Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22137 State: PUBLISHED Published: 2025-01-08T16:08:21.751Z Last Updated: 2025-01-08T19:28:59.296Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: stonith404 Products: pingvin-share Problem Types: CWE-20, CWE-434 Description: Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an authenticated or unauthenticated (if anonymous shares are allowed) user to overwrite arbitrary files on the server, including sensitive system files, via HTTP POST requests. The issue has been patched in version 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/st
as been patched in version 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stonith404/pingvin-share/security/advisories/GHSA-rjwx-p44f-mcrv - https://github.com/stonith404/pingvin-share/commit/6cf5c66fe2eda1e0a525edf7440d047fe2f0e35b - https://github.com/stonith404/pingvin-share/commit/c52ec7192080c402bd804e69be93dd88cc7c5c70
CVE ID: CVE-2025-22138 State: PUBLISHED Published: 2025-01-13T20:34:29.354Z Last Updated: 2025-01-14T14:19:59.062Z Vendors: codidact Products: qpixel Problem Types: CWE-200 Description: @codidact/qpixel is a Q&A-based community knowledge-sharing software. In affected versions when a category is set to private or limited-visibility within QPixel's admin tools, suggested edits within this category can still be viewed by unprivileged or anonymous users via the suggested edit queue. This issue has not yet been patched and no workarounds are available. Users are advised to follow the development repo for updates. ### Patches Not yet patched. ### Workarounds None available. Private or limited-visi
w the development repo for updates. ### Patches Not yet patched. ### Workarounds None available. Private or limited-visibility categories should not be considered ways to store sensitive information. ### References Internal: [SUPPORT-114](https://codidact.atlassian.net/issues/SUPPORT-114) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/codidact/qpixel/security/advisories/GHSA-pv74-hcg9-65r4
CVE ID: CVE-2025-22139 State: PUBLISHED Published: 2025-01-08T18:26:04.346Z Last Updated: 2025-01-08T19:29:21.650Z Vendors: nilsonLazarin Products: WeGIA Problem Types: CWE-79 Description: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_geral.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-xrjq-57mq-4hf8
CVE ID: CVE-2025-22140 State: PUBLISHED Published: 2025-01-08T18:25:57.950Z Last Updated: 2025-01-08T19:32:00.409Z Vendors: nilsonLazarin Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /html/funcionario/dependente_listar_um.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nilsonLazarin/WeGIA/security/advisori
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-mrhp-wfp2-59h5
CVE ID: CVE-2025-22141 State: PUBLISHED Published: 2025-01-08T18:27:08.543Z Last Updated: 2025-01-08T19:27:47.059Z Vendors: nilsonLazarin Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificar_recursos_cargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-w7hp-2w2c
Notes: - CISA ADP Vulnrichment: References: - https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-w7hp-2w2c-p636
CVE ID: CVE-2025-22142 State: PUBLISHED Published: 2025-01-13T19:56:59.869Z Last Updated: 2025-01-13T20:07:05.344Z Vendors: NamelessMC Products: Nameless Problem Types: CWE-79 Description: NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In affected versions an admin can add the ability to have users fill out an additional field and users can inject javascript code into it that would be activated once a staffer visits the user's profile on staff panel. As a result an attacker can execute javascript code on the staffer's computer. This issue has been addressed in version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vul
ue has been addressed in version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NamelessMC/Nameless/security/advisories/GHSA-9q22-w64p-g8qm - https://github.com/NamelessMC/Nameless/releases/tag/v2.1.3
CVE ID: CVE-2025-22143 State: PUBLISHED Published: 2025-01-08T19:42:57.276Z Last Updated: 2025-01-08T21:02:19.356Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the listar_permissoes.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gxh2-8jxp-m59h
CVE ID: CVE-2025-22144 State: PUBLISHED Published: 2025-01-13T19:49:03.887Z Last Updated: 2025-01-13T20:21:06.877Z Vendors: NamelessMC Products: Nameless Problem Types: CWE-610 Description: NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by email the reset code is NULL, but when the account is manually validated by a user with admincp.core.emails or admincp.users.edit permissions then the reset_code will no longer be NULL but empty. An attacker can request http://localhost/nameless/index.p
missions then the reset_code will no longer be NULL but empty. An attacker can request http://localhost/nameless/index.php?route=/forgot_password/&c= and reset the password. As a result an attacker may compromise another users password and take over their account. This issue has been addressed in release version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NamelessMC/Nameless/security/advisories/GHSA-p883-7496-x35p - https://github.com/NamelessMC/Nameless/releases/tag/v2.1.3
CVE ID: CVE-2025-22145 State: PUBLISHED Published: 2025-01-08T20:40:37.545Z Last Updated: 2025-02-25T13:07:45.559Z Vendors: CarbonPHP Products: carbon Problem Types: CWE-98 Description: Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CarbonPHP/ca
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CarbonPHP/carbon/security/advisories/GHSA-j3f9-p6hm-5w6q - https://github.com/briannesbitt/Carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58
CVE ID: CVE-2025-22146 State: PUBLISHED Published: 2025-01-15T19:57:59.734Z Last Updated: 2025-01-15T20:44:47.931Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: getsentry Products: sentry Problem Types: CWE-287 Description: Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploi
Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. The Sentry SaaS fix was deployed on Jan 14, 2025. For self hosted users; if only a single organization is allowed `(SENTRY_SINGLE_ORGANIZATION = True)`, then no action is needed. Otherwise, users should upgrade to version 25.1.0 or higher. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getsentry/sentry/security/advisories/GHSA-7pq6-v88g-wf3w - https://github.com/getsentry/sentry/pull/83407
CVE ID: CVE-2025-22149 State: PUBLISHED Published: 2025-01-09T17:22:59.757Z Last Updated: 2025-05-23T19:56:35.937Z Vendors: MicahParks Products: jwkset Problem Types: CWE-672 Description: JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal from a JWK Set is equivalent to revocation. The affected auto-caching HTTP client was added in version v0.5.0 and fixed in v0.6.0. The
is equivalent to revocation. The affected auto-caching HTTP client was added in version v0.5.0 and fixed in v0.6.0. The only workaround would be to remove the provided auto-caching HTTP client and replace it with a custom implementation. This involves setting the HTTPClientStorageOptions.RefreshInterval to zero (or not specifying the value). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/MicahParks/jwkset/security/advisories/GHSA-675f-rq2r-jw82 - https://github.com/MicahParks/jwkset/issues/40 - https://github.com/MicahParks/jwkset/commit/01db49a90f7f20c7fb39a699a2f19a7a5f379ed3
CVE ID: CVE-2025-22150 State: PUBLISHED Published: 2025-01-21T17:46:58.872Z Last Updated: 2025-02-12T20:41:22.041Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: nodejs Products: undici Problem Types: CWE-330 Description: Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary val
m in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975 - https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0 - https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a - https://github.com/nodejs/
efdf07d0 - https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a - https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385 - https://hackerone.com/reports/2913312 - https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f - https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113
CVE ID: CVE-2025-22151 State: PUBLISHED Published: 2025-01-09T18:51:18.221Z Last Updated: 2025-01-09T20:09:27.557Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: strawberry-graphql Products: strawberry Problem Types: CWE-843 Description: Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node interface. When querying for a specific type using
es are mapped to the same underlying model while using the relay node interface. When querying for a specific type using the global node field (e.g., FruitType:some-id), the resolver may incorrectly return an instance of a different type mapped to the same model (e.g., SpecialFruitType). This can lead to information disclosure if the alternate type exposes sensitive fields and potential privilege escalation if the alternate type contains data intended for restricted access. This vulnerability is fixed in 0.257.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-5xh2-23cc-5jc6 - https://github.com/strawb
: - https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-5xh2-23cc-5jc6 - https://github.com/strawberry-graphql/strawberry/commit/526eb82b70451c0e59d5a71ae9b7396f59974bd8
CVE ID: CVE-2025-22152 State: PUBLISHED Published: 2025-01-10T15:23:16.919Z Last Updated: 2025-01-10T16:08:16.253Z Vendors: Atheos Products: Atheos Problem Types: CWE-22, CWE-94, CWE-434 Description: Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack vectors present in multiple PHP files. This vulnerability is fixed in v600. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Atheos/Atheos/security/advisories/GHSA-rgjm-6p
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Atheos/Atheos/security/advisories/GHSA-rgjm-6p59-537v
CVE ID: CVE-2025-22153 State: PUBLISHED Published: 2025-01-23T17:34:27.056Z Last Updated: 2025-02-12T20:41:29.946Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: zopefoundation Products: RestrictedPython Problem Types: CWE-843 Description: RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing
sion 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-gmj9-h825-chq2 - https://github.com/zopefoundation/RestrictedPython/commit/48a92c5bb617a647cffd0dadd4d5cfe626bcdb2f
CVE ID: CVE-2025-22157 State: PUBLISHED Published: 2025-05-20T18:00:01.328Z Last Updated: 2025-05-21T03:55:32.132Z Vendors: Atlassian Products: Jira Core Data Center, Jira Core Server, Jira Service Management Data Center, Jira Service Management Server Problem Types: PrivEsc (Privilege Escalation) Description: This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc (Privilege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged us
ege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged user. Atlassian recommends that Jira Core Data Center and Server and Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Jira Core Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.20 Jira Service Management Data Center and Server 5.12: Upgrade to a release greater than or equal to 5.12.20 Jira Core Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5 Jira Service Management Data Center 10.3: Upgrad
Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5 Jira Service Management Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5 Jira Core Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0 Jira Service Management Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0 Jira Core Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1 Jira Service Management Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1 See the release notes. You can download the latest version of Jira Core Data Center and Jira Service Management Data Center from the download center. This vulnerability was reported
Jira Core Data Center and Jira Service Management Data Center from the download center. This vulnerability was reported via our Atlassian (Internal) program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://confluence.atlassian.com/pages/viewpage.action?pageId=1561365992 - https://jira.atlassian.com/browse/JRASERVER-78766 - https://jira.atlassian.com/browse/JSDSERVER-16206
CVE ID: CVE-2025-22165 State: PUBLISHED Published: 2025-07-24T22:30:00.776Z Last Updated: 2025-07-29T03:55:16.721Z Vendors: Atlassian Products: Sourcetree for Mac Problem Types: Security Misconfiguration Description: This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you ar
d requires user interaction. Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://www.sourcetreeapp.com/download-archives . You can download the latest version of Sourcetree for Mac from the download center https://www.sourcetreeapp.com/download-archives . This vulnerability was found through the Atlassian Bug Bounty Program by Karol Mazurek (AFINE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/SRCTREE-8217
CVE ID: CVE-2025-22166 State: PUBLISHED Published: 2025-10-21T16:00:05.978Z Last Updated: 2025-10-21T16:21:27.828Z Vendors: Atlassian Products: Confluence Data Center Problem Types: DoS (Denial of Service) Description: This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your insta
commends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2 See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives
ion of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]). This vulnerability was reported via our Atlassian (Internal) program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034 - https://jira.atlassian.com/browse/CONFSERVER-100907
CVE ID: CVE-2025-22167 State: PUBLISHED Published: 2025-10-22T01:00:06.278Z Last Updated: 2025-10-23T03:55:20.670Z Vendors: Atlassian Products: Jira Software Data Center, Jira Software Server Problem Types: Path Traversal (Arbitrary Read/Write) Description: This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by the Jira JVM process. Atlassian recommends that Jira Software Data Center and Server customers upgrade to the latest versio
Jira JVM process. Atlassian recommends that Jira Software Data Center and Server customers upgrade to the latest version; if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Jira Software Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.28 Jira Software Data Center and Server 10.3: Upgrade to a release greater than or equal to 10.3.12 Jira Software Data Center and Server 11.0: Upgrade to a release greater than or equal to 11.1.0 See the release notes. You can download the latest version of Jira Software Data Center and Server from the download center. This vulnerability was reported via our Atlassian (Internal) p
Software Data Center and Server from the download center. This vulnerability was reported via our Atlassian (Internal) program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://confluence.atlassian.com/pages/viewpage.action?pageId=1652920034 - https://jira.atlassian.com/browse/JSWSERVER-26552
CVE ID: CVE-2025-22168 State: PUBLISHED Published: 2025-10-22T16:30:00.663Z Last Updated: 2025-10-24T14:45:20.537Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user's private checklist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8637