deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4119
Published: 2025-04-30
Description: A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Product Statistics Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-284, CWE-639
References: https://vuldb.com/?ctiid.306604; https://vuldb.com/?id.306604; https://vuldb.com/?submit.560778
CVE: CVE-2025-4120
Published: 2025-04-30
Description: A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been classified as critical. Affected is the function sub_4238E8. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Buffer_overflow-sub_4238E8-log_type/README.md; https://vuldb.com/?ctiid.306600; https://vuldb.com/?id.306600
CVE: CVE-2025-4121
Published: 2025-04-30
Description: A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The manipulation of the argument host leads to command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Command_injection-cmd_wireless-port_phy_set/README.md; https://vuldb.com/?ctiid.306601; https://vuldb.com/?id.306601
CVE: CVE-2025-27134
Published: 2025-04-30
Description: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/:id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/laurent22/joplin/commit/12baa9827dac9da903f244c9f358e3deb264e228; https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x; https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x
CVE: CVE-2025-27409
Published: 2025-04-30
Description: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with `css/pluginAssets` or `js/pluginAssets`. The `findLocalFile` function in the `default route` calls `localFileFromUrl` to check for special `pluginAssets` paths. If the function returns a path, the result is returned directly, without checking for path traversal. The vulnerability allows attackers to read files outside the intended directories. This issue has been patched in version 3.3.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/laurent22/joplin/pull/11916; https://github.com/laurent22/joplin/security/advisories/GHSA-5xv6-7jm3-fmg5; https://github.com/laurent22/joplin/security/advisories/GHSA-5xv6-7jm3-fmg5
CVE: CVE-2025-32376
Published: 2025-04-30
Description: Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/discourse/discourse/commit/21a7f3162221c393f9bb13721451aa7f237d881a; https://github.com/discourse/discourse/security/advisories/GHSA-mqqq-h2x3-46fr
CVE: CVE-2025-32970
Published: 2025-04-30
Description: XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pjhg-9wr9-rj96; https://jira.xwiki.org/browse/XWIKI-22487
CVE: CVE-2025-32971
Published: 2025-04-30
Description: XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the Solr script service doesn't take dropped programming rights into account. The Solr script service that is accessible in XWiki's scripting API normally requires programming rights to be called. Due to using the wrong API for checking rights, it doesn't take the fact into account that programming rights might have been dropped by calling `$xcontext.dropPermissions()`. If some code relies on this for the safety of executing Velocity code with the wrong author context, this could allow a user with script rights to either cause a high load by indexing documents or to temporarily remove documents from the search index. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0-rc-1.
CVSS Score: 3.8 (LOW)
CWE: CWE-863
References: https://github.com/xwiki/xwiki-platform/commit/6570f40f976aec82baf388b5239d1412cab238c9; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-987p-r3jc-8c8v; https://jira.xwiki.org/browse/XWIKI-22474
CVE: CVE-2025-32972
Published: 2025-04-30
Description: XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.
CVSS Score: 2.7 (LOW)
CWE: CWE-285
References: https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rp38-24m3-rx87; https://jira.xwiki.org/browse/XWIKI-22462
CVE: CVE-2025-32973
Published: 2025-04-30
Description: XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without programming rights and contains an XWiki.ComponentClass, there is no warning that this will grant programming rights to this object. An attacker who created such a malicious object could use this to gain programming rights on the wiki. For this, the attacker needs to have edit rights on at least one page to place this object and then get an admin user to edit that document. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-862
References: https://github.com/xwiki/xwiki-platform/commit/1a6f1b2e050770331c9a63d12a3fd8a36d199f62; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x7wv-5qg4-vmr6; https://jira.xwiki.org/browse/XWIKI-22460
CVE: CVE-2025-32974
Published: 2025-04-30
Description: XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15.9 when there is content on the page like a script macro that would gain more rights due to the editing. This analysis doesn't consider certain kinds of properties, allowing a user to put malicious scripts in there that will be executed after a user with script, admin, or programming rights edited the page. Such a malicious script could impact the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in versions 15.10.8 and 16.2.0.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-116, CWE-269, CWE-116
References: https://github.com/xwiki/xwiki-platform/commit/153dbfa2ef1a7a0a644fe3f889684c6a8738c5fc; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvgm-3rw2-7j4r; https://jira.xwiki.org/browse/XWIKI-22002
CVE: CVE-2025-46342
Published: 2025-04-30
Description: Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-1287
References: https://github.com/kyverno/kyverno/commit/3ff923b7756e1681daf73849954bd[PII_REDACTED]4; https://github.com/kyverno/kyverno/security/advisories/GHSA-jrr2-x33p-6hvc
CVE: CVE-2025-4122
Published: 2025-04-30
Description: A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been rated as critical. Affected by this issue is the function sub_435E04. The manipulation of the argument host leads to command injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Command_injection-sub_435E04-auth_mac/README.md; https://vuldb.com/?ctiid.306602; https://vuldb.com/?id.306602
CVE: CVE-2025-3599
Published: 2025-04-30
Description: Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which may allow an attacker to delete resources that are normally protected from an application or user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-367
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25659
CVE: CVE-2025-3859
Published: 2025-04-30
Description: Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage. This vulnerability was fixed in Focus 138.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1951533; https://www.mozilla.org/security/advisories/mfsa2025-33/
CVE: CVE-2025-21416
Published: 2025-04-30
Description: Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network.
CVSS Score: 8.5 (HIGH)
CWE: CWE-862
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21416
CVE: CVE-2025-24091
Published: 2025-04-30
Description: An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.3. An app may be able to cause a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-290
References: https://support.apple.com/en-us/121838; https://support.apple.com/en-us/122066
CVE: CVE-2025-2156
Published: 2025-04-30
Description: Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
CVE: CVE-2025-30389
Published: 2025-04-30
Description: Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 8.7 (HIGH)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30389
CVE: CVE-2025-30390
Published: 2025-04-30
Description: Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30390
CVE: CVE-2025-30391
Published: 2025-04-30
Description: Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30391
CVE: CVE-2025-30392
Published: 2025-04-30
Description: Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30392
CVE: CVE-2025-33074
Published: 2025-04-30
Description: Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33074
CVE: CVE-2025-39413
Published: 2025-04-30
Description: Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through <= 3.6.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/simple-sitemap/vulnerability/wordpress-simple-sitemap-create-a-responsive-html-sitemap-plugin-3-5-14-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-3269
Published: 2025-04-30
Description: Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
CVE: CVE-2025-44192
Published: 2025-04-30
Description: SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_clearance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/red-team00/bug_report/blob/main/simple-barangay-management-system/SQLi-1.md; https://github.com/red-team00/bug_report/blob/main/simple-barangay-management-system/SQLi-1.md
CVE: CVE-2025-44193
Published: 2025-04-30
Description: SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_complaint.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://github.com/red-team00/bug_report/blob/main/simple-barangay-management-system/SQLi-2.md
CVE: CVE-2025-44194
Published: 2025-04-30
Description: SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_household.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/red-team00/bug_report/blob/main/simple-barangay-management-system/SQLi-3.md
CVE: CVE-2025-46619
Published: 2025-04-30
Description: A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow.
CVSS Score: 7.6 (HIGH)
CWE: CWE-284
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2025-4135
Published: 2025-04-30
Description: A vulnerability was found in Netgear WG302v2 up to 5.2.9 and classified as critical. Affected by this issue is the function ui_get_input_value. The manipulation of the argument host leads to command injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_WG302v2/Command_injection-basic_settings_handler-static-ip-update/README.md; https://vuldb.com/?ctiid.306626; https://vuldb.com/?id.306626
CVE: CVE-2024-47784
Published: 2025-04-30
Description: Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI
This issue affects ANC software version 1.1.4 and earlier.
CVSS Score: 2.6 (LOW)
CWE: CWE-620
References: https://search.abb.com/library/Download.aspx?DocumentID=2CRT000006&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE: CVE-2024-9876
Published: 2025-04-30
Description: : Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4.
CVSS Score: 7.3 (HIGH)
CWE: CWE-471
References: https://search.abb.com/library/Download.aspx?DocumentID=2CRT000006&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE: CVE-2024-9877
Published: 2025-04-30
Description: : Use of GET Request Method With Sensitive Query Strings vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-598
References: https://search.abb.com/library/Download.aspx?DocumentID=2CRT000006&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE: CVE-2025-24887
Published: 2025-04-30
Description: OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the `external` flag on/off and change the own token value for a user. It is also possible to edit attributes that are not in the allow list, such as `otp_qr` and `otp_activated`. If external users exist in the OpenCTI setup and the information about these users identities is sensitive, the above vulnerabilities can be used to enumerate existing user accounts as a standard low privileged user. This issue has been patched in version 6.4.10.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-657
References: https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-8262-pw2q-5qc3
CVE: CVE-2025-2170
Published: 2025-04-30
Description: A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potentially enable a remote unauthenticated attacker to cause the appliance to make requests to an unintended location.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0008; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0008
CVE: CVE-2025-32777
Published: 2025-04-30
Description: Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the scheduler. This is a privilege escalation, because Volcano users may run their Elastic service and extender plugins in separate pods or nodes from the scheduler. In the Kubernetes security model, node isolation is a security boundary, and as such an attacker is able to cross that boundary in Volcano's case if they have compromised either the vulnerable services or the pod/node in which they are deployed. The scheduler will become unavailable to other users and workloads in the cluster. The scheduler will either crash with an unrecoverable OOM panic or freeze while consuming excessive amounts of memory. This issue has been patched in versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2.
CWE: CWE-770
References: https://github.com/volcano-sh/volcano/releases/tag/v1.10.2; https://github.com/volcano-sh/volcano/releases/tag/v1.11.0-network-topology-preview.3; https://github.com/volcano-sh/volcano/releases/tag/v1.11.2
CVE: CVE-2025-46331
Published: 2025-04-30
Description: OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been patched in version 1.8.11.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/openfga/openfga/commit/244302e7a8b979d66cc1874a3899cdff7d47862f; https://github.com/openfga/openfga/security/advisories/GHSA-w222-m46c-mgh6
CVE: CVE-2025-46554
Published: 2025-04-30
Description: XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608; https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e[PII_REDACTED]e9342; https://github.com/xwiki/xwiki-platform/commit/c02ce7843a39851865b9d7b6132e32fdd21e3856
CVE: CVE-2025-46557
Published: 2025-04-30
Description: XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1, a user who can access pages located in the XWiki space (by default, anyone) can access the page XWiki.Authentication.Administration and (unless an authenticator is set in xwiki.cfg) switch to another installed authenticator. Note that, by default, there is only one authenticator available (Standard XWiki Authenticator). So, if no authenticator extension was installed, it's not really possible to do anything for an attacker. Also, in most cases, if an SSO authenticator is installed and utilized (like OIDC or LDAP for example), the worst an attacker can do is break authentication by switching back to the standard authenticator (that's because it's impossible to login to a user which does not have a stored password, and that's usually what SSO authenticator produce). This issue has been patched in versions 15.10.14, 16.4.6, and 16.10.0-rc-1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/xwiki/xwiki-platform/commit/5efc31cea1501c9a5cb593566fea8b558ff32a2a; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f9c6-2f9p-82jj; https://jira.xwiki.org/browse/XWIKI-22604