Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24350 State: PUBLISHED Published: 2025-04-30T11:45:52.088Z Last Updated: 2025-04-30T14:23:43.476Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-23 Description: A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to write arbitrary certificates in arbitrary file system paths via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24351 State: PUBLISHED Published: 2025-04-30T11:47:00.441Z Last Updated: 2025-08-27T20:43:01.365Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-78 Description: A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to execute arbitrary OS commands in the context of user “root” via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-24353 State: PUBLISHED Published: 2025-01-23T17:45:32.868Z Last Updated: 2025-02-12T20:41:29.561Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-269 Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. V
those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-pmf4-v838-29hg - https://github.com/directus/directus/pull/23716 - https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804 - https://github.com/directus/directus/releases/tag/v11.2.0 - https://www.youtube.com/watch?v=DbV4IxbWzN4
CVE ID: CVE-2025-24354 State: PUBLISHED Published: 2025-01-27T17:23:58.303Z Last Updated: 2025-02-12T20:41:35.745Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: imgproxy Products: imgproxy Problem Types: CWE-918 Description: imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/imgproxy/imgproxy/security/advisories/GHSA-j2hp-6m75-v4j4 - https://github.com/imgproxy/imgpro
ces: - https://github.com/imgproxy/imgproxy/security/advisories/GHSA-j2hp-6m75-v4j4 - https://github.com/imgproxy/imgproxy/commit/3d4fed6842aa8930ec224d0ad75b0079b858e081
CVE ID: CVE-2025-24355 State: PUBLISHED Published: 2025-01-24T16:48:17.723Z Last Updated: 2025-02-12T20:01:18.920Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: updatecli Products: updatecli Problem Types: CWE-359 Description: Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized
e credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/updatecli/updatecli/security/advisories/GHSA-v34r-vj4r-38j6 - https://github.com/updatecli/updatecli/commit/344b28091ffeca5ed32e8d0f9eda542842fcd3fa
CVE ID: CVE-2025-24356 State: PUBLISHED Published: 2025-01-27T17:31:38.541Z Last Updated: 2025-01-28T15:39:06.688Z Vendors: neocturne Products: fastd Problem Types: CWE-405 Description: fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast reconnect" avoids having to wait for a session timeout (up to ~90s) until a new connection is established. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake packet
lished. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake packet (~150 bytes of UDP payload). Including IPv4 and UDP headers, the resulting amplification factor is roughly 12-13. By sending data packets with a spoofed source address to fastd instances reachable on the internet, this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack. This vulnerability is fixed in v23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/neocturne/fastd/security/advisories/GHSA-pggg-vpfv-4rcv - https://github.com/neocturne/fastd/commit/1f233bee76b722c0b3f9024f2c39c72e9f7e5843 -
y/advisories/GHSA-pggg-vpfv-4rcv - https://github.com/neocturne/fastd/commit/1f233bee76b722c0b3f9024f2c39c72e9f7e5843 - https://github.com/neocturne/fastd/commit/3940150e801d0c91460491bec32cbcc5bbc89d5f - https://github.com/neocturne/fastd/commit/5f63fcfc18ae9cad023fa463b152d5e14192b5a8 - https://github.com/neocturne/fastd/commit/9df7e516378441d2d17b89f9db5c27c8312d8f12 - https://github.com/neocturne/fastd/commit/c1a07b3f2b9066c3713c68547da700b85d60f4f7 - https://github.com/neocturne/fastd/commit/ce1b79b12dbfa796743b5f3a50789ade965b7023 - https://github.com/neocturne/fastd/commit/d03a0a17347efb5293e42fde7d982781e90f14ef
CVE ID: CVE-2025-24357 State: PUBLISHED Published: 2025-01-27T17:38:20.070Z Last Updated: 2025-02-12T20:41:36.324Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-502 Description: vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When torch.load loads malicious pickle data, it will execute arbitrary code during unpickling. This vulnerability is fixed in v0.7.0. Additional Analyst Notes: - CISA AD
ill execute arbitrary code during unpickling. This vulnerability is fixed in v0.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 - https://github.com/vllm-project/vllm/pull/12366 - https://github.com/vllm-project/vllm/commit/d3d6bb13fb62da3234addf6574922a4ec0513d04 - https://pytorch.org/docs/stable/generated/torch.load.html
CVE ID: CVE-2025-24358 State: PUBLISHED Published: 2025-04-15T18:57:40.559Z Last Updated: 2025-05-01T11:02:45.986Z Vendors: gorilla Products: csrf Problem Types: CWE-352 Description: gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for "server" requests per the Go spec, and so this check does not run in practice. T
ever, this value is never populated for "server" requests per the Go spec, and so this check does not run in practice. This vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain. This vulnerability is fixed in 1.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gorilla/csrf/security/advisories/GHSA-rq77-p4h8-4crw - https://github.com/gorilla/csrf/commit/9dd6af1f6d30fc79fb0d972394deebdabad6b5eb
CVE ID: CVE-2025-24359 State: PUBLISHED Published: 2025-01-24T16:52:44.304Z Last Updated: 2025-02-12T20:01:18.799Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: lmfit Products: asteval Problem Types: CWE-134, CWE-749 Description: ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous for
al` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3g9f-9gc7 - https://github.com/lmfit/asteval/blob/cfb57f0beebe0dc0520a1fbabc35e66060c7ea71/asteval/asteval.py#L507 - https://lucumr.pocoo.org/2016/12/29/careful-with-str-format
CVE ID: CVE-2025-24360 State: PUBLISHED Published: 2025-01-25T00:49:09.783Z Last Updated: 2025-02-12T20:41:32.307Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: nuxt Products: nuxt Problem Types: CWE-200 Description: Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: R
olen by malicious websites. Version 3.15.3 fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47 - https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6 - https://github.com/nuxt/nuxt/pull/23995 - https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f - https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263 - https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39
CVE ID: CVE-2025-24361 State: PUBLISHED Published: 2025-01-25T00:53:23.400Z Last Updated: 2025-02-12T20:41:32.191Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: nuxt Products: nuxt Problem Types: CWE-749 Description: Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::t
to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99 - https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f
CVE ID: CVE-2025-24362 State: PUBLISHED Published: 2025-01-24T18:04:45.674Z Last Updated: 2025-03-31T13:47:02.009Z Vendors: github Products: codeql-action Problem Types: CWE-532 Description: In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository would be able to access this artifact, containing any secrets from the environment. This vulnerability is patched in CodeQL Action version 3.28.3 or later, or CodeQL CLI version 2.20.3 or later. For some affected w
rability is patched in CodeQL Action version 3.28.3 or later, or CodeQL CLI version 2.20.3 or later. For some affected workflow runs, the exposed environment variables in the debug artifacts included a valid `GITHUB_TOKEN` for the workflow run, which has access to the repository in which the workflow ran, and all the permissions specified in the workflow or job. The `GITHUB_TOKEN` is valid until the job completes or 24 hours has elapsed, whichever comes first. Environment variables are exposed only from workflow runs that satisfy all of the following conditions: - Code scanning workflow configured to scan the Java/Kotlin languages. - Running in a repository containing Kotlin source code. - R
ning workflow configured to scan the Java/Kotlin languages. - Running in a repository containing Kotlin source code. - Running with debug artifacts enabled. - Using CodeQL Action versions <= 3.28.2, and CodeQL CLI versions >= 2.9.2 (May 2022) and <= 2.20.2. - The workflow run fails before the CodeQL database is finalized within the `github/codeql-action/analyze` step. - Running in any GitHub environment: GitHub.com, GitHub Enterprise Cloud, and GitHub Enterprise Server. Note: artifacts are only accessible to users within the same GitHub environment with access to the scanned repo. The `GITHUB_TOKEN` exposed in this way would only have been valid for workflow runs that satisfy all of the foll
d repo. The `GITHUB_TOKEN` exposed in this way would only have been valid for workflow runs that satisfy all of the following conditions, in addition to the conditions above: - Using CodeQL Action versions >= 3.26.11 (October 2024) and <= 3.28.2, or >= 2.26.11 and < 3. - Running in GitHub.com or GitHub Enterprise Cloud only (not valid on GitHub Enterprise Server). In rare cases during advanced setup, logging of environment variables may also occur during database creation of Java, Swift, and C/C++. Please read the corresponding CodeQL CLI advisory GHSA-gqh3-9prg-j95m for more details. In CodeQL CLI versions >= 2.9.2 and <= 2.20.2, the CodeQL Kotlin extractor logs all environment variables by
re details. In CodeQL CLI versions >= 2.9.2 and <= 2.20.2, the CodeQL Kotlin extractor logs all environment variables by default into an intermediate file during the process of creating a CodeQL database for Kotlin code. This is a part of the CodeQL CLI and is invoked by the CodeQL Action for analyzing Kotlin repositories. On Actions, the environment variables logged include GITHUB_TOKEN, which grants permissions to the repository being scanned. The intermediate file containing environment variables is deleted when finalizing the database, so it is not included in a successfully created database. It is, however, included in the debug artifact that is uploaded on a failed analysis run if the
fully created database. It is, however, included in the debug artifact that is uploaded on a failed analysis run if the CodeQL Action was invoked in debug mode. Therefore, under these specific circumstances (incomplete database creation using the CodeQL Action in debug mode) an attacker with access to the debug artifact would gain unauthorized access to repository secrets from the environment, including both the `GITHUB_TOKEN` and any user-configured secrets made available via environment variables. The impact of the `GITHUB_TOKEN` leaked in this environment is limited: - For workflows on GitHub.com and GitHub Enterprise Cloud using CodeQL Action versions >= 3.26.11 and <= 3.28.2, or >= 2.26
or workflows on GitHub.com and GitHub Enterprise Cloud using CodeQL Action versions >= 3.26.11 and <= 3.28.2, or >= 2.26.11 and < 3, which in turn use the `actions/artifacts v4` library, the debug artifact is uploaded before the workflow job completes. During this time the `GITHUB_TOKEN` is still valid, providing an opportunity for attackers to gain access to the repository. - For all other workflows, the debug artifact is uploaded after the workflow job completes, at which point the leaked `GITHUB_TOKEN` has been revoked and cannot be used to access the repository. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/github/codeql-acti
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/github/codeql-action/security/advisories/GHSA-vqf5-2xx6-9wfm - https://github.com/github/codeql-cli-binaries/security/advisories/GHSA-gqh3-9prg-j95m - https://github.com/github/codeql-action/pull/1074 - https://github.com/github/codeql-action/pull/2482 - https://github.com/github/codeql-action/commit/519de26711ecad48bde264c51e414658a82ef3fa - https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/logs-not-detailed-enough
CVE ID: CVE-2025-24363 State: PUBLISHED Published: 2025-01-24T18:54:44.179Z Last Updated: 2025-01-24T19:19:20.046Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: HL7 Products: fhir-ig-publisher Problem Types: CWE-200 Description: The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses git commands to determine the URL of the originating repo. If the repo was cloned, or otherwise set to use a repo that uses a username and credential based URL, the entire URL will be included in the built Implementation Guide, exposing username and credential. This does not im
L, the entire URL will be included in the built Implementation Guide, exposing username and credential. This does not impact users that clone public repos without credentials, such as those using the auto-ig-build continuous integration infrastructure. This problem has been patched in release 1.8.9. Some workarounds are available. Users should ensure the IG repo they are publishing does not have username or credentials included in the `origin` URL. Running the command `git remote origin url` should return a URL that contains no username, password, or token; or users should run the IG Publisher CLI with the `-repo` parameter and specify a URL that contains no username, password, or token. Add
run the IG Publisher CLI with the `-repo` parameter and specify a URL that contains no username, password, or token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-6729-95v3-pjc2 - https://github.com/HL7/fhir-ig-publisher/commit/d968694b7dd041640efab5414d7077d5028569f7 - https://github.com/HL7/fhir-ig-publisher/releases/tag/1.8.9
CVE ID: CVE-2025-24364 State: PUBLISHED Published: 2025-01-27T17:46:15.260Z Last Updated: 2025-02-12T20:41:36.200Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: dani-garcia Products: vaultwarden Problem Types: CWE-74 Description: vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker with authenticated access to the vaultwarden admin panel can execute arbitrary code in the system. The attacker could then change some settings to use sendmail as mail agent but adjust the settings in such a way that it would use a shell command. It then also needed to craft a special favicon image which would have the
such a way that it would use a shell command. It then also needed to craft a special favicon image which would have the commands embedded to run during for example sending a test email. This vulnerability is fixed in 1.33.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h6cc-rc6q-23j4 - https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0
CVE ID: CVE-2025-24365 State: PUBLISHED Published: 2025-01-27T17:49:57.796Z Last Updated: 2025-02-12T20:41:36.070Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: dani-garcia Products: vaultwarden Problem Types: CWE-284 Description: vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed
of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797 - https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0
CVE ID: CVE-2025-24366 State: PUBLISHED Published: 2025-02-07T21:16:40.375Z Last Updated: 2025-02-07T22:49:18.456Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: drakkan Products: sftpgo Problem Types: CWE-78 Description: SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authe
ot work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. This issue was fixed in version v2.6.5 by checking the client provided arguments. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/drakkan/sftpgo/security/advisories/GHSA-vj7w-3m8c-6vpx - https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1