Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48358 State: PUBLISHED Published: 2025-08-28T12:37:07.703Z Last Updated: 2025-08-28T14:45:49.412Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: everythingwp Products: Risk Free Cash On Delivery (COD) &#8211; WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) &#8211; WooCommerce allows Stored XSS. This issue affects Risk Free Cash On Delivery (COD) &#8211; WooCommerce: from n/a through 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/p
ough 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/risk-free-cash-on-delivery-cod-woocommerce/vulnerability/wordpress-risk-free-cash-on-delivery-cod-woocommerce-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48359 State: PUBLISHED Published: 2025-08-28T12:37:08.340Z Last Updated: 2025-08-28T14:45:42.639Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: thaihavnn07 Products: ATT YouTube Widget Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in thaihavnn07 ATT YouTube Widget allows Stored XSS. This issue affects ATT YouTube Widget: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/att-youtube/vulnerability/wordpress-att-youtube-widget-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48360 State: PUBLISHED Published: 2025-08-28T12:37:08.905Z Last Updated: 2025-08-28T14:45:35.837Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Razvan Stanga Products: Varnish/Nginx Proxy Caching Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching allows Stored XSS. This issue affects Varnish/Nginx Proxy Caching: from n/a through 1.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vcaching/vulnerability/wordpress-varnish-nginx-proxy-caching-plugin
: - https://patchstack.com/database/wordpress/plugin/vcaching/vulnerability/wordpress-varnish-nginx-proxy-caching-plugin-1-8-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48361 State: PUBLISHED Published: 2025-08-28T12:37:09.524Z Last Updated: 2025-08-28T14:45:28.254Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Saeed Sattar Beglou Products: Hesabfa Accounting Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting allows Retrieve Embedded Sensitive Data. This issue affects Hesabfa Accounting: from n/a through 2.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hesabfa-accounting/vulnerability/wordpress-hesabfa-accounting-plugin-2-2-4-sensitive-data-expo
database/wordpress/plugin/hesabfa-accounting/vulnerability/wordpress-hesabfa-accounting-plugin-2-2-4-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2025-48362 State: PUBLISHED Published: 2025-08-28T12:37:10.106Z Last Updated: 2025-08-28T14:45:19.371Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Saeed Sattar Beglou Products: Hesabfa Accounting Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting allows Cross Site Request Forgery. This issue affects Hesabfa Accounting: from n/a through 2.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hesabfa-accounting/vulnerability/wordpress-hesabfa-accounting-plugin-2-2-4-cross-site-request-forgery-csrf-vulnerabi
gin/hesabfa-accounting/vulnerability/wordpress-hesabfa-accounting-plugin-2-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48363 State: PUBLISHED Published: 2025-08-28T12:37:10.659Z Last Updated: 2025-08-28T14:45:10.113Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Metin Saraç Products: Popup for CF7 with Sweet Alert Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Metin Saraç Popup for CF7 with Sweet Alert allows Cross Site Request Forgery. This issue affects Popup for CF7 with Sweet Alert: from n/a through 1.6.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-sweet-alert-popup/vulnerability/wordpress-popup-for-cf7-with-sweet-alert-plugin-1-6-5-cross-
tabase/wordpress/plugin/cf7-sweet-alert-popup/vulnerability/wordpress-popup-for-cf7-with-sweet-alert-plugin-1-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48364 State: PUBLISHED Published: 2025-08-28T12:37:11.279Z Last Updated: 2025-08-28T14:44:57.923Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vEnCa-X Products: rajce Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce allows Server Side Request Forgery. This issue affects rajce: from n/a through 0.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rajce/vulnerability/wordpress-rajce-plugin-0-4-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48365 State: PUBLISHED Published: 2025-08-28T12:37:11.934Z Last Updated: 2025-08-28T14:20:36.022Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: imaprogrammer Products: Custom Comment Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imaprogrammer Custom Comment allows Stored XSS. This issue affects Custom Comment: from n/a through 2.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/customcomment/vulnerability/wordpress-custom-comment-plugin-2-1-6-cross-site-scripting-xss-vulnerability-2
dpress/plugin/customcomment/vulnerability/wordpress-custom-comment-plugin-2-1-6-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-48366 State: PUBLISHED Published: 2025-05-22T17:28:26.530Z Last Updated: 2025-05-22T17:55:53.951Z Vendors: Intermesh Products: groupoffice Problem Types: CWE-79, CWE-87 Description: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persistent JavaScript payloads, which are triggered in the context of another user when they view the Address Book. Successful exploitation enables actions such as forced redirects, unauthorized fetch requests, or
view the Address Book. Successful exploitation enables actions such as forced redirects, unauthorized fetch requests, or other arbitrary JavaScript execution without user interaction. Versions 6.8.119 and 25.0.20 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Intermesh/groupoffice/security/advisories/GHSA-phhq-3h8f-qxpx
CVE ID: CVE-2025-48367 State: PUBLISHED Published: 2025-07-07T15:25:47.690Z Last Updated: 2025-07-07T15:39:11.003Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: redis Products: redis Problem Types: CWE-770 Description: Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq - https://github.com/redis/redis/commit/bde
es: - https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq - https://github.com/redis/redis/commit/bde62951accfc4bb0a516276fd0b4b307e140ce2 - https://github.com/redis/redis/releases/tag/6.2.19 - https://github.com/redis/redis/releases/tag/7.2.10 - https://github.com/redis/redis/releases/tag/7.4.5 - https://github.com/redis/redis/releases/tag/8.0.3
CVE ID: CVE-2025-48368 State: PUBLISHED Published: 2025-05-22T17:29:57.631Z Last Updated: 2025-05-22T17:52:08.245Z Vendors: Intermesh Products: groupoffice Problem Types: CWE-79 Description: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting (XSS) vulnerability exists in the GroupOffice application, allowing attackers to execute arbitrary JavaScript code in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability can be triggered by injecting a crafted payload into a parameter that is later processed unsafely
es. The vulnerability can be triggered by injecting a crafted payload into a parameter that is later processed unsafely in the DOM. Versions 6.8.119 and 25.0.20 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Intermesh/groupoffice/security/advisories/GHSA-c49j-qvp9-vgg6
CVE ID: CVE-2025-48369 State: PUBLISHED Published: 2025-05-22T17:33:06.254Z Last Updated: 2025-05-22T18:45:32.626Z Vendors: Intermesh Products: groupoffice Problem Types: CWE-79 Description: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a persistent Cross-Site Scripting (XSS) vulnerability exists in Groupoffice's tasks comment functionality, allowing attackers to execute arbitrary JavaScript by uploading an file with a crafted filename. When administrators or other users view the task containing this malicious file, the payload executes in their browser context. The application fails to sanitize image filenames befor
s malicious file, the payload executes in their browser context. The application fails to sanitize image filenames before rendering them in the comment. By uploading an image with a crafted filename containing XSS payloads, attackers can steal sensitive information. Versions 6.8.119 and 25.0.20 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Intermesh/groupoffice/security/advisories/GHSA-45jj-r48j-75pp
CVE ID: CVE-2025-48370 State: PUBLISHED Published: 2025-05-27T15:27:00.864Z Last Updated: 2025-05-27T15:37:18.556Z Vendors: supabase Products: auth-js Problem Types: CWE-287, CWE-22 Description: auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.69.1, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. This issue has been patched in version 2.
validate user controlled inputs, such as the userId are not affected by this. This issue has been patched in version 2.69.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/supabase/auth-js/security/advisories/GHSA-8r88-6cj9-9fh5 - https://github.com/supabase/auth-js/pull/1063
CVE ID: CVE-2025-48371 State: PUBLISHED Published: 2025-05-22T22:20:37.570Z Last Updated: 2025-05-23T14:14:20.586Z Vendors: openfga Products: openfga Problem Types: CWE-285 Description: OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or
el that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openfga/openfga/security/advisories/GHSA-c72g-53hw-82q7 - https://github.com/openfga/openfga/commit/e5960d4eba92b723
com/openfga/openfga/security/advisories/GHSA-c72g-53hw-82q7 - https://github.com/openfga/openfga/commit/e5960d4eba92b723de8ff3a5346a07f50c1379ca
CVE ID: CVE-2025-48372 State: PUBLISHED Published: 2025-05-22T20:38:02.463Z Last Updated: 2025-05-23T13:56:37.894Z Vendors: schule111 Products: Schule Problem Types: CWE-521 Description: Schule is open-source school management system software. The generateOTP() function generates a 4-digit numeric One-Time Password (OTP). Prior to version 1.0.1, even if a secure random number generator is used, the short length and limited range (1000–9999) results in only 9000 possible combinations. This small keyspace makes the OTP highly vulnerable to brute-force attacks, especially in the absence of strong rate-limiting or lockout mechanisms. Version 1.0.1 fixes the issue. Additional Analyst Notes: - CIS
he absence of strong rate-limiting or lockout mechanisms. Version 1.0.1 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/schule111/Schule/security/advisories/GHSA-6c48-67xx-vqgc - https://github.com/schule111/Schule/commit/cd53abbea93943f2c60a5281d45bebadc57636b7
CVE ID: CVE-2025-48373 State: PUBLISHED Published: 2025-05-22T20:39:35.548Z Last Updated: 2025-05-27T20:28:17.446Z Vendors: schule111 Products: Schule Problem Types: CWE-863 Description: Schule is open-source school management system software. The application relies on client-side JavaScript (index.js) to redirect users to different panels based on their role. Prior to version 1.0.1, this implementation poses a serious security risk because it assumes that the value of data.role is trustworthy on the client side. Attackers can manipulate JavaScript in the browser (e.g., via browser dev tools or intercepting API responses) and set data.role to any arbitrary value (e.g., "admin"), gaining unau
browser dev tools or intercepting API responses) and set data.role to any arbitrary value (e.g., "admin"), gaining unauthorized access to restricted areas of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/schule111/Schule/security/advisories/GHSA-37h9-qq7c-6mc9 - https://github.com/schule111/Schule/commit/cbf7f509c37acd69b4ab8ee19d842de867b46b7e
CVE ID: CVE-2025-48374 State: PUBLISHED Published: 2025-05-22T20:43:13.708Z Last Updated: 2025-05-23T14:33:24.239Z Vendors: project-zot Products: zot Problem Types: CWE-532 Description: zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
0.20250522160828-8a99a3ed231f) fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/project-zot/zot/security/advisories/GHSA-c37v-3c8w-crq8 - https://github.com/project-zot/zot/commit/8a99a3ed231fdcd8467e986182b4705342b6a15e
CVE ID: CVE-2025-48375 State: PUBLISHED Published: 2025-05-23T15:41:11.735Z Last Updated: 2025-05-23T16:09:49.204Z Vendors: schule111 Products: Schule Problem Types: CWE-770 Description: Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-based OTP generation) lacks proper rate limiting controls, allowing attackers to abuse the OTP request functionality. This vulnerability can be exploited to send an excessive number of OTP emails, leading to potential denial-of-service (DoS) conditions or facilitating user harassment through email flooding. Version 1.0.1 fixes the issue. Additional Analys
DoS) conditions or facilitating user harassment through email flooding. Version 1.0.1 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/schule111/Schule/security/advisories/GHSA-h3f2-mc85-67gc
CVE ID: CVE-2025-48376 State: PUBLISHED Published: 2025-05-23T15:37:03.832Z Last Updated: 2025-05-23T15:59:13.541Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-841 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (Host) could craft a request to use an external url for a site export to then be imported. Version 9.13.9 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-62mf-vhhw-xmf8 - http
P Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-62mf-vhhw-xmf8 - https://github.com/dnnsoftware/Dnn.Platform/commit/13fb13ee76173c3467d7ee8d120b20ca7bd4fa63
CVE ID: CVE-2025-48377 State: PUBLISHED Published: 2025-05-23T15:39:40.020Z Last Updated: 2025-05-23T15:51:16.186Z Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-79m3-rvx2-3qq9 - https://github.com/dnnsoftware/Dnn.Platform/commit/351b166492ad4b
Dnn.Platform/security/advisories/GHSA-79m3-rvx2-3qq9 - https://github.com/dnnsoftware/Dnn.Platform/commit/351b166492ad4b6509c273dc83211d52238e31a7
CVE ID: CVE-2025-48378 State: PUBLISHED Published: 2025-05-23T15:39:03.727Z Last Updated: 2025-05-23T16:01:18.090Z Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-m4hf-fxcg-cp34 - https://github.com/dnnsoftware/Dnn.Platform/commit/cfed83c291d5e5072b2fa70924a
security/advisories/GHSA-m4hf-fxcg-cp34 - https://github.com/dnnsoftware/Dnn.Platform/commit/cfed83c291d5e5072b2fa70924a8b7c35b1cdf9e
CVE ID: CVE-2025-48379 State: PUBLISHED Published: 2025-07-01T18:33:30.687Z Last Updated: 2025-07-01T19:42:22.348Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: python-pillow Products: Pillow Problem Types: CWE-122 Description: Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment
a compressed DDS image. This issue has been patched in version 11.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952 - https://github.com/python-pillow/Pillow/pull/9041 - https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4 - https://github.com/python-pillow/Pillow/releases/tag/11.3.0
CVE ID: CVE-2025-48381 State: PUBLISHED Published: 2025-05-30T03:38:24.317Z Last Updated: 2025-05-30T12:43:13.681Z Vendors: cvat-ai Products: cvat Problem Types: CWE-201 Description: Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tasks, projects, labels, and the IDs of all jobs and quality reports on the CVAT instance. In addition, if the instance contains many resources of a particular type, retrieving this information may tie up system resources, denying access to legitimate users. This issue has been pa
ype, retrieving this information may tie up system resources, denying access to legitimate users. This issue has been patched in version 2.38.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cvat-ai/cvat/security/advisories/GHSA-7484-2gfm-852p - https://github.com/cvat-ai/cvat/commit/7136c99fb2c3a5cb2d8c3ca54b4201b9fa6aab5a
CVE ID: CVE-2025-48382 State: PUBLISHED Published: 2025-05-27T04:32:23.804Z Last Updated: 2025-05-27T14:34:38.199Z Vendors: codelibs Products: fess Problem Types: CWE-732 Description: Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensitive data contained in these files. This issue primarily affects environments where Fess is deployed in a shared or multi-user context. Typical single-user or isolated deployments have minimal or
s where Fess is deployed in a shared or multi-user context. Typical single-user or isolated deployments have minimal or negligible practical impact. This issue has been patched in version 14.19.2. A workaround for this issue involves ensuring local access to the environment running Fess is restricted to trusted users only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/codelibs/fess/security/advisories/GHSA-g88v-2j67-9rmx - https://github.com/codelibs/fess/commit/25b2009fea2a0f6ccd5aa8154aa54b536c08f6c4
CVE ID: CVE-2025-48383 State: PUBLISHED Published: 2025-05-27T15:03:10.062Z Last Updated: 2025-05-27T15:17:02.957Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: codingjoe Products: django-select2 Problem Types: CWE-402, CWE-918 Description: Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data. This issue has been patched in version 8.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.c