deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-52881
Published: 2025-02-07
Description: An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sensitive data such as passwords extracted from the topology file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321
References: https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-079.txt
CVE: CVE-2024-52882
Published: 2025-02-07
Description: An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code (XSS) to attack logged-in administrator sessions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-076.txt
CVE: CVE-2024-52883
Published: 2025-02-07
Description: An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to a path traversal vulnerability, sensitive data can be read without any authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.audiocodes.com/solutions-products/products/management-products-solutions/one-voice-operations-center; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-075.txt
CVE: CVE-2024-52884
Published: 2025-02-07
Description: An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an attacker with access to configuration exports (INI) is able to decrypt the passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://www.audiocodes.com/solutions-products/products/session-border-controllers-sbcs; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-078.txt
CVE: CVE-2024-55213
Published: 2025-02-07
Description: Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listing function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://dhtmlx.com/docs/products/demoApps/dhtmlxFileExplorerDemo/; https://packetstorm.news/files/id/189020
CVE: CVE-2024-55214
Published: 2025-02-07
Description: Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://dhtmlx.com; https://packetstorm.news/files/id/189018
CVE: CVE-2024-57248
Published: 2025-02-07
Description: Directory Traversal in File Upload in Gleamtech FileVista 9.2.0.0 allows remote attackers to achieve Code Execution, Information Disclosure, and Escalation of Privileges via injecting malicious payloads in HTTP requests to manipulate file paths, bypass access controls, and upload malicious files.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://packetstorm.news/files/id/189021; https://www.gleamtech.com/filevista
CVE: CVE-2024-57249
Published: 2025-02-07
Description: Incorrect Access Control in the Preview Function of Gleamtech FileVista 9.2.0.0 allows remote attackers to gain unauthorized access via exploiting a vulnerability in access control mechanisms by removing authentication-related HTTP headers, such as the Cookie header, in the request. This bypasses the authentication process and grants attackers access to sensitive image files without proper login credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://packetstorm.news/files/id/189019; https://www.gleamtech.com/filevista
CVE: CVE-2024-57707
Published: 2025-02-07
Description: An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/shigophilo/CVE/blob/main/DataEase-v1-code-execute.md
CVE: CVE-2024-7419
Published: 2025-02-07
Description: The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation and sanitization of user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary PHP code into form fields that get executed on the server during the export, potentially leading to a complete site compromise. 
As a prerequisite, the custom export field should include fields containing user-supplied data.
CVSS Score: 8.3 (HIGH)
CWE: CWE-94
References: https://www.wordfence.com/threat-intel/vulnerabilities/id/40b57370-4fd7-4316-9e99-a3f1d34616e8?source=cve; https://www.wpallimport.com/upgrade-to-wp-all-export-pro/
CVE: CVE-2024-9661
Published: 2025-02-07
Description: The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f8659a-fb3f-4df3-85a6-979751627a9c?source=cve; https://www.wpallimport.com
CVE: CVE-2024-9664
Published: 2025-02-07
Description: The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://www.wordfence.com/threat-intel/vulnerabilities/id/0099a8d7-827d-4215-9a2b-b3c268fb5e97?source=cve; https://www.wpallimport.com/
CVE: CVE-2022-26388
Published: 2025-02-07
Description: A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: 

Versions 2.6.0 and prior; ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:

Versions 2.3.1 and prior; ELI 250c/BUR 250c Resting Electrocardiograph:

Versions 2.1.2 and prior; ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: 

Versions 2.2.0 and prior.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-259
References: https://hillrom.com/en/responsible-disclosures/; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-22-167-01
CVE: CVE-2022-26389
Published: 2025-02-07
Description: An improper access control vulnerability may allow privilege escalation.This issue affects: 

  *  ELI 380 Resting Electrocardiograph:

Versions 2.6.0 and prior; 
  *  ELI 280/BUR280/MLBUR 280 Resting Electrocardiograph:

Versions 2.3.1 and prior; 
  *  ELI 250c/BUR 250c Resting Electrocardiograph: Versions 2.1.2 and prior; 
  *  ELI 150c/BUR 150c/MLBUR 150c Resting Electrocardiograph: 

Versions 2.2.0 and prior.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://hillrom.com/en/responsible-disclosures/; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-22-167-01
CVE: CVE-2024-7425
Published: 2025-02-07
Description: The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input validation and sanitization in all versions up to, and including, 1.9.1. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://www.wordfence.com/threat-intel/vulnerabilities/id/c9205896-487d-4b8f-84cf-7ba16e1205e3?source=cve; https://www.wpallimport.com/upgrade-to-wp-all-export-pro/
CVE: CVE-2025-1104
Published: 2025-02-07
Description: A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authentication bypass by spoofing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-290, CWE-290
References: https://github.com/kn1g78/cve/blob/main/dlink.md; https://vuldb.com/?ctiid.294934; https://vuldb.com/?id.294934
CVE: CVE-2025-0307
Published: 2025-02-07
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-1105
Published: 2025-02-07
Description: A vulnerability was found in SiberianCMS 4.20.6. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /app/sae/design/desktop/flat of the component HTTP GET Request Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.294938; https://vuldb.com/?id.294938; https://vuldb.com/?submit.491207
CVE: CVE-2025-1106
Published: 2025-02-07
Description: A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/database_admin.php. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/Sinon2003/cve/blob/main/CmsEasy/CmsEasyPathTraversal-2.md; https://vuldb.com/?ctiid.294939; https://vuldb.com/?id.294939
CVE: CVE-2021-27017
Published: 2025-02-07
Description: Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-502
References: https://www.puppet.com/security/cve/cve-2021-27017-deserialization-untrusted-data
CVE: CVE-2021-41527
Published: 2025-02-07
Description: An error related to the 2-factor authorization (2FA) on the RISC Platform prior to the saas-2021-12-29 release can potentially be exploited to bypass the 2FA. The vulnerability requires that the 2FA setup hasn’t been completed.
CWE: CWE-94
References: https://community.flexera.com/s/feed/0D5PL00000Nwgg30AB; https://medium.com/@amroot/cve-2021-41527-flexera-multi-factor-authentication-mfa-bypass-cb9effc3af98
CVE: CVE-2021-41528
Published: 2025-02-07
Description: An error when handling authorization related to the import / export interfaces on the RISC Platform prior to the saas-2021-12-29 release can potentially be exploited to access the import / export functionality with low privileges.
CWE: CWE-863
References: https://community.flexera.com/s/feed/0D5PL00000Nwgg30AB; https://medium.com/@amroot/cve-2021-41528-flexera-risc-networks-vulnerable-authorization-schema-3e980d59217a
CVE: CVE-2025-24980
Published: 2025-02-07
Description: pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://github.com/pimcore/admin-ui-classic-bundle/commit/96ae555578c3b4df368092d71e07a6c4ddf8fbe9; https://github.com/pimcore/admin-ui-classic-bundle/pull/808; https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-vr5f-php7-rg24
CVE: CVE-2025-25183
Published: 2025-02-07
Description: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, resulting in cache reuse, which can interfere with subsequent responses and cause unintended behavior. Prefix caching makes use of Python's built-in hash() function. As of Python 3.12, the behavior of hash(None) has changed to be a predictable constant value. This makes it more feasible that someone could try exploit hash collisions. The impact of a collision would be using cache that was generated using different content. Given knowledge of prompts in use and predictable hashing behavior, someone could intentionally populate the cache using a prompt known to collide with another prompt in use. This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.6 (LOW)
CWE: CWE-354
References: https://github.com/python/cpython/commit/432117cd1f59c76d97da2eaff55a7d758301dbc7; https://github.com/vllm-project/vllm/pull/12621; https://github.com/vllm-project/vllm/security/advisories/GHSA-rm76-4mrf-v9r8
CVE: CVE-2024-55215
Published: 2025-02-07
Description: An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://github.com/ainrm/Jrohy-trojan-unauth-poc/blob/main/README.en.md
CVE: CVE-2024-55272
Published: 2025-02-07
Description: An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/soursec/CVEs/tree/main/CVE-2024-55272
CVE: CVE-2024-57278
Published: 2025-02-07
Description: A reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan <=v1.8.0. The vulnerability is caused by improper input sanitization of the query parameter, allowing an attacker to inject malicious JavaScript payloads. When a victim accesses a crafted URL containing the malicious input, the script executes in the victim's browser context.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/78778443/QingScan/issues/41; https://github.com/78778443/QingScan/issues/41
CVE: CVE-2024-57279
Published: 2025-02-07
Description: A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the LDAP User Manager <= ce92321, specifically in the /setup/index.php endpoint via the returnto parameter. This vulnerability arises due to improper sanitization of user-supplied input, allowing an attacker to inject malicious JavaScript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wheelybird/ldap-user-manager/issues/232; https://github.com/wheelybird/ldap-user-manager/issues/232
CVE: CVE-2024-57357
Published: 2025-02-07
Description: An issue in TPLINK TL-WPA 8630 TL-WPA8630(US)_V2_2.0.4 Build 20230427 allows a remote attacker to execute arbitrary code via function sub_4256CC, which allows command injection by injecting 'devpwd'.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/c10uds/tplink-wpa8630-rce-vulnerability; https://github.com/c10uds/tplink-wpa8630-rce-vulnerability
CVE: CVE-2024-57606
Published: 2025-02-07
Description: SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive information via the getTotalData component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/jeecgboot/JeecgBoot/issues/7665
CVE: CVE-2025-1113
Published: 2025-02-07
Description: A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of the component Add Theme Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://gitee.com/taisan/tarzan-cms/issues/IBHZ0J; https://vuldb.com/?ctiid.295019; https://vuldb.com/?id.295019
CVE: CVE-2025-24366
Published: 2025-02-07
Description: SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. This issue was fixed in version v2.6.5 by checking the client provided arguments. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1; https://github.com/drakkan/sftpgo/security/advisories/GHSA-vj7w-3m8c-6vpx
CVE: CVE-2024-55630
Published: 2025-02-07
Description: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the `name` attribute to be specified. If `name` is set to the same value as an existing `document` property (e.g. `querySelector`), that property is replaced with the element. This vulnerability's only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://en.wikipedia.org/wiki/DOM_clobbering; https://github.com/laurent22/joplin/commit/e70efcbd60ce62f06e77c183b362c74e636c02d9; https://github.com/laurent22/joplin/security/advisories/GHSA-5cch-jr52-qffh
CVE: CVE-2025-1114
Published: 2025-02-07
Description: A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component Add Category Page. The manipulation of the argument categoryName leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/newbee-ltd/newbee-mall/issues/94; https://github.com/newbee-ltd/newbee-mall/issues/94#issue[PII_REDACTED]; https://vuldb.com/?ctiid.295020
CVE: CVE-2025-24028
Published: 2025-02-07
Description: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Text Editor and the Markdown viewer. However, unlike the Rich Text Editor, the Markdown viewer is `cross-origin isolated`, which prevents JavaScript from directly accessing functions/variables in the toplevel Joplin `window`. This issue is not present in Joplin 3.1.24 and may have been introduced in `9b50539`. This is an XSS vulnerability that impacts users that open untrusted notes in the Rich Text Editor. This vulnerability has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-79
References: https://github.com/laurent22/joplin/commit/2a058ed8097c2502e152b26394dc1917897f5817; https://github.com/laurent22/joplin/commit/9b505395918bc923f34fe6f3b960bb10e8cf234e; https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92
CVE: CVE-2025-25187
Published: 2025-02-07
Description: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's `dangerouslySetInnerHTML`, without first escaping HTML entities. Joplin lacks a Content-Security-Policy with a restrictive `script-src`. This allows arbitrary JavaScript execution via inline `onclick`/`onload` event handlers in unsanitized HTML. Additionally, Joplin's main window is created with `nodeIntegration` set to `true`, allowing arbitrary JavaScript execution to result in arbitrary code execution. Anyone who 1) receives notes from unknown sources and 2) uses <kbd>ctrl</kbd>-<kbd>p</kbd> to search is impacted. This issue has been addressed in version 3.1.24 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-79
References: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src; https://github.com/laurent22/joplin/blob/2fc9bd476b0d9abcddb0a46f615a48333779d225/packages/app-desktop/plugins/GotoAnything.tsx#L558; https://github.com/laurent22/joplin/commit/360ece6f8873ef81afbfb98b25faad696ffccdb6
CVE: CVE-2025-1096
Published: 2025-02-08
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-1115
Published: 2025-02-08
Description: A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_control/sys_device_find/sys_device_init/sys_device_open/sys_device_read/sys_device_register/sys_device_write/sys_event_delete/sys_event_recv/sys_event_send/sys_mb_delete/sys_mb_recv/sys_mb_send/sys_mb_send_wait/sys_mq_recv/sys_mq_send/sys_mq_urgent/sys_mutex_delete/sys_mutex_release/sys_mutex_take/sys_rt_timer_control/sys_rt_timer_delete/sys_rt_timer_start/sys_rt_timer_stop/sys_sem_delete/sys_sem_release/sys_sem_take/sys_shmat/sys_shmdt/sys_thread_create/sys_thread_delete/sys_thread_startup/sys_timer_delete/sys_timer_gettime/sys_timer_settime of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument arg[0] leads to information disclosure. An attack has to be approached locally.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-284
References: https://github.com/RT-Thread/rt-thread/issues/9877; https://vuldb.com/?ctiid.295021; https://vuldb.com/?id.295021
CVE: CVE-2025-1116
Published: 2025-02-08
Description: A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/live_search/module/live_search.searchresults. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://gist.github.com/mcdruid/d6a41cfebd9e10e63a8c698d3a8ad771; https://vuldb.com/?ctiid.295022; https://vuldb.com/?id.295022