Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-64133 State: PUBLISHED Published: 2025-10-29T13:29:41.045Z Last Updated: 2025-11-04T21:14:25.010Z Vendors: Jenkins Project Products: Jenkins Extensible Choice Parameter Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3583
CVE ID: CVE-2025-64134 State: PUBLISHED Published: 2025-10-29T13:29:41.699Z Last Updated: 2025-11-04T21:14:26.342Z Vendors: Jenkins Project Products: Jenkins JDepend Plugin Description: Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936
CVE ID: CVE-2025-64135 State: PUBLISHED Published: 2025-10-29T13:29:42.358Z Last Updated: 2025-11-04T21:14:27.669Z Vendors: Jenkins Project Products: Jenkins Eggplant Runner Plugin Description: Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value, disabling a protection mechanism of the Java runtime. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3326
CVE ID: CVE-2025-64136 State: PUBLISHED Published: 2025-10-29T13:29:42.998Z Last Updated: 2025-11-04T21:14:29.011Z Vendors: Jenkins Project Products: Jenkins Themis Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3517
CVE ID: CVE-2025-64137 State: PUBLISHED Published: 2025-10-29T13:29:43.669Z Last Updated: 2025-11-04T21:14:30.356Z Vendors: Jenkins Project Products: Jenkins Themis Plugin Description: A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3517
CVE ID: CVE-2025-64138 State: PUBLISHED Published: 2025-10-29T13:29:44.349Z Last Updated: 2025-11-04T21:14:31.752Z Vendors: Jenkins Project Products: Jenkins Start Windocks Containers Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3531
CVE ID: CVE-2025-64139 State: PUBLISHED Published: 2025-10-29T13:29:45.114Z Last Updated: 2025-11-04T21:14:33.120Z Vendors: Jenkins Project Products: Jenkins Start Windocks Containers Plugin Description: A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3531
CVE ID: CVE-2025-64140 State: PUBLISHED Published: 2025-10-29T13:29:45.804Z Last Updated: 2025-11-04T21:14:34.461Z Vendors: Jenkins Project Products: Jenkins Azure CLI Plugin Description: Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3538
CVE ID: CVE-2025-64141 State: PUBLISHED Published: 2025-10-29T13:29:46.447Z Last Updated: 2025-11-04T21:14:35.812Z Vendors: Jenkins Project Products: Jenkins Nexus Task Runner Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3550
CVE ID: CVE-2025-64142 State: PUBLISHED Published: 2025-10-29T13:29:47.116Z Last Updated: 2025-11-04T21:14:37.130Z Vendors: Jenkins Project Products: Jenkins Nexus Task Runner Plugin Description: A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3550
CVE ID: CVE-2025-64143 State: PUBLISHED Published: 2025-10-29T13:29:47.762Z Last Updated: 2025-11-04T21:14:38.426Z Vendors: Jenkins Project Products: Jenkins OpenShift Pipeline Plugin Description: Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3553
CVE ID: CVE-2025-64144 State: PUBLISHED Published: 2025-10-29T13:29:48.402Z Last Updated: 2025-11-04T21:14:39.751Z Vendors: Jenkins Project Products: Jenkins ByteGuard Build Actions Plugin Description: Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3560
CVE ID: CVE-2025-64145 State: PUBLISHED Published: 2025-10-29T13:29:49.056Z Last Updated: 2025-11-04T21:14:41.055Z Vendors: Jenkins Project Products: Jenkins ByteGuard Build Actions Plugin Description: Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3560
CVE ID: CVE-2025-64146 State: PUBLISHED Published: 2025-10-29T13:29:49.711Z Last Updated: 2025-11-04T21:14:42.392Z Vendors: Jenkins Project Products: Jenkins Curseforge Publisher Plugin Description: Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3562
CVE ID: CVE-2025-64147 State: PUBLISHED Published: 2025-10-29T13:29:50.359Z Last Updated: 2025-11-04T21:14:43.680Z Vendors: Jenkins Project Products: Jenkins Curseforge Publisher Plugin Description: Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3562
CVE ID: CVE-2025-64148 State: PUBLISHED Published: 2025-10-29T13:29:51.005Z Last Updated: 2025-11-04T21:14:44.983Z Vendors: Jenkins Project Products: Jenkins Publish to Bitbucket Plugin Description: A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3570
CVE ID: CVE-2025-64149 State: PUBLISHED Published: 2025-10-29T13:29:51.666Z Last Updated: 2025-11-04T21:14:46.295Z Vendors: Jenkins Project Products: Jenkins Publish to Bitbucket Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3576
CVE ID: CVE-2025-64150 State: PUBLISHED Published: 2025-10-29T13:29:52.313Z Last Updated: 2025-11-04T21:14:47.588Z Vendors: Jenkins Project Products: Jenkins Publish to Bitbucket Plugin Description: A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-3576
CVE ID: CVE-2025-64151 State: PUBLISHED Published: 2025-11-05T06:19:25.053Z Last Updated: 2025-11-05T17:08:42.226Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Roboticsware PTE. LTD. Products: FA-Panel6, BA-Panel6, PA-Panel6, FA-Server6 Problem Types: CWE-428 Description: Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.roboticsware.com/dev-jp/2025/10/28/announcements-20251028/ - https://j
CISA ADP Vulnrichment: References: - https://www.roboticsware.com/dev-jp/2025/10/28/announcements-20251028/ - https://jvn.jp/en/jp/JVN92563420/
CVE ID: CVE-2025-64158 State: REJECTED Published: N/A Last Updated: 2025-10-29T03:55:07.530Z Description: No description available.
CVE ID: CVE-2025-64159 State: REJECTED Published: N/A Last Updated: 2025-10-29T03:55:06.994Z Description: No description available.
CVE ID: CVE-2025-64160 State: REJECTED Published: N/A Last Updated: 2025-10-29T03:55:06.432Z Description: No description available.
CVE ID: CVE-2025-64161 State: REJECTED Published: N/A Last Updated: 2025-10-29T03:55:05.817Z Description: No description available.
CVE ID: CVE-2025-64162 State: REJECTED Published: N/A Last Updated: 2025-10-29T03:55:04.987Z Description: No description available.
CVE ID: CVE-2025-64163 State: PUBLISHED Published: 2025-11-05T23:52:05.196Z Last Updated: 2025-11-06T21:18:12.403Z Vendors: dataease Products: dataease Problem Types: CWE-918 Description: DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-8397-v66p-539m - https://github.com/dataease/dataease/commit/869b7fb8b10069ac6c326554bfa8f060a539ba85
y/advisories/GHSA-8397-v66p-539m - https://github.com/dataease/dataease/commit/869b7fb8b10069ac6c326554bfa8f060a539ba85 - https://github.com/dataease/dataease/releases/tag/v2.10.15
CVE ID: CVE-2025-64164 State: PUBLISHED Published: 2025-11-06T00:07:58.592Z Last Updated: 2025-11-06T21:17:41.345Z Vendors: dataease Products: dataease Problem Types: CWE-502 Description: Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections to Oracle, resulting in a risk of JNDI injection (Java Naming and Directory Interface injection). This issue is fixed in version 2.10.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-q754-4pc2-wjqw - https://github.com/dataease/dataease/commit/7b68eb3dfccbbd12ec977e6320
ataease/security/advisories/GHSA-q754-4pc2-wjqw - https://github.com/dataease/dataease/commit/7b68eb3dfccbbd12ec977e6320dbd3e32a7bbfe6 - https://github.com/dataease/dataease/releases/tag/v2.10.15
CVE ID: CVE-2025-64167 State: PUBLISHED Published: 2025-11-10T21:15:11.632Z Last Updated: 2025-11-10T21:43:14.849Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack (leading to JS execution) when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-pr7w-2cr9-5h38
CVE ID: CVE-2025-64168 State: PUBLISHED Published: 2025-10-31T14:58:54.447Z Last Updated: 2025-10-31T15:39:39.368Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: agno-agi Products: agno Problem Types: CWE-362, CWE-668 Description: Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. This has been patched in version 2.2.2. Additional Analyst Notes: -
ata from one session being exposed to another user. This has been patched in version 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/agno-agi/agno/security/advisories/GHSA-vw84-hprm-cxmm
CVE ID: CVE-2025-64169 State: PUBLISHED Published: 2025-11-21T18:39:02.463Z Last Updated: 2025-11-21T19:05:51.973Z Vendors: wazuh Products: wazuh Problem Types: CWE-252, CWE-476 Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 3.7.0 to before 4.12.0, fim_alert() implementation does not check whether oldsum->md5 is NULL or not before dereferencing it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. This issue has been patched in version 4.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wazuh/wazuh/security/advisories/G
0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wazuh/wazuh/security/advisories/GHSA-hc35-h924-8596
CVE ID: CVE-2025-64170 State: PUBLISHED Published: 2025-11-12T20:30:14.961Z Last Updated: 2025-11-14T17:34:21.165Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: trifectatechfoundation Products: sudo-rs Problem Types: CWE-549 Description: sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully ha
ck to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw - https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10
CVE ID: CVE-2025-64171 State: PUBLISHED Published: 2025-11-06T00:23:48.695Z Last Updated: 2025-11-06T21:17:02.114Z Vendors: 3scale-sre Products: marin3r Problem Types: CWE-862 Description: MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is fixed in version 0.13.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/3scale-sre/marin3r/security/advisories/GHSA-gf93-xccm-5g6j - https://github.com/3scale-sre/marin3r/commit
s://github.com/3scale-sre/marin3r/security/advisories/GHSA-gf93-xccm-5g6j - https://github.com/3scale-sre/marin3r/commit/859b14115fde1d67620e645cd1b62e90e30d9981
CVE ID: CVE-2025-64173 State: PUBLISHED Published: 2025-11-06T20:42:51.785Z Last Updated: 2025-11-07T13:48:35.506Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: apollographql Products: router Problem Types: CWE-288 Description: Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying th
ctly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives on their implementing object types/fields when all implementations had the same requirements. Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives inconsistently on polymorphic types (i.e., object types that implement interface types) are impacted. This issue is fixed in versions 1.61.12 and 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/router/security/advisories/GHSA-x33c-7c2v-mrj9 - https://github.com/apollographql/router/rel
://github.com/apollographql/router/security/advisories/GHSA-x33c-7c2v-mrj9 - https://github.com/apollographql/router/releases/tag/v2.8.1 - https://www.apollographql.com/docs/graphos/routing/security/authorization#authorization-directives
CVE ID: CVE-2025-64174 State: PUBLISHED Published: 2025-11-06T20:45:55.915Z Last Updated: 2025-11-06T21:20:10.817Z Vendors: OpenMage Products: magento-lts Problem Types: CWE-79 Description: Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Unescaped translation strings and URLs are printed into contexts inside app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. A malicious translation or polluted d
inside app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. A malicious translation or polluted data can inject script. This issue is fixed in version 20.16.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-qv78-c8hc-438r - https://github.com/OpenMage/magento-lts/commit/9d604f5489851c54a96fca31b0e13c414b0fb20a
CVE ID: CVE-2025-64176 State: PUBLISHED Published: 2025-11-06T21:12:38.265Z Last Updated: 2025-11-06T21:31:41.244Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: MatiasDesuu Products: ThinkDashboard Problem Types: CWE-20, CWE-434, CWE-79 Description: ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip file to bypass the client-side file-type verification. This could lead to stored XSS, or be used for other nefarious
zip file to bypass the client-side file-type verification. This could lead to stored XSS, or be used for other nefarious purposes such as malware distribution. This issue is fixed in version 0.6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-jvmw-hg62-jr47 - https://github.com/MatiasDesuu/ThinkDashboard/commit/18d2f6aded0d6424cc4c8619731dd20563f4cfd8
CVE ID: CVE-2025-64177 State: PUBLISHED Published: 2025-11-06T21:32:43.236Z Last Updated: 2025-11-06T21:45:13.536Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: MatiasDesuu Products: ThinkDashboard Problem Types: CWE-79 Description: ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting (XSS) vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme filtering. This is fixed in version 0.6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MatiasD
s is fixed in version 0.6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-57f2-rhxm-fjv3 - https://github.com/MatiasDesuu/ThinkDashboard/commit/16976263b22a4b0526b2c7c30294cc099258edae
CVE ID: CVE-2025-64178 State: PUBLISHED Published: 2025-11-06T21:46:58.994Z Last Updated: 2025-11-07T14:59:57.782Z Vendors: jon4hz Products: jellysweep Problem Types: CWE-918 Description: Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, accepted a URL parameter that was directly passed to the cache package, which downloaded the poster from this URL. This URL parameter can be used to make the Jellysweep server download arbitrary content. The API endpoint can only be used by authenticated users. This issue is fixed in version 0.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ed by authenticated users. This issue is fixed in version 0.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jon4hz/jellysweep/security/advisories/GHSA-xc93-q32j-cpcg - https://github.com/jon4hz/jellysweep/commit/17466312510966418aea941e4944229856d55101
CVE ID: CVE-2025-64179 State: PUBLISHED Published: 2025-11-06T21:57:18.234Z Last Updated: 2025-11-07T13:24:42.263Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: treeverse Products: lakeFS Problem Types: CWE-862, CWE-200 Description: lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a l