Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
y PHP files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a963cd9b-9f8f-4bd2-92cd-74c5e85e1d96?source=cve - https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMorePages.php#L82 - https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMorePages.php#L59 - https://plugins.trac.wordpress.org/browser/expand-maker/trunk/classes/ReadMoreInit.php#L122
CVE ID: CVE-2025-0811 State: PUBLISHED Published: 2025-03-27T12:31:07.487Z Last Updated: 2025-03-27T13:08:11.807Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/515566 - https://hackerone.com/reports/2961854
CVE ID: CVE-2025-0813 State: PUBLISHED Published: 2025-03-12T15:30:03.262Z Last Updated: 2025-03-12T15:58:00.171Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Power Automation System User Interface (EPAS-UI) - Secured Versions Problem Types: CWE-287 Description: CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to reboot the workstation and interrupt the normal boot process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneide
rupt the normal boot process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-070-02.pdf
CVE ID: CVE-2025-0814 State: PUBLISHED Published: 2025-02-13T06:41:11.968Z Last Updated: 2025-02-13T14:54:10.159Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Schneider Electric Products: Enerlin’X IFE interface (LV434001), Enerlin’X eIFE (LV851001) Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product when malicious IEC61850-MMS packets are sent to the device. The core functionality of the breaker remains intact during the attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/file
he attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-042-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-04.pdf
CVE ID: CVE-2025-0815 State: PUBLISHED Published: 2025-02-13T06:39:22.828Z Last Updated: 2025-02-13T14:55:27.364Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Enerlin’X IFE interface (LV434001), Enerlin’X eIFE (LV851001) Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sent to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-042-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-04.pdf
CVE ID: CVE-2025-0816 State: PUBLISHED Published: 2025-02-13T06:38:12.426Z Last Updated: 2025-02-13T14:26:44.542Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Enerlin’X IFE interface (LV434001), Enerlin’X eIFE (LV851001) Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-042-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-04.pdf
CVE ID: CVE-2025-0817 State: PUBLISHED Published: 2025-02-18T11:10:19.710Z Last Updated: 2025-02-18T14:20:37.194Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: FormCraft Products: FormCraft Problem Types: CWE-79 Description: The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfen
never a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae0710a-8c9b-41b0-860f-ae79b7ed1ee4?source=cve - https://codecanyon.net/item/formcraft-premium-wordpress-form-builder/5335056 - https://formcraft-wp.com/changelog/
CVE ID: CVE-2025-0818 State: PUBLISHED Published: 2025-08-13T03:42:04.514Z Last Updated: 2025-08-13T14:01:52.795Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: ninjateam, saadiqbal, mndpsingh287 Products: File Manager Pro – Filester, Advanced File Manager – Ultimate WP File Manager And Document Library Solution, File Manager Problem Types: CWE-22 Description: Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instan
delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a166de-3bdf-4883-91ba-655f2757c53b?source=cve - https://github.com/Studio-42/elFinder - https://plugins.trac.wordpress.org/browser/wp-file-manager/trunk/lib/php/elFinder.class.php - https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/library/php/elFinder.class.php#L5411 - https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/lib/php/elFinder.class.php#L
php#L5411 - https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/lib/php/elFinder.class.php#L5378 - https://github.com/Studio-42/elFinder/blob/master/php/elFinder.class.php#L5367 - https://plugins.trac.wordpress.org/changeset/3319016/filester - https://plugins.trac.wordpress.org/changeset/3335715/file-manager-advanced/trunk/application/library/php/elFinder.class.php
CVE ID: CVE-2025-0819 State: PUBLISHED Published: 2025-06-02T11:05:13.573Z Last Updated: 2025-06-02T14:03:05.184Z Vendors: Arm Ltd Products: Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r44p0 throu
frost GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.arm.com/documentation/110466/latest/
CVE ID: CVE-2025-0820 State: PUBLISHED Published: 2025-03-01T04:21:47.812Z Last Updated: 2025-03-03T17:39:07.564Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: clicface Products: Clicface Trombi Problem Types: CWE-79 Description: The Clicface Trombi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nom’ parameter in all versions up to, and including, 2.08 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes:
t arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d9ff834-8a11-4ec7-9371-15d56bc84106?source=cve - https://plugins.trac.wordpress.org/browser/clicface-trombi/trunk/clicface-trombi.php#L80 - https://wordpress.org/plugins/clicface-trombi/#developers
CVE ID: CVE-2025-0821 State: PUBLISHED Published: 2025-02-14T11:10:58.171Z Last Updated: 2025-02-14T16:36:10.755Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: bitpressadmin Products: Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist Problem Types: CWE-89 Description: Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wit
er and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b64fc9d8-ea02-49e7-add1-8d83f0f41431?source=cve - https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTTP/Controllers/WidgetChannelController.php#L89 - https://wordpress.org/plugins/bit-assist/#developers - https://plugins.trac.wordpress.org/changeset/3239816/#f
php#L89 - https://wordpress.org/plugins/bit-assist/#developers - https://plugins.trac.wordpress.org/changeset/3239816/#file5
CVE ID: CVE-2025-0822 State: PUBLISHED Published: 2025-02-15T12:43:02.986Z Last Updated: 2025-02-18T19:35:54.973Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: bitpressadmin Products: Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist Problem Types: CWE-23 Description: Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive informati
ber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de9b0eba-5d2b-427c-a199-88bf96c26f5e?source=cve - https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTTP/Controllers/DownloadController.php#L65 - https://wordpress.org/plugins/bit-assist/#developers - https://plugins.trac.wordpress.org/changeset/3239816/#file3
CVE ID: CVE-2025-0823 State: PUBLISHED Published: 2025-02-28T02:31:01.843Z Last Updated: 2025-02-28T16:24:22.680Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-22 Description: IBM Cognos Analytics 11.2.0 through 11.2.4 FP5 and 12.0.0 through 12.0.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183676
CVE ID: CVE-2025-0825 State: PUBLISHED Published: 2025-02-04T14:11:51.741Z Last Updated: 2025-05-23T12:50:55.298Z Problem Types: CWE-113 Description: cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289 - https://advisory.checkmarx.net/advisory/CVE-2025-0825/
CVE ID: CVE-2025-0826 State: PUBLISHED Published: 2025-03-17T13:49:44.172Z Last Updated: 2025-03-17T14:03:04.895Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2025-0827 State: PUBLISHED Published: 2025-03-17T13:49:56.352Z Last Updated: 2025-03-17T14:11:39.199Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: 3DSwymer Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2025-0828 State: PUBLISHED Published: 2025-03-17T13:50:07.283Z Last Updated: 2025-03-17T14:10:38.497Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Product Engineering Specialist Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2025-0829 State: PUBLISHED Published: 2025-03-17T13:50:18.950Z Last Updated: 2025-03-17T14:09:28.808Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2025-0830 State: PUBLISHED Published: 2025-03-17T13:50:29.066Z Last Updated: 2025-03-17T14:08:08.917Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Change Manager Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting Meeting Management in ENOVIA Change Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2025-0831 State: PUBLISHED Published: 2025-07-15T15:00:10.987Z Last Updated: 2025-07-15T20:45:04.768Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Dassault Systèmes Products: SOLIDWORKS eDrawings Problem Types: CWE-125 Description: Out-Of-Bounds Read vulnerability exists in the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted JT file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/trust-center/security/security-advisories/cve-2025-0831
CVE ID: CVE-2025-0832 State: PUBLISHED Published: 2025-03-17T13:50:41.077Z Last Updated: 2025-03-17T14:07:24.875Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2025-0833 State: PUBLISHED Published: 2025-03-17T13:50:50.134Z Last Updated: 2025-03-17T14:06:42.816Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2025-0834 State: PUBLISHED Published: 2025-01-30T09:02:48.133Z Last Updated: 2025-01-30T15:05:40.124Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Wondershare Products: Dr.Fone Problem Types: CWE-269 Description: Privilege escalation vulnerability has been found in Wondershare Dr.Fone version 13.5.21. This vulnerability could allow an attacker to escalate privileges by replacing the binary ‘C:\ProgramData\Wondershare\wsServices\ElevationService.exe’ with a malicious binary. This binary will be executed by SYSTEM automatically. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/wond
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/wondershare-drfone-privilege-scalation-vulnerability
CVE ID: CVE-2025-0835 State: PUBLISHED Published: 2025-03-24T11:42:21.834Z Last Updated: 2025-03-24T13:34:32.571Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-416 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-0837 State: PUBLISHED Published: 2025-02-13T04:21:46.181Z Last Updated: 2025-02-25T19:19:55.986Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ThemeREX Products: Puzzles | WP Magazine / Review with Store WordPress Theme + RTL Problem Types: CWE-79 Description: The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a
kers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/669e3015-b64c-440d-bc06-db4828c07196?source=cve - https://themeforest.net/item/puzzles-wordpress-magazinereview-with-wooc/5690583
CVE ID: CVE-2025-0838 State: PUBLISHED Published: 2025-02-21T14:20:52.767Z Last Updated: 2025-04-05T16:02:54.716Z Vendors: abseil Products: abseil-cpp Problem Types: CWE-190 Description: There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading
bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/abseil/abseil-cpp/commit/5a0e2cb5e3958dd90bb8569a2766622cb74d90c1
CVE ID: CVE-2025-0839 State: PUBLISHED Published: 2025-04-05T05:32:13.249Z Last Updated: 2025-04-07T14:11:50.831Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ZoomIt Products: ZoomSounds - WordPress Wave Audio Player with Playlist Problem Types: CWE-79 Description: The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user acc
h contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49b76f5f-03f7-48bc-b848-9ab55d875639?source=cve - https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433
CVE ID: CVE-2025-0840 State: PUBLISHED Published: 2025-01-29T20:00:11.944Z Last Updated: 2025-02-12T19:51:13.375Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: GNU Products: Binutils Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to ver