deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-54687
Published: 2025-01-10
Description: Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://andrea0.medium.com; https://andrea0.medium.com/analysis-of-cve-2024-54687-9d82f4c0eaa8
CVE: CVE-2024-57222
Published: 2025-01-10
Description: Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_5_apcli_cancel_wps/README.md
CVE: CVE-2024-57223
Published: 2025-01-10
Description: Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_6_apcli_wps_gen_pincode/README.md
CVE: CVE-2024-57224
Published: 2025-01-10
Description: Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_3_apcli_do_enr_pin_wps/README.md
CVE: CVE-2024-57225
Published: 2025-01-10
Description: Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_7_reset_wifi/README.md
CVE: CVE-2024-57226
Published: 2025-01-10
Description: Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_2_vif_enable/README.md; https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_2_vif_enable/README.md
CVE: CVE-2024-57227
Published: 2025-01-10
Description: Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_4_apcli_do_enr_pbc_wps/README.md; https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_4_apcli_do_enr_pbc_wps/README.md
CVE: CVE-2024-57228
Published: 2025-01-10
Description: Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_1_vif_disable/README.md; https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_1_vif_disable/README.md
CVE: CVE-2024-6662
Published: 2025-01-10
Description: Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0" lacks protection mechanisms.
A user could be tricked into visiting a malicious website, which would send POST request to this endpoint. If the victim is a logged in administrator, this could lead to creation of new accounts and granting of administrative permissions.
CWE: CWE-352
References: https://cert.pl/en/posts/2024/09/CVE-2024-6662; https://megabip.pl/; https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
CVE: CVE-2024-6880
Published: 2025-01-10
Description: During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as one of the protection mechanisms. 
Publicly available source code of "/registered.php" discloses that path, allowing an attacker to attempt further attacks.  

This issue affects MegaBIP software versions below 5.15
CWE: CWE-538
References: https://cert.pl/en/posts/2024/09/CVE-2024-6680; https://megabip.pl/; https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
CVE: CVE-2025-23078
Published: 2025-01-10
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Breadcrumbs2 extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.5, from 1.42.X before 1.42.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I7878f8f7bc067080f80427b90f8d85337f172711; https://phabricator.wikimedia.org/T382043
CVE: CVE-2024-54910
Published: 2025-01-10
Description: Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-732
References: https://github.com/KrakenEU/CVE-2024-54910; https://www.easyuefi.com/backup-software/backup-suite-free.html; https://github.com/KrakenEU/CVE-2024-54910
CVE: CVE-2025-23079
Published: 2025-01-10
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - ArticleFeedbackv5 extension: from 1.42.X before 1.42.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I6ee51c8b518bda41739fd666fa2891cc12e79ac3; https://phabricator.wikimedia.org/T381753
CVE: CVE-2024-12847
Published: 2025-01-10
Description: NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-306, CWE-306
References: https://seclists.org/bugtraq/2013/Jun/8; https://vulncheck.com/advisories/netgear-dgn; https://www.exploit-db.com/exploits/25978
CVE: CVE-2024-33297
Published: 2025-01-10
Description: Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Name) field in the Add new campaign function
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/MathSabo/CVE-2024-33297; https://github.com/MathSabo/CVE-2024-33297
CVE: CVE-2024-33298
Published: 2025-01-10
Description: Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=admin__backup
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MathSabo/CVE-2024-33298
CVE: CVE-2024-33299
Published: 2025-01-10
Description: Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/MathSabo/CVE-2024-33299; https://github.com/MathSabo/CVE-2024-33299
CVE: CVE-2024-6437
Published: 2025-01-10
Description: On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.
CVSS Score: 5.8 (MEDIUM)
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20689-security-advisory-0108
CVE: CVE-2024-54994
Published: 2025-01-10
Description: MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationship feature.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://monicahq.com; https://github.com/p314dO/CVEs/tree/main/CVE-2024-54994; https://github.com/p314dO/CVEs/tree/main/CVE-2024-54994
CVE: CVE-2024-54996
Published: 2025-01-10
Description: MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-94
References: http://monicahq.com; https://github.com/p314dO/CVEs/tree/main/CVE-2024-54996
CVE: CVE-2024-54997
Published: 2025-01-10
Description: MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: http://monicahq.com; https://github.com/p314dO/CVEs/tree/main/CVE-2024-54997
CVE: CVE-2024-54998
Published: 2025-01-10
Description: MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://monicahq.com; https://github.com/p314dO/CVEs/tree/main/CVE-2024-54998; https://github.com/p314dO/CVEs/tree/main/CVE-2024-54998
CVE: CVE-2024-5872
Published: 2025-01-10
Description: On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.
CVSS Score: 6.5 (MEDIUM)
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20649-security-advisory-0106
CVE: CVE-2024-7095
Published: 2025-01-10
Description: On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being terminated (causing SNMP requests to time out until snmpd is restarted) and memory pressure for other processes on the switch. Increased memory pressure can cause processes other than snmpd to be at risk for unexpected termination as well.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-401
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20650-security-advisory-0107
CVE: CVE-2024-47517
Published: 2025-01-10
Description: Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1230
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE: CVE-2024-47518
Published: 2025-01-10
Description: Specially constructed queries targeting ETM could discover active remote access sessions
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-552
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE: CVE-2024-47519
Published: 2025-01-10
Description: Backup uploads to ETM subject to man-in-the-middle interception
CVSS Score: 8.3 (HIGH)
CWE: CWE-322
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE: CVE-2024-47520
Published: 2025-01-10
Description: A user with advanced report application access rights can perform actions for which they are not authorized
CVSS Score: 7.6 (HIGH)
CWE: CWE-653
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE: CVE-2024-7142
Published: 2025-01-10
Description: On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption might not be successfully performed. This results in the disks remaining unsecured and data on them
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-311
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20405-security-advisory-0104
CVE: CVE-2024-9131
Published: 2025-01-10
Description: A user with administrator privileges can perform command injection
CVSS Score: 7.2 (HIGH)
CWE: CWE-88
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE: CVE-2024-9132
Published: 2025-01-10
Description: The administrator is able to configure an insecure captive portal script
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE: CVE-2024-9133
Published: 2025-01-10
Description: A user with administrator privileges is able to retrieve authentication tokens
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-287
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE: CVE-2024-9134
Published: 2025-01-10
Description: Multiple SQL Injection vulnerabilities exist in the reporting application.  A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE: CVE-2024-9188
Published: 2025-01-10
Description: Specially constructed queries cause cross platform scripting leaking administrator tokens
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE: CVE-2025-23110
Published: 2025-01-10
Description: An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject field exists while performing an upload of a CSV file containing a list of alert configurations. An attacker can send the victim a CSV file containing the XSS payload in the email-subject. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim clicks on the email-subject value, it triggers the XSS payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_VVVVVV/README.md
CVE: CVE-2025-23111
Published: 2025-01-10
Description: An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website. Thus, this allows malicious actions to be executed without user consent.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_YYYY/README.md
CVE: CVE-2025-23112
Published: 2025-01-10
Description: An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious scripts into the Survey field name of Survey. When a user receive the survey, if he clicks on the field name, it triggers the XSS payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_ZZZZ/README.md
CVE: CVE-2025-23113
Published: 2025-01-10
Description: An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim click on the alert-title value, it can trigger a logout request and terminates their session, or redirect to a phishing website. This vulnerability stems from the absence of CSRF protections on the logout functionality.
CVSS Score: 3.4 (LOW)
CWE: CWE-352, CWE-352
References: https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_XXX/README.md
CVE: CVE-2024-11327
Published: 2025-01-11
Description: The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/clickwhale/tags/2.3.0/includes/admin/links/Clickwhale_Links_List_Table.php#L384; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219341%40clickwhale&new=3219341%40clickwhale&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/96c5836f-6d33-4a56-b30b-5e5d95b81b6b?source=cve
CVE: CVE-2024-12204
Published: 2025-01-11
Description: The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create 100% off coupons, delete posts, delete leads, and update coupon statuses.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3219466/coupon-x-discount-pop-up/trunk/inc/class-cx-rest.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e52d8b5e-727f-474a-a255-c24033db17d8?source=cve
CVE: CVE-2024-12404
Published: 2025-01-11
Description: The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/internal-link-shortcode/trunk/internal-link-shortcode.php#L82; https://www.wordfence.com/threat-intel/vulnerabilities/id/1661bb28-e5b4-4319-84bb-6cbeac266147?source=cve
CVE: CVE-2024-12472
Published: 2025-01-11
Description: The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to by duplicating the post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219375%40post-duplicator&new=3219375%40post-duplicator&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3071b2dc-9673-4e30-bd04-7404eb6a1ed9?source=cve
CVE: CVE-2024-12505
Published: 2025-01-11
Description: The Trackserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tsmap' shortcode in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/trackserver/trunk/class-trackserver-shortcode.php#L281; https://plugins.trac.wordpress.org/browser/trackserver/trunk/class-trackserver-shortcode.php#L46; https://plugins.trac.wordpress.org/browser/trackserver/trunk/class-trackserver-shortcode.php#L57
CVE: CVE-2024-12627
Published: 2025-01-11
Description: The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.5 via deserialization of untrusted input from post content passed to the capture_email AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/changeset/3219466/coupon-x-discount-pop-up/trunk/inc/class-cx-rest.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/468be776-8804-4d2f-8eaf-841bbf598ef9?source=cve
CVE: CVE-2024-42168
Published: 2025-01-11
Description: HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability.  An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.
CVSS Score: 8.9 (HIGH)
CWE: CWE-610, CWE-918
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE: CVE-2024-42169
Published: 2025-01-11
Description: HCL MyXalytics is affected by insecure direct object references.  It occurs due to missing access control checks, which fail to verify whether a user should be allowed to access specific data.
CVSS Score: 7.1 (HIGH)
CWE: CWE-639, CWE-639
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
CVE: CVE-2025-0103
Published: 2025-01-11
Description: An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://security.paloaltonetworks.com/PAN-SA-2025-0001
CVE: CVE-2025-0104
Published: 2025-01-11
Description: A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.paloaltonetworks.com/PAN-SA-2025-0001
CVE: CVE-2025-0105
Published: 2025-01-11
Description: An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-73
References: https://security.paloaltonetworks.com/PAN-SA-2025-0001
CVE: CVE-2025-0106
Published: 2025-01-11
Description: A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-155
References: https://security.paloaltonetworks.com/PAN-SA-2025-0001