Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-52968 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-23T16:18:03.769Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: freedesktop Products: xdg-utils Problem Types: CWE-420 Description: xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: thi
would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cgit.freedesktop.org/xdg/xdg-utils/tag/?h=v1.2.1 - https://www.openwall.com/lists/oss-security/2025/06/23/1
CVE ID: CVE-2025-52969 State: REJECTED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-07-03T15:20:56.984Z Description: No description available.
CVE ID: CVE-2025-52970 State: PUBLISHED Published: 2025-08-12T18:59:25.817Z Last Updated: 2025-08-18T12:44:51.339Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-233 Description: A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.
ce via a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-448
CVE ID: CVE-2025-52971 State: REJECTED Published: N/A Last Updated: 2025-06-24T02:55:09.021Z Description: No description available.
CVE ID: CVE-2025-52972 State: REJECTED Published: N/A Last Updated: 2025-06-24T02:55:08.563Z Description: No description available.
CVE ID: CVE-2025-52973 State: REJECTED Published: N/A Last Updated: 2025-06-24T02:55:08.076Z Description: No description available.
CVE ID: CVE-2025-52974 State: REJECTED Published: N/A Last Updated: 2025-06-24T02:55:07.581Z Description: No description available.
CVE ID: CVE-2025-52975 State: REJECTED Published: N/A Last Updated: 2025-06-24T02:55:07.104Z Description: No description available.
CVE ID: CVE-2025-52976 State: REJECTED Published: N/A Last Updated: 2025-06-24T02:55:06.646Z Description: No description available.
CVE ID: CVE-2025-52977 State: REJECTED Published: N/A Last Updated: 2025-06-24T02:55:06.194Z Description: No description available.
CVE ID: CVE-2025-52978 State: REJECTED Published: N/A Last Updated: 2025-06-24T02:55:05.722Z Description: No description available.
CVE ID: CVE-2025-52979 State: REJECTED Published: N/A Last Updated: 2025-06-24T02:55:05.084Z Description: No description available.
CVE ID: CVE-2025-52980 State: PUBLISHED Published: 2025-07-11T15:08:15.638Z Last Updated: 2025-07-15T19:55:48.095Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-198 Description: A Use of Incorrect Byte Ordering vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS on SRX300 Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a BGP update is received over an established BGP session which contains a specific, valid, optional, transitive path attribute, rpd will crash and restart. This issue affects eBGP and iBGP over IPv4 and IPv6. Thi
ptional, transitive path attribute, rpd will crash and restart. This issue affects eBGP and iBGP over IPv4 and IPv6. This issue affects: Junos OS: * 22.1 versions from 22.1R1 before 22.2R3-S4, * 22.3 versions before 22.3R3-S3, * 22.4 versions before 22.4R3-S2, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100084
CVE ID: CVE-2025-52981 State: PUBLISHED Published: 2025-07-11T15:08:33.384Z Last Updated: 2025-07-15T19:55:40.480Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-754 Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX1600, SRX2300, SRX 4000 Series, and SRX5000 Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If a sequence of specific PIM packets is received, this will cause a flowd crash and restart. This issue affects Junos OS: * all versions befor
ic PIM packets is received, this will cause a flowd crash and restart. This issue affects Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S11, * 22.2 versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2. This is a similar, but different vulnerability than the issue reported as CVE-2024-47503, published in JSA88133. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100087
CVE ID: CVE-2025-52982 State: PUBLISHED Published: 2025-07-11T15:08:53.931Z Last Updated: 2025-07-15T19:55:34.678Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-404 Description: An Improper Resource Shutdown or Release vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an MX Series device with an MS-MPC is configured with two or more service sets which are both processing SIP calls, a specific sequence of call events will lead to a crash and restart of the MS-MPC. This issue affect
ocessing SIP calls, a specific sequence of call events will lead to a crash and restart of the MS-MPC. This issue affects Junos OS: * all versions before 21.2R3-S9, * 21.4 versions from 21.4R1, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6. As the MS-MPC is EoL after Junos OS 22.4, later versions are not affected. This issue does not affect MX-SPC3 or SRX Series devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100088
CVE ID: CVE-2025-52983 State: PUBLISHED Published: 2025-07-11T15:09:18.207Z Last Updated: 2025-07-15T19:55:28.869Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-446 Description: A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device. On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users which are in possession of the corresponding private key can still log in as root. This issue affects Junos OS: * all versions before 22.2R3-S7,
f the corresponding private key can still log in as root. This issue affects Junos OS: * all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S3, * 24.2 versions before 24.2R1-S2, 24.2R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100089 - https://www.juniper.net/documentation/us/en/software/junos/junos-install-upgrade/topics/topic-map/vm-host-overview.html#id-routing-engines-with-vm-host-support
CVE ID: CVE-2025-52984 State: PUBLISHED Published: 2025-07-11T15:09:37.765Z Last Updated: 2025-07-15T19:55:22.722Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-476 Description: A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause impact to the availability of the device. When static route points to a reject next hop and a gNMI query is processed for that static route, rpd crashes and restarts. This issue affects: Junos OS: * all versions before 21.2R3-
s processed for that static route, rpd crashes and restarts. This issue affects: Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R1-S2, 24.2R2; Junos OS Evolved: * all versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S3-EVO, * 23.4-EVO versions before 23.4R2-S4-EVO, * 24.2-EVO versions before 24.2R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100090
CVE ID: CVE-2025-52985 State: PUBLISHED Published: 2025-07-11T15:09:58.361Z Last Updated: 2025-07-18T07:16:09.464Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Juniper Networks Products: Junos OS Evolved Problem Types: CWE-480 Description: A Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to bypass security restrictions. When a firewall filter which is applied to the lo0 or re:mgmt interface references a prefix list with 'from prefix-list', and that prefix list contains more than 10 entries, the prefix list doesn't match and packets destined to or
efix-list', and that prefix list contains more than 10 entries, the prefix list doesn't match and packets destined to or from the local device are not filtered. This issue affects firewall filters applied to the re:mgmt interfaces as input and output, but only affects firewall filters applied to the lo0 interface as output. This issue is applicable to IPv4 and IPv6 as a prefix list can contain IPv4 and IPv6 prefixes. This issue affects Junos OS Evolved: * 23.2R2-S3-EVO versions before 23.2R2-S4-EVO, * 23.4R2-S3-EVO versions before 23.4R2-S5-EVO, * 24.2R2-EVO versions before 24.2R2-S1-EVO, * 24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO. This issue doesn't affect Junos OS Evolved version
24.2R2-S1-EVO, * 24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO. This issue doesn't affect Junos OS Evolved versions before 23.2R1-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100091
CVE ID: CVE-2025-52986 State: PUBLISHED Published: 2025-07-11T15:10:20.934Z Last Updated: 2025-07-15T19:55:10.352Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-401 Description: A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device. When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been
one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart. The leak can be monitored with the CLI command: show task memory detail | match task_shard_mgmt_cookie where the allocated memory in bytes can be seen to continuously increase with each exploitation. This issue affects: Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S11, * 22.2 versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2, 24.4R2; Junos OS Evolved: * all versions be
23.4R2-S4, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2, 24.4R2; Junos OS Evolved: * all versions before 22.2R3-S7-EVO * 22.4-EVO versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S4-EVO, * 24.2-EVO versions before 24.2R2-EVO, * 24.4-EVO versions before 24.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100092
CVE ID: CVE-2025-52988 State: PUBLISHED Published: 2025-07-11T15:11:24.991Z Last Updated: 2025-07-12T03:55:14.636Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-78 Description: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a high privileged, local attacker to escalated their privileges to root. When a user provides specifically crafted arguments to the 'request system logout' command, these will be executed as root on the shell, which can completely comprom
uments to the 'request system logout' command, these will be executed as root on the shell, which can completely compromise the device. This issue affects: Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S8, * 22.2 versions before 22.2R3-S6, * 22.3 versions before 22.3R3-S3, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S1, * 23.4 versions before 23.4R1-S2, 23.4R2; Junos OS Evolved: * all versions before 22.4R3-S6-EVO, * 23.2-EVO versions before 23.2R2-S1-EVO, * 23.4-EVO versions before 23.4R1-S2-EVO, 23.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100095
CVE ID: CVE-2025-52989 State: PUBLISHED Published: 2025-07-11T15:10:47.204Z Last Updated: 2025-09-24T08:03:12.314Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-140 Description: An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to modify the system configuration. A user with limited configuration and commit permissions, using a specifically crafted annotate configuration command, can change any part of the device configuration. This issue affects: Junos OS: * al
fted annotate configuration command, can change any part of the device configuration. This issue affects: Junos OS: * all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R1-S2, 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S5-EVO, * 24.2-EVO versions before 24.2R2-S1-EVO * 24.4-EVO versions before 24.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100096
CVE ID: CVE-2025-52991 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-06-27T15:46:39.932Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: NixOS Products: Nix Problem Types: CWE-276 Description: The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b. Addition
e 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017 - https://lix.systems/blog/2025-06-24-lix-cves/ - https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/ - https://security.snyk.io/vuln/?search=CVE-2025-52991 - https://security-tracker.debian.org/tracker/CVE-2025-52991 - https://labs.snyk.io
CVE ID: CVE-2025-52992 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-06-27T15:18:30.716Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: NixOS Products: Nix Problem Types: CWE-732 Description: The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discourse.nixos.org/t/security-advisory-p
9d5b. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017 - https://lix.systems/blog/2025-06-24-lix-cves/ - https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/ - https://labs.snyk.io - https://security.snyk.io/vuln/?search=CVE-2025-52992 - https://security-tracker.debian.org/tracker/CVE-2025-52992
CVE ID: CVE-2025-52993 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-06-27T15:04:24.269Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: NixOS Products: Nix Problem Types: CWE-362 Description: A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discourse.nixos.org/t/security-advisory-privilege-escalations-
yst Notes: - CISA ADP Vulnrichment: References: - https://discourse.nixos.org/t/security-advisory-privilege-escalations-in-nix-lix-and-guix/66017 - https://lix.systems/blog/2025-06-24-lix-cves/ - https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerabilities-2025/ - https://labs.snyk.io - https://security.snyk.io/vuln/?search=CVE-2025-52993 - https://security-tracker.debian.org/tracker/CVE-2025-52993
CVE ID: CVE-2025-52994 State: PUBLISHED Published: 2025-07-11T00:00:00.000Z Last Updated: 2025-07-11T15:06:03.756Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: phpThumb project Products: phpThumb Problem Types: CWE-78 Description: gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JamesHeinrich/phpThumb/releases - https://safety-online.pl/cve-2025-52994/ - https://github.com/JamesHeinrich/phpThumb/commit/cdcbc206ae601b15fd17e7aadf59df51149a0e82
CVE ID: CVE-2025-52995 State: PUBLISHED Published: 2025-06-30T19:57:52.307Z Last Updated: 2025-06-30T20:25:51.255Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: filebrowser Products: filebrowser Problem Types: CWE-77 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact of this vulnerability depends on the commands configured, and the binaries installed on the server or in the contain
act of this vulnerability depends on the commands configured, and the binaries installed on the server or in the container image. Due to the missing separation of scopes on the OS-level, this could give an attacker access to all files managed the application, including the File Browser database. This issue has been patched in version 2.33.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-w7qc-6grj-w7r8 - https://github.com/filebrowser/filebrowser/commit/4d830f707fc4314741fd431e70c2ce50cd5a3108 - https://github.com/filebrowser/filebrowser/releases/tag/v2.33.10
CVE ID: CVE-2025-52996 State: PUBLISHED Published: 2025-06-30T19:58:33.484Z Last Updated: 2025-08-04T17:36:00.191Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: filebrowser Products: filebrowser Problem Types: CWE-305 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser h
ad link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3v48-283x-f2w4 - https://github.com/filebrowser/filebrowser/issues/5239 - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-02_Filebrowser_Password_Protection_Of_Links_Bypassable
CVE ID: CVE-2025-52997 State: PUBLISHED Published: 2025-06-30T20:05:36.730Z Last Updated: 2025-08-04T17:38:38.684Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: filebrowser Products: filebrowser Problem Types: CWE-307, CWE-521, CWE-1392 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2
ute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-cm2r-rg7r-p7gg - https://github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93c - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-01_Filebrowser_Insecure_Password_Handling