Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1364 State: PUBLISHED Published: 2025-02-16T23:00:14.667Z Last Updated: 2025-02-18T16:07:31.878Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MicroWord Products: eScan Antivirus Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this vulnerability is the function passPrompt of the component USB Protection Service. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclo
cal host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295969 - https://vuldb.com/?ctiid.295969 - https://vuldb.com/?submit.496481 - https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md
CVE ID: CVE-2025-1365 State: PUBLISHED Published: 2025-02-16T23:31:08.316Z Last Updated: 2025-02-18T16:06:41.984Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: GNU Products: elfutils Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recomm
sed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295977 - https://vuldb.com/?ctiid.295977 - https://vuldb.com/?submit.496483 - https://sourceware.org/bugzilla/show_bug.cgi?id=32654 - https://sourceware.org/bugzilla/attachment.cgi?id=15925 - https://sourceware.org/bugzilla/show_bug.cgi?id=32654#c2 - https://www.gnu.org/
CVE ID: CVE-2025-1366 State: PUBLISHED Published: 2025-02-17T00:00:16.054Z Last Updated: 2025-02-18T15:58:00.838Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MicroWord Products: eScan Antivirus Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function strcpy of the component VirusPopUp. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addi
to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295970 - https://vuldb.com/?ctiid.295970 - https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md
CVE ID: CVE-2025-1367 State: PUBLISHED Published: 2025-02-17T00:31:03.915Z Last Updated: 2025-02-18T19:33:23.455Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MicroWord Products: eScan Antivirus Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintf of the component USB Password Handler. The manipulation leads to buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
is disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295971 - https://vuldb.com/?ctiid.295971 - https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md
CVE ID: CVE-2025-1368 State: PUBLISHED Published: 2025-02-17T01:00:11.214Z Last Updated: 2025-02-18T19:33:13.700Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: MicroWord Products: eScan Antivirus Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects the function ReadConfiguration of the file /opt/MicroWorld/etc/mwav.conf. The manipulation of the argument BasePath leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about
approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295972 - https://vuldb.com/?ctiid.295972 - https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md
CVE ID: CVE-2025-1369 State: PUBLISHED Published: 2025-02-17T01:31:04.446Z Last Updated: 2025-02-18T19:33:05.664Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MicroWord Products: eScan Antivirus Problem Types: CWE-78, CWE-77 Description: A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of the component USB Password Handler. The manipulation leads to os command injection. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be
attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295975 - https://vuldb.com/?ctiid.295975 - https://vuldb.com/?submit.496482 - https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md
CVE ID: CVE-2025-1370 State: PUBLISHED Published: 2025-02-17T02:00:14.070Z Last Updated: 2025-02-18T19:32:57.120Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MicroWorld Products: eScan Antivirus Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux. Affected by this issue is the function sprintf of the file epsdaemon of the component Autoscan USB. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did
exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295976 - https://vuldb.com/?ctiid.295976 - https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md
CVE ID: CVE-2025-1371 State: PUBLISHED Published: 2025-02-17T02:31:07.921Z Last Updated: 2025-02-18T19:32:38.490Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GNU Products: elfutils Problem Types: CWE-476, CWE-404 Description: A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply
public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295978 - https://vuldb.com/?ctiid.295978 - https://vuldb.com/?submit.496484 - https://sourceware.org/bugzilla/show_bug.cgi?id=32655 - https://sourceware.org/bugzilla/attachment.cgi?id=15926 - https://sourceware.org/bugzilla/show_bug.cgi?id=32655#c2 - https://www.gnu.org/
CVE ID: CVE-2025-1372 State: PUBLISHED Published: 2025-02-17T03:00:36.624Z Last Updated: 2025-02-18T15:55:33.549Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: GNU Products: elfutils Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd7
cally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295981 - https://vuldb.com/?ctiid.295981 - https://vuldb.com/?submit.496485 - https://sourceware.org/bugzilla/show_bug.cgi?id=32656 - https://sourceware.org/bugzilla/show_bug.cgi?id=32657 - https://sourceware.org/bugzilla/attachment.cgi?id=15927 - https://sourceware.org/bugzilla/show_bug.cgi?id=32656#c3 - https://www.gnu.org/
CVE ID: CVE-2025-1373 State: PUBLISHED Published: 2025-02-17T03:31:05.119Z Last Updated: 2025-02-18T15:53:38.652Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: FFmpeg Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in FFmpeg up to 7.1. It has been rated as problematic. Affected by this issue is the function mov_read_trak of the file libavformat/mov.c of the component MOV Parser. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The patch is identified as 43be8d07281caca2e88bfd8ee2333633e1fb1a13. It is recommend
osed to the public and may be used. The patch is identified as 43be8d07281caca2e88bfd8ee2333633e1fb1a13. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295982 - https://vuldb.com/?ctiid.295982 - https://vuldb.com/?submit.496930 - https://trac.ffmpeg.org/ticket/11460 - https://trac.ffmpeg.org/attachment/ticket/11460/poc - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/43be8d07281caca2e88bfd8ee2333633e1fb1a13 - https://ffmpeg.org/
CVE ID: CVE-2025-1374 State: PUBLISHED Published: 2025-02-17T04:00:12.123Z Last Updated: 2025-02-18T15:33:06.633Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /search.php. The manipulation of the argument StateName/CityName/AreaName/CatId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment
emotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295983 - https://vuldb.com/?ctiid.295983 - https://vuldb.com/?submit.499767 - https://github.com/1337g/realestatepropertymanagement_poc/blob/main/sql-gu2.pdf - https://code-projects.org/
CVE ID: CVE-2025-1376 State: PUBLISHED Published: 2025-02-17T04:31:08.264Z Last Updated: 2025-02-18T15:31:33.633Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GNU Products: elfutils Problem Types: CWE-404 Description: A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of
igh. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295984 - https://vuldb.com/?ctiid.295984 - https://vuldb.com/?submit.497538 - https://sourceware.org/bugzilla/show_bug.cgi?id=32672 - https://sourceware.org/bugzilla/attachment.cgi?id=15940 - https://sourceware.org/bugzilla/show_bug.cgi?id=32672#c3 - https://www.gnu.org/
CVE ID: CVE-2025-1377 State: PUBLISHED Published: 2025-02-17T05:00:19.288Z Last Updated: 2025-02-18T15:30:48.628Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GNU Products: elfutils Problem Types: CWE-404 Description: A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to
be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295985 - https://vuldb.com/?ctiid.295985 - https://vuldb.com/?submit.497539 - https://sourceware.org/bugzilla/show_bug.cgi?id=32673 - https://sourceware.org/bugzilla/attachment.cgi?id=15941 - https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2 - https://www.gnu.org/
CVE ID: CVE-2025-1378 State: PUBLISHED Published: 2025-02-17T06:00:09.606Z Last Updated: 2025-02-18T15:48:01.535Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: radare2 Problem Types: CWE-119 Description: A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of the component rasm2. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0.0 is able to address this issue. The patch is identified as c6c772d2eab692ce7ada5a4227afd50c355ad54
ading to version 6.0.0 is able to address this issue. The patch is identified as c6c772d2eab692ce7ada5a4227afd50c355ad545. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295986 - https://vuldb.com/?ctiid.295986 - https://vuldb.com/?submit.498499 - https://github.com/radareorg/radare2/issues/23953 - https://github.com/radareorg/radare2/issues/23953#issue-2844325926 - https://github.com/radareorg/radare2/commit/c6c772d2eab692ce7ada5a4227afd50c355ad545 - https://github.com/radareorg/radare2/milestone/86
CVE ID: CVE-2025-1379 State: PUBLISHED Published: 2025-02-17T06:31:04.246Z Last Updated: 2025-02-18T19:32:17.122Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /Admin/CustomerReport.php. The manipulation of the argument city leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
unched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295987 - https://vuldb.com/?ctiid.295987 - https://vuldb.com/?submit.501070 - https://github.com/1337g/realestatepropertymanagement_poc/blob/main/gu3.pdf - https://code-projects.org/
CVE ID: CVE-2025-1380 State: PUBLISHED Published: 2025-02-17T07:00:15.364Z Last Updated: 2025-02-18T19:32:08.675Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /dashboard/admin/del_plan.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.29598
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295988 - https://vuldb.com/?ctiid.295988 - https://vuldb.com/?submit.501980 - https://www.yuque.com/polaris-pisym/aevk1q/fdkeqw2a2ug9zohn
CVE ID: CVE-2025-1381 State: PUBLISHED Published: 2025-02-17T08:00:11.845Z Last Updated: 2025-02-18T19:31:59.918Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ajax_city.php. The manipulation of the argument CityName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295989 - https://vuldb.com/?ctiid.295989 - https://vuldb.com/?submit.502070 - https://github.com/Lonpeak/cve/blob/main/upload-1.md - https://code-projects.org/
CVE ID: CVE-2025-1382 State: PUBLISHED Published: 2025-03-09T06:00:05.522Z Last Updated: 2025-03-10T14:10:06.800Z Vendors: Unknown Products: Contact Us By Lord Linus Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a3002265-ac83-4c00-8afb-cbfbb4afc1e9/
CVE ID: CVE-2025-1383 State: PUBLISHED Published: 2025-03-06T11:11:01.134Z Last Updated: 2025-03-06T16:19:43.974Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: eteubert Products: Podlove Podcast Publisher Problem Types: CWE-352 Description: The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to missing or incorrect nonce validation on the ajax_transcript_delete() function. This makes it possible for unauthenticated attackers to delete arbitrary episode transcripts via a forged request granted they can trick a site administrator into performing an action such
rary episode transcripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/00a95ae7-3c58-4e5e-aaef-c04d1dacf27f?source=cve - https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.2.0/lib/modules/transcripts/transcripts.php#L223 - https://wordpress.org/plugins/podlove-podcasting-plugin-for-wordpress/#developers - https://plugins.trac.wordpress.org/changeset/3246867/
CVE ID: CVE-2025-1384 State: PUBLISHED Published: 2025-07-13T23:42:09.953Z Last Updated: 2025-07-14T14:15:23.939Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: OMRON Corporation Products: Machine Automation Controller NJ-series, Machine Automation Controller NX-series, Sysmac Studio Software Problem Types: CWE-272 Description: Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the controller products. Additional Analyst Notes
rform unauthorized access and to execute unauthorized code remotely to the controller products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-004_en.pdf - https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-004_ja.pdf
CVE ID: CVE-2025-1385 State: PUBLISHED Published: 2025-03-20T07:13:34.577Z Last Updated: 2025-03-20T15:10:30.494Z Vendors: ClickHouse Products: ClickHouse OSS Problem Types: CWE-20 Description: When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if
cker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge> Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5phv-x8x4-83x5
CVE ID: CVE-2025-1386 State: PUBLISHED Published: 2025-04-11T04:27:35.846Z Last Updated: 2025-04-11T16:01:28.660Z Vendors: ch-go Products: ch-go Problem Types: Query smuggling Description: When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ClickHouse/ch-go/security/advisories/GHSA-m454-3xv7-qj85