Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-31477 State: PUBLISHED Published: 2025-04-02T21:10:14.264Z Last Updated: 2025-04-03T13:59:36.712Z Vendors: tauri-apps Products: plugins-workspace Problem Types: CWE-20 Description: The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of protocols like https or mailto by default. This default restriction was not functional due to improper validation of the allowed protocols, allowing for p
default. This default restriction was not functional due to improper validation of the allowed protocols, allowing for potentially dangerous protocols like file://, smb://, or nfs:// and others to be opened by the system registered protocol handler. By passing untrusted user input to the open endpoint these potentially dangerous protocols can be abused to gain remote code execution on the system. This either requires direct exposure of the endpoint to application users or code execution in the frontend of a Tauri application. This vulnerability is fixed in 2.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tauri-apps/plugins-workspace/security/advisori
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp - https://github.com/tauri-apps/plugins-workspace/commit/9cf0390a52497e273db1a1b613a0e26827aa327c
CVE ID: CVE-2025-31478 State: PUBLISHED Published: 2025-04-16T21:28:23.087Z Last Updated: 2025-04-17T13:18:13.288Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: zulip Products: zulip Problem Types: CWE-287 Description: Zulip is an open-source team collaboration tool. Zulip supports a configuration where account creation is limited solely by being able to authenticate with a single-sign on authentication backend, meaning the organization places no restrictions on email address domains or invitations being required to join, but has disabled the EmailAuthBackend that is used for email/password authentication. A bug in the Zulip server means that it is possible
he EmailAuthBackend that is used for email/password authentication. A bug in the Zulip server means that it is possible to create an account in such organizations, without having an account with the configured SSO authentication backend. This issue is patched in version 10.2. A workaround includes requiring invitations to join the organization prevents the vulnerability from being accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-qxfv-j6vg-5rqc
CVE ID: CVE-2025-31479 State: PUBLISHED Published: 2025-04-02T21:09:34.354Z Last Updated: 2025-04-03T14:01:08.763Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: canonical Products: get-workflow-version-action Problem Types: CWE-532 Description: canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the token may be truncated—ca
output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the token may be truncated—causing part of the GITHUB_TOKEN to be displayed in plaintext in the GitHub Actions logs. Anyone with read access to the GitHub repository can view GitHub Actions logs. For public repositories, anyone can view the GitHub Actions logs. The opportunity to exploit this vulnerability is limited—the GITHUB_TOKEN is automatically revoked when the job completes. However, there is an opportunity for an attack in the time between the GITHUB_TOKEN being displayed in the logs and the completion of the job. Users using the github-token input are impacted. This vulnerability is fixed in 1
he logs and the completion of the job. Users using the github-token input are impacted. This vulnerability is fixed in 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/get-workflow-version-action/security/advisories/GHSA-26wh-cc3r-w6pj - https://github.com/canonical/get-workflow-version-action/issues/2 - https://github.com/canonical/get-workflow-version-action/commit/88281a62e96e1c0ef4df30352ae0668a9f3e3369
CVE ID: CVE-2025-31480 State: PUBLISHED Published: 2025-04-04T14:49:30.863Z Last Updated: 2025-04-04T14:57:54.321Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: aiven Products: aiven-extras Problem Types: CWE-426 Description: aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and ensure they run the latest version issuing ALTER EXTENSION aiven_extras UPDATE TO '1.1.16' after installing it. This needs to happen in eac
latest version issuing ALTER EXTENSION aiven_extras UPDATE TO '1.1.16' after installing it. This needs to happen in each database aiven_extras has been installed in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aiven/aiven-extras/security/advisories/GHSA-33xh-jqgf-6627 - https://github.com/aiven/aiven-extras/commit/77b5f19a0c1d196bc741ff5c774f85fe7ca3063b
CVE ID: CVE-2025-31481 State: PUBLISHED Published: 2025-04-03T19:20:22.916Z Last Updated: 2025-04-08T13:14:36.379Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: api-platform Products: core Problem Types: CWE-863 Description: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/api-platform/core/security/advisories/GHSA-cg3c-245w-728m - https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958
e/security/advisories/GHSA-cg3c-245w-728m - https://github.com/api-platform/core/commit/55712452b4f630978537bdb2a07dc958202336bb - https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568 - https://github.com/api-platform/core/releases/tag/v3.4.17
CVE ID: CVE-2025-31482 State: PUBLISHED Published: 2025-06-04T19:50:58.615Z Last Updated: 2025-06-04T20:46:27.779Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-352 Description: FreshRSS is a self-hosted RSS feed aggregator. A vulnerability in versions prior to 1.26.2 causes a user to be repeatedly logged out after fetching a malicious feed entry, effectively causing that user to suffer denial of service. Version 1.26.2 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-vpmc-3fv2-jmgp
CVE ID: CVE-2025-31483 State: PUBLISHED Published: 2025-04-03T18:07:32.241Z Last Updated: 2025-04-03T18:49:45.617Z Vendors: miniflux Products: v2 Problem Types: CWE-79 Description: Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/miniflux/v2/security/ad
ed in 2.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/miniflux/v2/security/advisories/GHSA-cq88-842x-2jhp - https://github.com/miniflux/v2/commit/cb695e653a08af4cabcb277c271ce74bd0c746e6
CVE ID: CVE-2025-31484 State: PUBLISHED Published: 2025-04-02T21:38:03.493Z Last Updated: 2025-04-03T19:38:18.563Z Vendors: conda-forge Products: infrastructure Problem Types: CWE-284 Description: conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a package to the conda-forge channel, bypassing our feedstock-token + upload process. The security logs on anaconda.org were check for any packages that were not copied from the cf-staging to the conda-forge chann
urity logs on anaconda.org were check for any packages that were not copied from the cf-staging to the conda-forge channel and none were found. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/conda-forge/infrastructure/security/advisories/GHSA-m4h2-49xf-vq72 - https://github.com/conda-forge/infrastructure/commit/70f3f09e64968d5f0a7b0525846f17cad42dd052
CVE ID: CVE-2025-31485 State: PUBLISHED Published: 2025-04-03T19:31:46.021Z Last Updated: 2025-04-08T13:15:23.510Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: api-platform Products: core Problem Types: CWE-696 Description: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.
at is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3 - https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8 - https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a - https://github.com/api-platform/core/releases/tag/v3.4.17
CVE ID: CVE-2025-31486 State: PUBLISHED Published: 2025-04-03T18:24:39.616Z Last Updated: 2025-04-03T20:39:28.939Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: vitejs Products: vite Problem Types: CWE-200, CWE-284 Description: Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --
imit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x - https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647 - https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
CVE ID: CVE-2025-31487 State: PUBLISHED Published: 2025-04-03T18:38:27.067Z Last Updated: 2025-04-03T20:37:56.519Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: xwiki-contrib Products: jira Problem Types: CWE-611 Description: The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the
local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). The vulnerability has been patched in the JIRA Extension v8.6.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki-contrib/jira/security/advisories/GHSA-wc53-4255-gw3f - https://github.com/xwiki-contrib/jira/commit/5049e352d16f8356734de70daf1202301f170ee6 - https://github.com/xwiki-contrib/jira/commit/98a74c2a516b42689c73b13ecd94e9c1998fa9cb - https://jira.xwiki.org/browse/JIRA-49
CVE ID: CVE-2025-31488 State: PUBLISHED Published: 2025-04-06T19:56:24.648Z Last Updated: 2025-04-07T14:15:50.443Z Vendors: Hex-Dragon Products: PCL2 Problem Types: CWE-20 Description: Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If the user uses a malicious homepage, the attacker can use IE background to access the specified webpage without knowing it. This vulnerability is fixed in 2.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Hex-Dragon/PCL2/security/adviso
9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Hex-Dragon/PCL2/security/advisories/GHSA-wfpw-hfcp-9m73
CVE ID: CVE-2025-31489 State: PUBLISHED Published: 2025-04-03T19:36:09.335Z Last Updated: 2025-04-03T20:36:19.079Z Vendors: minio Products: minio Problem Types: CWE-347 Description: MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to
ccess-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh - https://github.com/minio/minio/pull/21103
CVE ID: CVE-2025-31490 State: PUBLISHED Published: 2025-04-14T23:07:25.840Z Last Updated: 2025-04-15T03:00:21.930Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Significant-Gravitas Products: AutoGPT Problem Types: CWE-918 Description: AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python's requests library, hardening the application against SSRF. The code for this wrapper can be found in autogpt_platform/backend/backend/util/request.py. The reque
tion against SSRF. The code for this wrapper can be found in autogpt_platform/backend/backend/util/request.py. The requested hostname of a URL which is being requested is validated, ensuring that it does not resolve to any local ipv4 or ipv6 addresses. However, this check is not sufficient, as a DNS server may initially respond with a non-blocked address, with a TTL of 0. This means that the initial resolution would appear as a non-blocked address. In this case, validate_url() will return the url as successful. After validate_url() has successfully returned the url, the url is then passed to the real request() function. When the real request() function is called with the validated url, reque
is then passed to the real request() function. When the real request() function is called with the validated url, request() will once again resolve the address of the hostname, because the record will not have been cached (due to TTL 0). This resolution may be in the "invalid range". This type of attack is called a "DNS Rebinding Attack". This vulnerability is fixed in 0.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-wvjg-9879-3m7w - https://github.com/Significant-Gravitas/AutoGPT/commit/66ebe4376eab3434af90808796b54c2139847b37
CVE ID: CVE-2025-31491 State: PUBLISHED Published: 2025-04-14T23:15:56.611Z Last Updated: 2025-04-15T02:58:57.322Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Significant-Gravitas Products: AutoGPT Problem Types: CWE-200 Description: AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows of leakage of cross-domain cookies and protected headers in requests redirect. AutoGPT uses a wrapper around the requests python library, located in autogpt_platform/backend/backend/util/request.py. In this wrapper, redirects are specifically NOT followe
ry, located in autogpt_platform/backend/backend/util/request.py. In this wrapper, redirects are specifically NOT followed for the first request. If the wrapper is used with allow_redirects set to True (which is the default), any redirect is not followed by the initial request, but rather re-requested by the wrapper using the new location. However, there is a fundamental flaw in manually re-requesting the new location: it does not account for security-sensitive headers which should not be sent cross-origin, such as the Authorization and Proxy-Authorization header, and cookies. For example in autogpt_platform/backend/backend/blocks/github/_api.py, an Authorization header is set when retrieving
s. For example in autogpt_platform/backend/backend/blocks/github/_api.py, an Authorization header is set when retrieving data from the GitHub API. However, if GitHub suffers from an open redirect vulnerability (such as the made-up example of https://api.github.com/repos/{owner}/{repo}/issues/comments/{comment_id}/../../../../../redirect/?url=https://joshua.hu/), and the script can be coerced into visiting it with the Authorization header, the GitHub credentials in the Authorization header will be leaked. This allows leaking auth headers and private cookies. This vulnerability is fixed in 0.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Significant-Gr
ty is fixed in 0.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-ggcm-93qg-gfhp
CVE ID: CVE-2025-31492 State: PUBLISHED Published: 2025-04-06T20:02:20.511Z Last Updated: 2025-04-17T11:02:37.315Z Vendors: OpenIDC Products: mod_auth_openidc Problem Types: CWE-200 Description: mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protect
there mustn't be any application-level gateway (or load balancer etc) protecting the server. When you request a protected resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-submitting form), and the protected resource (with no headers). This is an example of a request for a protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try to issue the protected resource. oidc_content_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_
ent_handler is called early, which has the opportunity to prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >= 2.4.16.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-59jp-rwph-878r - https://github.com/OpenIDC/mod_auth_openidc/commit/b59b8ad63411857090ba1088e23fe414c690c127
CVE ID: CVE-2025-31493 State: PUBLISHED Published: 2025-05-13T15:24:40.178Z Last Updated: 2025-05-13T19:08:37.490Z Vendors: getkirby Products: kirby Problem Types: CWE-22, CWE-23 Description: Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the `collection()` helper or `$kirby->collection()` method with a dynamic collection name (such as a collection name that depends on request or user data). Sites that only use fixed calls to the `collection()` helper/`$kirby->collection()` method (i.e. calls with a simple string for the collection name) are *not* affected. A missing path traversal check al
` method (i.e. calls with a simple string for the collection name) are *not* affected. A missing path traversal check allowed attackers to navigate and access all files on the server that were accessible to the PHP process, including files outside of the collections root or even outside of the Kirby installation. PHP code within such files was executed. Such attacks first require an attack vector in the site code that is caused by dynamic collection names, such as `collection('tags-' . get('tags'))`. It generally also requires knowledge of the site structure and the server's file system by the attacker, although it can be possible to find vulnerable setups through automated methods such as f
s file system by the attacker, although it can be possible to find vulnerable setups through automated methods such as fuzzing. In a vulnerable setup, this could cause damage to the confidentiality and integrity of the server. The problem has been patched in Kirby 3.9.8.3, Kirby 3.10.1.2, and Kirby 4.7.1. In all of the mentioned releases, the maintainers of Kirby have added a check for the collection path that ensures that the resulting path is contained within the configured collections root. Collection paths that point outside of the collections root will not be loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getkirby/kirby/security/advisories/GH
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getkirby/kirby/security/advisories/GHSA-x275-h9j4-7p4h - https://github.com/getkirby/kirby/releases/tag/3.10.1.2 - https://github.com/getkirby/kirby/releases/tag/3.9.8.3 - https://github.com/getkirby/kirby/releases/tag/4.7.1