Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-58081 State: PUBLISHED Published: 2025-08-28T08:28:38.426Z Last Updated: 2025-08-28T13:43:05.729Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: DOS Co., Ltd. Products: SS1 Problem Types: CWE-259 Description: Use of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to view arbitrary files with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dos-osaka.co.jp/news/2025/08/250827.html - https://jvn.jp/en/jp/JVN99577552/
CVE ID: CVE-2025-58083 State: PUBLISHED Published: 2025-11-14T23:24:54.274Z Last Updated: 2025-11-17T14:35:13.251Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: General Industrial Controls Products: Lynx+ Gateway Problem Types: CWE-306 Description: General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-08 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-08.json
CVE ID: CVE-2025-58084 State: PUBLISHED Published: 2025-10-13T19:57:23.997Z Last Updated: 2025-10-14T14:28:52.930Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-1287 Description: Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-58096 State: PUBLISHED Published: 2025-10-15T13:55:52.333Z Last Updated: 2025-10-16T03:56:29.900Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-787 Description: When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156691
CVE ID: CVE-2025-58097 State: PUBLISHED Published: 2025-11-21T06:17:50.799Z Last Updated: 2025-11-21T14:58:20.681Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: LogStare Inc. Products: LogStare Collector (for Windows), LogStare Collector (for Linux) Problem Types: CWE-276 Description: The installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate files within the installation directory and execute arbitrary code with the administrative privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.logstare.com/vulnerability/2025-001/ - https://jvn.jp/en/jp/
t Notes: - CISA ADP Vulnrichment: References: - https://www.logstare.com/vulnerability/2025-001/ - https://jvn.jp/en/jp/JVN77560819/
CVE ID: CVE-2025-58114 State: PUBLISHED Published: 2025-09-19T13:10:38.231Z Last Updated: 2025-09-19T13:55:52.996Z Vendors: Hallo Welt! GmbH Products: BlueSpice Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects BlueSpice: from 5 through 5.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05
CVE ID: CVE-2025-58115 State: PUBLISHED Published: 2025-10-16T08:55:14.283Z Last Updated: 2025-10-16T15:35:37.661Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: NEOJAPAN Inc. Products: ChatLuck Problem Types: CWE-79 Description: ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.chatluck.com/support/package/mainte/pchatluck-%e8%a3%bd%e5%93%81%e3%81%ab%e3%81%8a%e3%81%91%e3%82%8b%e3%80%81%e8%a4%87%e6%95%b0%e3%81%ae%e3%82%bb%e3%82%ad%e3%83%a5%e3%83
%a3%bd%e5%93%81%e3%81%ab%e3%81%8a%e3%81%91%e3%82%8b%e3%80%81%e8%a4%87%e6%95%b0%e3%81%ae%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3%e4%b8%8a%e3%81%ae%e5%95%8f%e9%a1%8c%e3%81%ab/ - https://jvn.jp/en/jp/JVN13030751/
CVE ID: CVE-2025-58116 State: PUBLISHED Published: 2025-09-17T03:08:40.791Z Last Updated: 2025-09-17T13:34:00.567Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: I-O DATA DEVICE, INC. Products: WN-7D36QR, WN-7D36QR/UE Problem Types: CWE-78 Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iodata.jp/support/information/2025/09_wn-7d36qr/index.htm - https://jvn.jp/en/vu/JVNVU9749
nt: References: - https://www.iodata.jp/support/information/2025/09_wn-7d36qr/index.htm - https://jvn.jp/en/vu/JVNVU97490987/
CVE ID: CVE-2025-58120 State: PUBLISHED Published: 2025-10-15T13:55:51.117Z Last Updated: 2025-10-17T03:55:14.603Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Next SPK, BIG-IP Next CNF, BIG-IP Next for Kubernetes Problem Types: CWE-476 Description: When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156623
CVE ID: CVE-2025-58121 State: PUBLISHED Published: 2025-11-18T15:11:35.167Z Last Updated: 2025-11-18T21:34:05.614Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-280 Description: Insufficient permission validation on multiple REST API endpoints in Checkmk 2.2.0, 2.3.0, and 2.4.0 before version 2.4.0p16 allows low-privileged users to perform unauthorized actions or obtain sensitive information Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/18983
CVE ID: CVE-2025-58122 State: PUBLISHED Published: 2025-11-18T15:11:17.244Z Last Updated: 2025-11-18T21:33:35.695Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-280 Description: Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify notification parameters via the REST API, which could lead to unauthorized actions or information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/18982
CVE ID: CVE-2025-58123 State: PUBLISHED Published: 2025-08-28T12:59:25.737Z Last Updated: 2025-08-28T13:20:27.456Z Problem Types: CWE-295 Description: Improper Certificate Validation in Checkmk Exchange plugin BGP Monitoring allows attackers in MitM position to intercept traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://exchange.checkmk.com/p/bgp-mon
CVE ID: CVE-2025-58124 State: PUBLISHED Published: 2025-08-28T12:59:28.526Z Last Updated: 2025-10-07T09:33:24.363Z Problem Types: CWE-295 Description: Improper Certificate Validation in Checkmk Exchange plugin check-mk-api allows attackers in MitM position to intercept traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://exchange.checkmk.com/p/check-mk-api
CVE ID: CVE-2025-58125 State: PUBLISHED Published: 2025-08-28T12:59:31.212Z Last Updated: 2025-08-28T13:17:25.986Z Problem Types: CWE-295 Description: Improper Certificate Validation in Checkmk Exchange plugin Freebox v6 agent allows attackers in MitM position to intercept traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://exchange.checkmk.com/p/freebox-v6
CVE ID: CVE-2025-58126 State: PUBLISHED Published: 2025-08-28T12:59:33.842Z Last Updated: 2025-08-28T13:14:16.922Z Problem Types: CWE-295 Description: Improper Certificate Validation in Checkmk Exchange plugin VMware vSAN allows attackers in MitM position to intercept traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://exchange.checkmk.com/p/vsan
CVE ID: CVE-2025-58127 State: PUBLISHED Published: 2025-08-28T12:59:36.596Z Last Updated: 2025-08-28T13:12:57.409Z Problem Types: CWE-295 Description: Improper Certificate Validation in Checkmk Exchange plugin Dell Powerscale allows attackers in MitM position to intercept traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://exchange.checkmk.com/p/powerscale
CVE ID: CVE-2025-58131 State: PUBLISHED Published: 2025-09-09T21:48:51.081Z Last Updated: 2025-09-10T19:31:32.177Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon Problem Types: CWE-367 Description: Race condition in the Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon before version 6.4.10 (or before 6.2.15 and 6.3.12 in their respective tracks) may allow an authenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/sec
n via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/ZSB-25037
CVE ID: CVE-2025-58132 State: PUBLISHED Published: 2025-10-15T16:10:20.442Z Last Updated: 2025-10-22T03:55:12.755Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: Zoom Communications Inc. Products: Zoom Clients for Windows Problem Types: CWE-77 Description: Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25038
CVE ID: CVE-2025-58133 State: PUBLISHED Published: 2025-10-15T16:13:28.273Z Last Updated: 2025-11-13T14:01:37.953Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Zoom Communications Inc. Products: Zoom Rooms Problem Types: CWE-288 Description: Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25039
CVE ID: CVE-2025-58134 State: PUBLISHED Published: 2025-09-09T21:44:01.928Z Last Updated: 2025-09-10T20:24:12.585Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Clients for Windows Problem Types: CWE-863 Description: Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impact to integrity via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/ZSB-25035
CVE ID: CVE-2025-58135 State: PUBLISHED Published: 2025-09-09T21:45:52.362Z Last Updated: 2025-09-10T19:33:42.439Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Clients for Windows Problem Types: CWE-837 Description: Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/ZSB-25036
CVE ID: CVE-2025-58142 State: PUBLISHED Published: 2025-09-11T14:05:29.649Z Last Updated: 2025-11-04T21:13:23.610Z Vendors: Xen Products: Xen Description: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can
CVE ID: CVE-2025-58143 State: PUBLISHED Published: 2025-09-11T14:05:29.729Z Last Updated: 2025-11-04T21:13:24.914Z Vendors: Xen Products: Xen Description: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can
CVE ID: CVE-2025-58144 State: PUBLISHED Published: 2025-09-11T14:05:36.284Z Last Updated: 2025-11-04T21:13:26.232Z Vendors: Xen Products: Xen Description: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144. And then the P2M lock isn't held until a page reference was actually obtained (or the attempt to do so has failed). Otherwise the page can not only change type, but even ow
nce was actually obtained (or the attempt to do so has failed). Otherwise the page can not only change type, but even ownership in between, thus allowing domain boundaries to be violated. This is CVE-2025-58145. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-473.html
CVE ID: CVE-2025-58145 State: PUBLISHED Published: 2025-09-11T14:05:36.380Z Last Updated: 2025-11-04T21:13:27.555Z Vendors: Xen Products: Xen Description: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144. And then the P2M lock isn't held until a page reference was actually obtained (or the attempt to do so has failed). Otherwise the page can not only change type, but even ow
CVE ID: CVE-2025-58147 State: PUBLISHED Published: 2025-10-31T11:50:28.282Z Last Updated: 2025-11-04T21:13:28.853Z Vendors: Xen Products: Xen Description: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any
e vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-475.html
CVE ID: CVE-2025-58148 State: PUBLISHED Published: 2025-10-31T11:50:28.407Z Last Updated: 2025-11-04T21:13:30.190Z Vendors: Xen Products: Xen Description: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any
CVE ID: CVE-2025-58149 State: PUBLISHED Published: 2025-10-31T11:50:39.536Z Last Updated: 2025-11-04T21:13:31.524Z Vendors: Xen Products: Xen Description: When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allows the domain itself to map the memory in the page-tables. For HVM it would require a compromised device model or stubdomain to map the leaked memory into the HVM domain p2m. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
map the leaked memory into the HVM domain p2m. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-476.html
CVE ID: CVE-2025-58152 State: PUBLISHED Published: 2025-10-31T05:55:02.996Z Last Updated: 2025-10-31T17:07:56.496Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Century Systems Co., Ltd. Products: FutureNet MA-X series, FutureNet MA-E300 series, FutureNet MA-S series, FutureNet MA-P series, FutureNet IP-K series Problem Types: CWE-552 Description: FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cen
can be accessed without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.centurysys.co.jp/backnumber/common/jvnvu98191201.html - https://jvn.jp/en/vu/JVNVU98191201/
CVE ID: CVE-2025-58153 State: PUBLISHED Published: 2025-10-15T13:55:44.577Z Last Updated: 2025-10-16T03:56:45.230Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-703 Description: Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experience a lockup of the HSB. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000151658
CVE ID: CVE-2025-58156 State: PUBLISHED Published: 2025-08-29T21:40:16.813Z Last Updated: 2025-09-02T19:22:22.110Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nofusscomputing Products: centurion_erp Problem Types: CWE-285 Description: Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details within the database. This includes the actual token, although only the hashed token. This does not include any un-hashed authentication token as viewable. This issue has been patched in version 1.21.0. A workaround for this is not deemed viable as it wou
n token as viewable. This issue has been patched in version 1.21.0. A workaround for this is not deemed viable as it would involve disabling token authentication. Users are encouraged to remove any authentication token that was created by one of the effected versions of Centurion ERP. Webmasters can ensure this occurs by removing all authentication tokens from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-x75j-cm35-5qcg - https://github.com/nofusscomputing/centurion_erp/pull/974 - https://github.com/nofusscomputing/centurion_erp/commit/332eb1075ad828e5c4c24caeaf5605259eb7ce34
CVE ID: CVE-2025-58157 State: PUBLISHED Published: 2025-08-29T21:21:35.677Z Last Updated: 2025-09-02T14:09:48.386Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Consensys Products: gnark Problem Types: CWE-400 Description: gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Consensys/gnark/security/advisories
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Consensys/gnark/security/advisories/GHSA-9fvj-xqr2-xwg8 - https://github.com/Consensys/gnark/issues/1483 - https://github.com/Consensys/gnark-crypto/commit/56600883e0e9f9b159e9c7000b94e76185ec3d0d - https://github.com/Consensys/gnark/commit/68be6cede36e387ab760725beabd3c96cc94e6dc
CVE ID: CVE-2025-58158 State: PUBLISHED Published: 2025-08-29T17:44:31.852Z Last Updated: 2025-08-29T18:08:04.400Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: harness Products: harness Problem Types: CWE-22, CWE-73 Description: Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries. Prior to version 3.3.0, Open Source Harness git LFS server (Gitness) exposes api to retrieve and upload files via git LFS. Implementation of upload git LFS file api is vulnerable to arbitrary file write. Due to improper sanitization for upload path, a malicious authenticated
file api is vulnerable to arbitrary file write. Due to improper sanitization for upload path, a malicious authenticated user who has access to Harness Gitness server api can use a crafted upload request to write arbitrary file to any location on file system, may even compromise the server. Users using git LFS are vulnerable. This issue has been patched in version 3.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/harness/harness/security/advisories/GHSA-w469-hj2f-jpr5 - https://github.com/harness/harness/commit/21c5ce42ae13740b1cad47706c2ec85e72cc8c20
CVE ID: CVE-2025-58159 State: PUBLISHED Published: 2025-08-29T22:15:12.472Z Last Updated: 2025-09-02T19:24:25.237Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-434, CWE-94 Description: WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. The application allows an attacker to upload files with arbitrary filenames, including those with a .php extension. Because the uploaded file is written directly to disk without adequate sanitization or extension restrictions, a spreadsheet file