Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-27138 State: PUBLISHED Published: 2025-03-13T16:49:34.954Z Last Updated: 2025-03-13T19:48:53.972Z Vendors: dataease Products: dataease Problem Types: CWE-287 Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-533g-whf8-q637
CVE ID: CVE-2025-27139 State: PUBLISHED Published: 2025-02-25T19:52:15.589Z Last Updated: 2025-02-25T20:07:39.635Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences page is opened. Versions 2.7.12, 3.1.2, and 3.2.0 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-c6mg-9537-c8cf
CVE ID: CVE-2025-27140 State: PUBLISHED Published: 2025-02-24T21:21:24.013Z Last Updated: 2025-02-25T14:32:26.749Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-78, CWE-284 Description: WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application, `importar_dump.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. The command is basically a command to move a temporary file, so a webshell upload is also possible. Version 3.2.15 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/L
15 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xw6w-x28r-2p5c - https://github.com/LabRedesCefetRJ/WeGIA/commit/7d0df8c9a0b8b7d6862bbc23dc729d73e39672a1
CVE ID: CVE-2025-27141 State: PUBLISHED Published: 2025-02-24T22:05:14.188Z Last Updated: 2025-02-25T14:31:28.020Z Vendors: metabase Products: metabase Problem Types: CWE-732 Description: Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see results of cached questions, even if their permissions don’t allow them to see the data. If some user runs a question which gets cached, and then an impersonated user runs that question, then the impersonated user sees t
r runs a question which gets cached, and then an impersonated user runs that question, then the impersonated user sees the same results as the previous user. These cached results may include data the impersonated user should not have access to. This vulnerability only impacts the Enterprise Edition of Metabase and not the Open Source Edition. Versions 1.53.2, 1.52.11, 1.51.14, and 1.50.36 contains a patch. Versions on the 1.49.X, 1.48.X, and 1.47.X branches are vulnerable but do not have a patch available, so users should upgrade to a major version with an available fix. Disabling question caching is a workaround for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
sabling question caching is a workaround for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-6cc4-h534-xh5p - https://www.metabase.com/docs/latest/configuring-metabase/caching - https://www.metabase.com/docs/latest/permissions/impersonation
CVE ID: CVE-2025-27142 State: PUBLISHED Published: 2025-02-25T20:03:23.204Z Last Updated: 2025-02-26T16:28:07.214Z Vendors: localsend Products: localsend Problem Types: CWE-22 Description: LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an internet connection. Prior to version 1.17.0, due to the missing sanitization of the path in the `POST /api/localsend/v2/prepare-upload` and the `POST /api/localsend/v2/upload` endpoint, a malicious file transfer request can write files to the arbitrary location on the system, resulting in the remote command execution. A malicious file transfer request
s to the arbitrary location on the system, resulting in the remote command execution. A malicious file transfer request sent by nearby devices can write files into an arbitrary directory. This usually allows command execution via the startup folder on Windows or Bash-related files on Linux. If the user enables the `Quick Save` feature, it will silently write files without explicit user interaction. Version 1.17.0 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/localsend/localsend/security/advisories/GHSA-f7jp-p6j4-3522 - https://github.com/localsend/localsend/commit/e8635204ec782ded45bc7d698deb60f3c4105687
CVE ID: CVE-2025-27143 State: PUBLISHED Published: 2025-02-24T22:16:55.224Z Last Updated: 2025-02-25T14:29:03.293Z Vendors: better-auth Products: better-auth Problem Types: CWE-601 Description: Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs, it incorrectly allows scheme-less URLs. This results in the browser interpreting the URL as a fully qualified URL, leading to unintended redirection. An attacker can exp
lts in the browser interpreting the URL as a fully qualified URL, leading to unintended redirection. An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens. This CVE is a bypass of the fix for GHSA-8jhw-6pjj-8723/CVE-2024-56734. Version 1.1.21 contains an updated patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/better-auth/better-auth/security/advisories/GHSA-hjpm-7mrm-26w8 - https://github.com
t: References: - https://github.com/better-auth/better-auth/security/advisories/GHSA-hjpm-7mrm-26w8 - https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723 - https://github.com/better-auth/better-auth/commit/24659aefc35a536b95ea4e5347e52c8803910153 - https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80 - https://github.com/better-auth/better-auth/releases/tag/v1.1.21
CVE ID: CVE-2025-27144 State: PUBLISHED Published: 2025-02-24T22:22:22.863Z Last Updated: 2025-02-25T14:27:04.978Z Vendors: go-jose Products: go-jose Problem Types: CWE-770 Description: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a larg
t JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78 - https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22 - https://github.com/go-jose/go-jose/
https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22 - https://github.com/go-jose/go-jose/releases/tag/v4.0.5
CVE ID: CVE-2025-27145 State: PUBLISHED Published: 2025-02-25T01:36:46.891Z Last Updated: 2025-02-25T13:59:54.943Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: 9001 Products: copyparty Problem Types: CWE-83, CWE-79 Description: copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the same privileges as that user. For example, this could give unintended read-access to files owned by that use
pt with the same privileges as that user. For example, this could give unintended read-access to files owned by that user. The bug is triggered by the drag-drop action itself; it is not necessary to actually initiate the upload. The file must be empty (zero bytes). Note that, as a general-purpose webserver, it is intentionally possible to upload HTML-files with arbitrary javascript in `<script>` tags, which will execute when the file is opened. The difference is that this vulnerability would trigger execution of javascript during the act of uploading, and not when the uploaded file was opened. Version 1.16.15 contains a fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
ded file was opened. Version 1.16.15 contains a fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/9001/copyparty/security/advisories/GHSA-m2jw-cj8v-937r - https://github.com/9001/copyparty/commit/438ea6ccb06f39d7cbb4b6ee7ad44606e21a63dd - https://github.com/9001/copyparty/releases/tag/v1.16.15
CVE ID: CVE-2025-27146 State: PUBLISHED Published: 2025-02-25T20:04:40.400Z Last Updated: 2025-02-25T20:33:36.095Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: matrix-org Products: matrix-appservice-irc Problem Types: CWE-77, CWE-88 Description: matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
been patched in matrix-appservice-irc version 3.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-5mvm-89c9-9gm5 - https://github.com/matrix-org/matrix-appservice-irc/commit/74f02c8e11f16ed1b355700092c1aa9c036a11bd
CVE ID: CVE-2025-27147 State: PUBLISHED Published: 2025-03-25T14:26:45.264Z Last Updated: 2025-03-25T14:40:39.830Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L) Vendors: glpi-project Products: glpi-inventory-plugin Problem Types: CWE-22, CWE-73, CWE-552 Description: The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access control vulnerability. Version 1.5.0 fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
ulnerability. Version 1.5.0 fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-h6x9-jm98-cw7c - https://github.com/glpi-project/glpi-inventory-plugin/commit/aaeb26d98d07019375c25b56e60fffc195553545
CVE ID: CVE-2025-27148 State: PUBLISHED Published: 2025-02-25T20:13:51.578Z Last Updated: 2025-02-25T21:20:46.507Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: gradle Products: gradle Problem Types: CWE-378, CWE-379 Description: Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. Gradle b
privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. Gradle builds that rely on versions of net.rubygrapefruit:native-platform prior to 0.22-milestone-28 could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. In net.rubygrapefruit:native-platform prior to version 0.22-milestone-28, if the `Native.get(Class<>)` method was called, without calling `Native.init(File)` first, with a non-`null` argument used as working file path, then the library would initialize itself using the system temporary directory and NativeLibraryLocator.java lines 68 through 7
he library would initialize itself using the system temporary directory and NativeLibraryLocator.java lines 68 through 78. Version 0.22-milestone-28 has been released with changes that fix the problem. Initialization is now mandatory and no longer uses the system temporary directory, unless such a path is passed for initialization. The only workaround for affected versions is to make sure to do a proper initialization, using a location that is safe. Gradle 8.12, only that exact version, had codepaths where the initialization of the underlying native integration library took a default path, relying on copying the binaries to the system temporary directory. Any execution of Gradle exposed this
a default path, relying on copying the binaries to the system temporary directory. Any execution of Gradle exposed this exploit. Users of Windows or modern versions of macOS are not vulnerable, nor are users of a Unix-like operating system with the "sticky" bit set or `noexec` on their system temporary directory vulnerable. This problem was fixed in Gradle 8.12.1. Gradle 8.13 release also upgrades to a version of the native library that no longer has that bug. Some workarounds are available. On Unix-like operating systems, ensure that the "sticky" bit is set. This only allows the original user (or root) to delete a file. Mounting `/tmp` as `noexec` will prevent Gradle 8.12 from starting. Th
ows the original user (or root) to delete a file. Mounting `/tmp` as `noexec` will prevent Gradle 8.12 from starting. Those who are are unable to change the permissions of the system temporary directory can move the Java temporary directory by setting the System Property java.io.tmpdir. The new path needs to limit permissions to the build user only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gradle/gradle/security/advisories/GHSA-465q-w4mf-4f4r - https://github.com/gradle/gradle/security/advisories/GHSA-89qm-pxvm-p336 - https://github.com/gradle/native-platform/security/advisories/GHSA-2xxp-vw2f-p3x8 - https://github.com/gradle/gradle/pull/32025 - htt
b.com/gradle/native-platform/security/advisories/GHSA-2xxp-vw2f-p3x8 - https://github.com/gradle/gradle/pull/32025 - https://github.com/gradle/native-platform/pull/353 - https://en.wikipedia.org/wiki/Fstab#Options_common_to_all_filesystems - https://en.wikipedia.org/wiki/Sticky_bit - https://github.com/gradle/native-platform/blob/574dfe8d9fb546c990436468d617ab81c140871d/native-platform/src/main/java/net/rubygrapefruit/platform/internal/NativeLibraryLocator.java#L68-L78
CVE ID: CVE-2025-27149 State: PUBLISHED Published: 2025-03-31T15:33:38.543Z Last Updated: 2025-03-31T18:36:58.695Z Vendors: zulip Products: zulip Problem Types: CWE-497 Description: Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries (E.g., ZulipGitlabWebhook, okhttp, or PycURL) that have been used to access any organization on the server was incorrectly included in all three export types, regardless of if they were used to access the exported organization or not. The
tly included in all three export types, regardless of if they were used to access the exported organization or not. The "public data" and "with consent" exports metadata including the titles of some topics in private channels which the administrator otherwise did not have access to, and none of the users consented to exporting and metadata for which users were in a group DM together. This vulnerability is fixed in 10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-358p-x39m-99mm
CVE ID: CVE-2025-27150 State: PUBLISHED Published: 2025-03-04T16:48:43.226Z Last Updated: 2025-03-04T18:52:59.756Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-538 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11. Addi
erability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-jc5r-684x-j46q - https://github.com/Enalean/tuleap/commit/a6702622a8db969a17522b8fac0774afdb1c916f - https://tuleap.net/plugins/tracker/?aid=41870
CVE ID: CVE-2025-27151 State: PUBLISHED Published: 2025-05-29T09:07:34.779Z Last Updated: 2025-05-29T13:43:09.725Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: redis Products: redis Problem Types: CWE-20, CWE-121 Description: Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2. Additional Anal
overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm - https://github.com/redis/redis/commit/643b5db235cb82508e72f11c7b4bbfc7dc39be56 - https://github.com/redis/redis/releases/tag/8.0.2
CVE ID: CVE-2025-27152 State: PUBLISHED Published: 2025-03-07T15:13:15.155Z Last Updated: 2025-03-07T19:32:17.511Z Vendors: axios Products: axios Problem Types: CWE-918 Description: axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6
st Notes: - CISA ADP Vulnrichment: References: - https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2jv-69x6 - https://github.com/axios/axios/issues/6463
CVE ID: CVE-2025-27153 State: PUBLISHED Published: 2025-07-01T18:27:50.677Z Last Updated: 2025-07-01T19:35:43.790Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: pluginsGLPI Products: escalade Problem Types: CWE-284 Description: Escalade GLPI plugin is a ticket escalation process helper for GLPI. Prior to version 2.9.11, there is an improper access control vulnerability. This can lead to data exposure and workflow disruptions. This issue has been patched in version 2.9.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pluginsGLPI/escalade/security/advisories/GHSA-pvqv-8r3r-47m9 - https://github.com/pluginsGLPI/escalade/
tps://github.com/pluginsGLPI/escalade/security/advisories/GHSA-pvqv-8r3r-47m9 - https://github.com/pluginsGLPI/escalade/releases/tag/2.9.11
CVE ID: CVE-2025-27154 State: PUBLISHED Published: 2025-02-27T13:53:54.161Z Last Updated: 2025-02-27T14:29:50.364Z Vendors: spotipy-dev Products: spotipy Problem Types: CWE-276 Description: Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions o
(another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-pwhh-q4h6-w599 - https://github.com/spotipy-dev/spotipy/commit/1ca453f6ef87a2a9e9876f52b6cb38d13532ccf2 - https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py#L93-L98 - https://github.com/spotipy-dev/spotipy/releases/tag/2.25.1
CVE ID: CVE-2025-27155 State: PUBLISHED Published: 2025-03-04T16:29:35.924Z Last Updated: 2025-03-04T16:57:46.139Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: matrix-org Products: pinecone Problem Types: CWE-79, CWE-80 Description: Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) included in Pinecone up to commit ea4c337 is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconesim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/pinecone/s
g pineconesim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/pinecone/security/advisories/GHSA-fr62-mg2q-7wqv - https://github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bd