Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-52447 State: PUBLISHED Published: 2025-07-25T18:50:03.762Z Last Updated: 2025-07-25T19:12:47.257Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE ID: CVE-2025-52448 State: PUBLISHED Published: 2025-07-25T18:53:39.834Z Last Updated: 2025-07-25T19:12:16.762Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE ID: CVE-2025-52449 State: PUBLISHED Published: 2025-07-25T18:56:25.554Z Last Updated: 2025-08-26T03:55:25.197Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE ID: CVE-2025-52450 State: PUBLISHED Published: 2025-08-22T20:18:19.554Z Last Updated: 2025-08-27T14:55:29.097Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (abdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005132575&type=1
CVE ID: CVE-2025-52451 State: PUBLISHED Published: 2025-08-22T20:20:12.596Z Last Updated: 2025-08-22T21:03:09.804Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005132575&type=1
CVE ID: CVE-2025-52452 State: PUBLISHED Published: 2025-07-25T19:00:05.794Z Last Updated: 2025-07-25T20:09:34.151Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE ID: CVE-2025-52453 State: PUBLISHED Published: 2025-07-25T19:05:50.905Z Last Updated: 2025-07-25T20:13:23.380Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE ID: CVE-2025-52454 State: PUBLISHED Published: 2025-07-25T19:08:59.366Z Last Updated: 2025-07-25T20:34:32.343Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE ID: CVE-2025-52455 State: PUBLISHED Published: 2025-07-25T19:11:47.772Z Last Updated: 2025-07-25T20:35:15.934Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE ID: CVE-2025-52456 State: PUBLISHED Published: 2025-08-25T14:17:35.230Z Last Updated: 2025-11-03T18:13:04.538Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAIL Image Decoding Library Products: SAIL Image Decoding Library Problem Types: CWE-680 Description: A memory corruption vulnerability exists in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .webp animation an integer overflow can be made to occur when calculating the stride for decoding. Afterwards, this will cause a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need
e a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2224
CVE ID: CVE-2025-52457 State: PUBLISHED Published: 2025-11-18T03:25:57.696Z Last Updated: 2025-11-19T16:49:38.128Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Gallagher Products: HBUS Devices Problem Types: CWE-208 Description: Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all ve
vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457
CVE ID: CVE-2025-52459 State: PUBLISHED Published: 2025-07-10T23:28:08.679Z Last Updated: 2025-07-11T13:29:56.285Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Advantech Products: iView Problem Types: CWE-88 Description: A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters can be used directly in a command without proper sanitization, allowing arbitrary arguments to be injected. This can result in information disclosure, including sensitive database credentials. Additional Analyst Notes: - CISA A
This can result in information disclosure, including sensitive database credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183
CVE ID: CVE-2025-52460 State: PUBLISHED Published: 2025-08-28T08:27:52.965Z Last Updated: 2025-08-28T14:17:26.892Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: DOS Co., Ltd. Products: SS1, SS1 Cloud Problem Types: CWE-552 Description: Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exploited, uploaded files and SS1 configuration files may be accessed by a remote unauthenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dos-osaka.co.jp/news/2025/08/250827.html - https://jvn.jp/en/jp/JVN99577552/
CVE ID: CVE-2025-52461 State: PUBLISHED Published: 2025-08-25T13:53:37.361Z Last Updated: 2025-11-03T18:13:05.521Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-125 Description: An out-of-bounds read vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted .nex file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-202
A ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2238
CVE ID: CVE-2025-52462 State: PUBLISHED Published: 2025-07-02T05:02:42.488Z Last Updated: 2025-07-02T13:16:36.963Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: QUALITIA CO., LTD. Products: Active! mail 6 Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in Active! mail 6 BuildInfo: 6.30.01004145 to 6.60.06008562. If this vulnerability is exploited, an arbitrary script may be executed on the logged-in user's web browser when the user is accessing a specially crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qualitia.com/jp/news/2025/07/02_1100.html - https://jvn.jp/en/jp/JVN89505333/
CVE ID: CVE-2025-52463 State: PUBLISHED Published: 2025-07-02T05:02:48.541Z Last Updated: 2025-07-02T13:15:35.821Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: QUALITIA CO., LTD. Products: Active! mail 6 Problem Types: CWE-352 Description: Cross-site request forgery vulnerability exists in Active! mail 6 BuildInfo: 6.60.06008562 and earlier. If this vulnerability is exploited, unintended E-mail may be sent when a user accesses a specially crafted URL while being logged in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qualitia.com/jp/news/2025/07/02_1100.html - https://jvn.jp/en/jp/JVN89505333/
CVE ID: CVE-2025-52464 State: PUBLISHED Published: 2025-06-19T15:10:18.365Z Last Updated: 2025-06-23T17:39:31.610Z Vendors: meshtastic Products: firmware Problem Types: CWE-331 Description: Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize the internal randomness pool on some platforms, leading to possible low-entropy key generation. When users with an affected key pair sent Direct Messages, those message could be captured and decrypted by an attacker that has compiled the list of comp
ir sent Direct Messages, those message could be captured and decrypted by an attacker that has compiled the list of compromised keys. This issue has been patched in version 2.6.11 where key generation is delayed til the first time the LoRa region is set, along with warning users when a compromised key is detected. Version 2.6.12 furthers this patch by automatically wiping known compromised keys when found. A workaround to this vulnerability involves users doing a complete device wipe to remove vendor-cloned keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meshtastic/firmware/security/advisories/GHSA-gq7v-jr8c-mfr7 - https://github.com/meshtastic/firmw
: - https://github.com/meshtastic/firmware/security/advisories/GHSA-gq7v-jr8c-mfr7 - https://github.com/meshtastic/firmware/commit/4bf2dd04aeeccc4ba20c79bcaad7a572aabdecad - https://github.com/meshtastic/firmware/commit/55b2bbf93756fc7bbbfdbc7cbf29f88e6b637f22 - https://github.com/meshtastic/firmware/commit/e5f6804421ac4b76dd31980250a505dba24c2aa6 - https://github.com/meshtastic/firmware/commit/e623c70bd0c2ab9db9baf04888e19d1428310bb9
CVE ID: CVE-2025-52467 State: PUBLISHED Published: 2025-06-19T02:50:51.240Z Last Updated: 2025-06-23T16:58:52.667Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: timescale Products: pgai Problem Types: CWE-200 Description: pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular, the GITHUB_TOKEN with write permissions for the repository, allowing an attacker to tamper with all aspects of the repository, including pushing arbitrary code and releases. This
allowing an attacker to tamper with all aspects of the repository, including pushing arbitrary code and releases. This issue has been patched in commit 8eb3567. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/timescale/pgai/security/advisories/GHSA-89qq-hgvp-x37m - https://github.com/timescale/pgai/pull/742 - https://github.com/timescale/pgai/commit/8eb356729c33560ce54b88b9a956960ad1e3ede8
CVE ID: CVE-2025-52471 State: PUBLISHED Published: 2025-06-24T19:53:06.066Z Last Updated: 2025-06-24T20:02:18.529Z Vendors: espressif Products: esp-idf Problem Types: CWE-191 Description: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. An integer underflow vulnerability has been identified in the ESP-NOW protocol implementation within the ESP Wi-Fi component of versions 5.4.1, 5.3.3, 5.2.5, and 5.1.6 of the ESP-IDF framework. This issue stems from insufficient validation of user-supplied data length in the packet receive function. Under certain conditions, this may lead to out-of-bounds memory access and may allow arbitrary memory write operations. On systems without
itions, this may lead to out-of-bounds memory access and may allow arbitrary memory write operations. On systems without a memory protection scheme, this behavior could potentially be used to achieve remote code execution (RCE) on the target device. In versions 5.4.2, 5.3.4, 5.2.6, and 5.1.6, ESP-NOW has added more comprehensive validation logic on user-supplied data length during packet reception to prevent integer underflow caused by negative value calculations. For ESP-IDF v5.3 and earlier, a workaround can be applied by validating that the `data_len` parameter received in the RX callback (registered via `esp_now_register_recv_cb()`) is a positive value before further processing. For ESP-
in the RX callback (registered via `esp_now_register_recv_cb()`) is a positive value before further processing. For ESP-IDF v5.4 and later, no application-level workaround is available. Users are advised to upgrade to a patched version of ESP-IDF to take advantage of the built-in mitigation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/esp-idf/security/advisories/GHSA-hqhh-cp47-fv5g - https://github.com/espressif/esp-idf/commit/b1a379d57430d265a53aca13d59ddfbf2e7ac409 - https://github.com/espressif/esp-idf/commit/c5fc81917805f99e687c81cc56b68dc5df7ef8b5 - https://github.com/espressif/esp-idf/commit/d4dafbdc3572387cd4f9a62b776580bc4ac3bde7 - ht
f99e687c81cc56b68dc5df7ef8b5 - https://github.com/espressif/esp-idf/commit/d4dafbdc3572387cd4f9a62b776580bc4ac3bde7 - https://github.com/espressif/esp-idf/commit/d6ec5a52255b17c1d6ef379e89f9de2c379042f8 - https://github.com/espressif/esp-idf/commit/df7757d8279871fa7a2f42ef3962c6c1ec88b8a2 - https://github.com/espressif/esp-idf/commit/edc227c5eaeced999b5212943a9434379f8aad80
CVE ID: CVE-2025-52472 State: PUBLISHED Published: 2025-10-06T14:53:46.654Z Last Updated: 2025-10-06T15:13:42.161Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-89 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quote
r clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gprp-h92g-gc2h - https://github.com/xwiki/xwiki-platform/commit/743ebf8696ffa55161ed2c5ecf26b09f69e6bcf1 - https://github.com/xwiki/xwiki-platform/commit/a45eca2af772abb7324e56d7fd2df1ac937bc445 - https://jira.xwiki.org/browse/XWIKI-23247
CVE ID: CVE-2025-52473 State: PUBLISHED Published: 2025-07-10T18:42:17.710Z Last Updated: 2025-07-10T19:16:29.556Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: open-quantum-safe Products: liboqs Problem Types: CWE-200 Description: liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Multiple secret-dependent branches have been identified in the reference implementation of the HQC key encapsulation mechanism when it is compiled with Clang for optimization levels above -O0 (-O1, -O2, etc). A proof-of-concept local attack exploits this secret-dependent information to recover the entire secret key
, -O2, etc). A proof-of-concept local attack exploits this secret-dependent information to recover the entire secret key. This vulnerability is fixed in 0.14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-qq3m-rq9v-jfgm - https://github.com/open-quantum-safe/liboqs/commit/4215362acbf69b88fe1777c4c052f154e29f9897
CVE ID: CVE-2025-52474 State: PUBLISHED Published: 2025-06-19T03:40:47.301Z Last Updated: 2025-06-23T17:34:42.578Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. This issue has been patched in version 3.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rw
alyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rwvh-2gfh-wmcm - https://github.com/LabRedesCefetRJ/WeGIA/commit/b6fbb3e21b8d71e50afe0395dca44acdd1ca2e29
CVE ID: CVE-2025-52477 State: PUBLISHED Published: 2025-06-26T16:46:09.380Z Last Updated: 2025-06-27T13:16:43.418Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: octo-sts Products: app Problem Types: CWE-918 Description: Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging. Addi
on. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq - https://github.com/octo-sts/app/security/advisories/GHSA-h3qp-hwvr-9xcq - https://github.com/octo-sts/app/commit/0f177fde54f9318e33f0bba6abaea9463a7c3afd - https://github.com/octo-sts/app/commit/b3976e39bd8c8c217c0670747d34a4499043da92
CVE ID: CVE-2025-52478 State: PUBLISHED Published: 2025-08-19T16:32:34.949Z Last Updated: 2025-08-19T19:18:13.300Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: n8n-io Products: n8n Problem Types: CWE-79 Description: n8n is a workflow automation platform. From 1.77.0 to before 1.98.2, a stored Cross-Site Scripting (XSS) vulnerability was identified in n8n, specifically in the Form Trigger node's HTML form element. An authenticated attacker can inject malicious HTML via an <iframe> with a srcdoc payload that includes arbitrary JavaScript execution. The attacker can also inject malicious Javascript by using <video> coupled <source> using an onerror event. Whil
cution. The attacker can also inject malicious Javascript by using <video> coupled <source> using an onerror event. While using iframe or a combination of video and source tag, this vulnerability allows for Account Takeover (ATO) by exfiltrating n8n-browserId and session cookies from authenticated users who visit a maliciously crafted form. Using these tokens and cookies, an attacker can impersonate the victim and change account details such as email addresses, enabling full control over the account—especially if 2FA is not enabled. Users should upgrade to version >= 1.98.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/security/advisories/GHS
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/security/advisories/GHSA-hfmv-hhh3-43f2 - https://github.com/n8n-io/n8n/pull/16329 - https://github.com/n8n-io/n8n/commit/7940384a85041a1890b1203d69c092c887312500
CVE ID: CVE-2025-52479 State: PUBLISHED Published: 2025-06-25T16:06:45.402Z Last Updated: 2025-06-26T19:52:34.932Z Vendors: JuliaWeb Products: HTTP.jl Problem Types: CWE-93, CWE-113 Description: HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise escaped or protected, this can lead to a CRLF injection attack. Users of HTTP.jl should upgrade immediately to HTTP.jl v1.10.17, and users of URIs.jl should upgrade immediately to URIs.jl v1.6.0. The check fo
upgrade immediately to HTTP.jl v1.10.17, and users of URIs.jl should upgrade immediately to URIs.jl v1.6.0. The check for valid URIs is now in the URI.jl package, and the latest version of HTTP.jl incorporates that fix. As a workaround, manually validate any URIs before passing them on to functions in this package. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JuliaWeb/HTTP.jl/security/advisories/GHSA-4g68-4pxg-mw93 - https://github.com/JuliaWeb/URIs.jl/pull/66