565Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SRC, DST, and COMMENT parameters when creating a time constraint rule. When a user adds a time constraint rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set to TIMECONSTRAINT and the source hostnames/IPs, destination, and remark provided in the SRC, DST, and COMMENT pa
ter set to TIMECONSTRAINT and the source hostnames/IPs, destination, and remark provided in the SRC, DST, and COMMENT parameters respectively. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected time constraint entry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13889 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-time-constraint-rule-url-filter
CVE ID: CVE-2025-34315 State: PUBLISHED Published: 2025-10-28T14:33:54.312Z Last Updated: 2025-10-29T18:13:29.333Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the REMOTELOG_ADDR parameter when updating the remote syslog server address. When a user updates the Remote logging Syslog server, the application issues an HTTP POST request to /cgi-bin/logs.cgi/config.dat and the server address is provided in the REMOTELOG_ADDR parameter. The value of this parameter is stored and later re
t and the server address is provided in the REMOTELOG_ADDR parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected configuration page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13890 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-remote-syslog-server-address
CVE ID: CVE-2025-34316 State: PUBLISHED Published: 2025-10-28T14:34:54.739Z Last Updated: 2025-10-29T18:07:01.018Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the txt_mailuser and txt_mailpass parameters when updating the mail server settings. When a user updates the mail server, the application issues an HTTP POST request to /cgi-bin/mail.cgi and the username and password are provided in the txt_mailuser and txt_mailpass parameters. The values of these parameters are stored and
nd password are provided in the txt_mailuser and txt_mailpass parameters. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected mail configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13891 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-mail-server-settings
CVE ID: CVE-2025-34317 State: PUBLISHED Published: 2025-10-28T14:36:00.558Z Last Updated: 2025-10-28T15:19:29.398Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME parameter when adding a new DNS entry. When a user adds a DNS entry, the application issues an HTTP POST request to /cgi-bin/dns.cgi and the TLS hostname is provided in the TLS_HOSTNAME parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or enco
rameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected DNS configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13892 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-dns-settings-dns-cgi
CVE ID: CVE-2025-34318 State: PUBLISHED Published: 2025-10-28T14:36:19.112Z Last Updated: 2025-10-28T15:19:18.537Z Vendors: IPFire.org Products: IPFire Problem Types: CWE-79 Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME, UPSTREAM_USER, UPSTREAM_PASSWORD, ADMIN_MAIL_ADDRESS, and ADMIN_PASSWORD parameters when adding a new DNS entry. When a user adds a DNS entry, the application issues an HTTP POST request to /cgi-bin/dns.cgi and these values are provided in the corresponding parameters. The values are stored and later rende
to /cgi-bin/dns.cgi and these values are provided in the corresponding parameters. The values are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected DNS configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released - https://bugzilla.ipfire.org/show_bug.cgi?id=13893 - https://www.vulncheck.com/advisories/ipfire-stored-xss-via-dns-creation-proxy-cgi
CVE ID: CVE-2025-34320 State: PUBLISHED Published: 2025-11-20T15:31:38.794Z Last Updated: 2025-11-20T16:21:05.006Z Vendors: BASIS International Ltd. Products: BASIS BBj Problem Types: CWE-22 Description: BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthenticated directory traversal sequences to cause the server to read arbitrary system files accessible to the account running the service. Retrieved configuration artifacts may contain account credentials used for BBj Enterprise Manager; possession of these credentials enables administrative access and use of legitimate management functio
terprise Manager; possession of these credentials enables administrative access and use of legitimate management functionality that can result in execution of system commands under the service account. Depending on the operating system and the privileges of the BBj service account, this issue may also allow access to other sensitive files on the host, including operating system or application data, potentially exposing additional confidential information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://myemail.constantcontact.com/BASIS-International-Ltd--releases-BBj---the-Barista--Application-Framework--and-AddonSoftware--by-Barista-version-25-00.html?soid=110346311
-Ltd--releases-BBj---the-Barista--Application-Framework--and-AddonSoftware--by-Barista-version-25-00.html?soid=1103463119019&aid=WbfWkReLRVE - https://www.vulncheck.com/advisories/basis-bbj-unauthenticated-arbitrary-file-read-rce
CVE ID: CVE-2025-34322 State: PUBLISHED Published: 2025-11-17T17:48:04.503Z Last Updated: 2025-11-24T20:10:34.971Z Vendors: Nagios Products: Log Server Problem Types: CWE-78 Description: Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the global configuration and concatenated into a shell command that is executed via shell_exec() without proper input handling or command-line argument sanitation. An authenticated user with access to the 'Global Settings
out proper input handling or command-line argument sanitation. An authenticated user with access to the 'Global Settings' page can supply crafted values in these fields to inject additional shell commands, resulting in arbitrary command execution as the 'www-data' user and compromise of the Log Server host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#log-server - https://www.nagios.com/changelog/nagios-log-server/nagios-log-server-2026r1-0-1/ - https://www.vulncheck.com/advisories/nagios-log-server-authenticated-command-injection-via-natural-language-queries