deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1933
Published: 2025-03-04
Description: On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a different type. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS Score: 7.6 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1946004; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-15/
CVE: CVE-2025-1934
Published: 2025-03-04
Description: It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1942881; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-16/
CVE: CVE-2025-1935
Published: 2025-03-04
Description: A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1866661; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-16/
CVE: CVE-2025-1936
Published: 2025-03-04
Description: jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS Score: 7.3 (HIGH)
CWE: CWE-158
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1940027; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-16/
CVE: CVE-2025-1937
Published: 2025-03-04
Description: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1260
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-15/
CVE: CVE-2025-1938
Published: 2025-03-04
Description: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1922889%2C1935004%2C1943586%2C1943912%2C1948111; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-16/
CVE: CVE-2025-1939
Published: 2025-03-04
Description: Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability was fixed in Firefox 136.
CVSS Score: 3.9 (LOW)
CWE: CWE-359
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1928334; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://taptrap.click
CVE: CVE-2025-1940
Published: 2025-03-04
Description: A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. 
*This issue only affects Android versions of Firefox.*. This vulnerability was fixed in Firefox 136.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1908488; https://www.mozilla.org/security/advisories/mfsa2025-14/
CVE: CVE-2025-1941
Published: 2025-03-04
Description: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1944665; https://www.mozilla.org/security/advisories/mfsa2025-14/
CVE: CVE-2025-1942
Published: 2025-03-04
Description: When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability was fixed in Firefox 136 and Thunderbird 136.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-908
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1947139; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-17/
CVE: CVE-2025-1943
Published: 2025-03-04
Description: Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136 and Thunderbird 136.
CVSS Score: 8.2 (HIGH)
CWE: CWE-122
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1869650%2C1938451%2C1940326%2C1944052%2C1944063%2C1947281; https://www.mozilla.org/security/advisories/mfsa2025-14/; https://www.mozilla.org/security/advisories/mfsa2025-17/
CVE: CVE-2025-27424
Published: 2025-03-04
Description: Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability was fixed in Firefox for iOS 136.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1945392; https://www.mozilla.org/security/advisories/mfsa2025-13/
CVE: CVE-2025-27425
Published: 2025-03-04
Description: Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. This vulnerability was fixed in Firefox for iOS 136.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1941525; https://www.mozilla.org/security/advisories/mfsa2025-13/
CVE: CVE-2025-27426
Published: 2025-03-04
Description: Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. This vulnerability was fixed in Firefox for iOS 136.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1933079; https://www.mozilla.org/security/advisories/mfsa2025-13/
CVE: CVE-2024-50705
Published: 2025-03-04
Description: Unauthenticated reflected cross-site scripting (XSS) vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary scripts via the page parameter.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://uniguest.com/cve-bulletins/; https://uniguest.com/wp-content/uploads/2025/02/CVE-2024-50705-Vulnerability-Summary.pdf
CVE: CVE-2024-50706
Published: 2025-03-04
Description: Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries on the backend database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://uniguest.com/cve-bulletins/; https://uniguest.com/wp-content/uploads/2025/02/CVE-2024-50706-Vulnerability-Summary.pdf
CVE: CVE-2024-9149
Published: 2025-03-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wind Media E-Commerce Website Template allows SQL Injection.This issue affects E-Commerce Website Template: before v1.5.
CVSS Score: 8.6 (HIGH)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0051
CVE: CVE-2024-11957
Published: 2025-03-04
Description: Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276

 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough.
CWE: CWE-347
References: https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/
CVE: CVE-2024-50704
Published: 2025-03-04
Description: Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://uniguest.com/cve-bulletins/; https://uniguest.com/wp-content/uploads/2025/02/CVE-2024-50704-Vulnerability-Summary.pdf
CVE: CVE-2024-50707
Published: 2025-03-04
Description: Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-For header in an HTTP GET request.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://uniguest.com/cve-bulletins/; https://uniguest.com/wp-content/uploads/2025/02/CVE-2024-50707-Vulnerability-Summary.pdf
CVE: CVE-2025-1424
Published: 2025-03-04
Description: A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if they gain physical access to the device.
This issue affects InkPad Color 3 in version U743k3.6.8.3671.
CWE: CWE-269
References: https://www.redguard.ch/blog/2025/03/04/security-advisory-pocketbook-inkpad-color-3/
CVE: CVE-2025-1425
Published: 2025-03-04
Description: A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affects InkPad Color 3: U743k3.6.8.3671.
CWE: CWE-269
References: https://www.redguard.ch/blog/2025/03/04/security-advisory-pocketbook-inkpad-color-3/
CVE: CVE-2025-23368
Published: 2025-03-04
Description: A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
CVSS Score: 8.1 (HIGH)
CWE: CWE-307
References: https://access.redhat.com/security/cve/CVE-2025-23368; https://bugzilla.redhat.com/show_bug.cgi?id=2337621; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2025-26320
Published: 2025-03-04
Description: t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://github.com/BaranTeyin1/vulnerability-research/tree/main/CVE-2025-26320; https://github.com/t0mer/broadlinkmanager-docker; https://github.com/t0mer/broadlinkmanager-docker/blob/master/broadlinkmanager/broadlinkmanager.py#L639-L657
CVE: CVE-2025-27111
Published: 2025-03-04
Description: Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
CVSS Score: 7.5 (HIGH)
CWE: CWE-93, CWE-117
References: https://github.com/rack/rack/commit/803aa221e[PII_REDACTED]e224f4476e438f2531a53; https://github.com/rack/rack/commit/aeac570bb8080ca7b53b7f2e2f67498be7ebd30b; https://github.com/rack/rack/commit/b13bc6bfc7506aca3478dc5ac1c2ec6fc53f82a3
CVE: CVE-2025-26091
Published: 2025-03-04
Description: A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'name' parameter when creating a new password in the "My Passwords" page.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://brunocaseiro.github.io/CVE-2025-26091/
CVE: CVE-2025-26182
Published: 2025-03-04
Description: An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://gist.github.com/GSBP0/007355c5f6bd213264ae1c35c347e5cc
CVE: CVE-2025-27150
Published: 2025-03-04
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99[PII_REDACTED] and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-538
References: https://github.com/Enalean/tuleap/commit/a6702622a8db969a17522b8fac0774afdb1c916f; https://github.com/Enalean/tuleap/security/advisories/GHSA-jc5r-684x-j46q; https://tuleap.net/plugins/tracker/?aid=41870
CVE: CVE-2025-27155
Published: 2025-03-04
Description: Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) included in Pinecone up to commit ea4c337 is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconesim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bd; https://github.com/matrix-org/pinecone/security/advisories/GHSA-fr62-mg2q-7wqv
CVE: CVE-2025-27156
Published: 2025-03-04
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail clients. This vulnerability is fixed in Tuleap Community Edition 16.4.99[PII_REDACTED] and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Enalean/tuleap/commit/a0bc657297b405debce1f5bcbbb30c733f3f09bd; https://github.com/Enalean/tuleap/security/advisories/GHSA-x2v2-xr59-c9cf; https://tuleap.net/plugins/tracker/?aid=42177
CVE: CVE-2025-27401
Published: 2025-03-04
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filters of all reports of the instance and delete them. The malicious user only needs to have access to one tracker. This would result in the loss of all criteria filters forcing users and tracker admins to re-create them. This vulnerability is fixed in Tuleap Community Edition 16.4.99[PII_REDACTED] and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-440
References: https://github.com/Enalean/tuleap/commit/0070fef5c3b27fd402d3232041c6e03f79a84ffd; https://github.com/Enalean/tuleap/security/advisories/GHSA-3rjf-87rf-h8m9; https://tuleap.net/plugins/tracker/?aid=41850
CVE: CVE-2025-27402
Published: 2025-03-04
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99[PII_REDACTED] and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352
References: https://github.com/Enalean/tuleap/commit/ea6319e2ad40beeda335af4ccd7a204a6912765c; https://github.com/Enalean/tuleap/security/advisories/GHSA-66pg-cpjf-2mfg; https://tuleap.net/plugins/tracker/?aid=41857
CVE: CVE-2025-27507
Published: 2025-03-04
Description: The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-639
References: https://github.com/zitadel/zitadel/commit/d9d8339813f1c43d3eb7d8d80f11fdabb2fd2ee4; https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x
CVE: CVE-2024-10930
Published: 2025-03-04
Description: An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-01; https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2024-41147
Published: 2025-03-04
Description: An out-of-bounds write vulnerability exists in the ma_dr_flac__decode_samples__lpc functionality of Miniaudio miniaudio v0.11.21. A specially crafted .flac file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-122
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2063; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2063
CVE: CVE-2019-1815
Published: 2025-03-04
Description: A security vulnerability was discovered in the local status page functionality of Cisco Meraki’s MX67 and MX68 security appliance models that may allow unauthenticated individuals to access and download logs containing sensitive, privileged device information. The vulnerability is due to improper access control to the files holding debugging and maintenance information, and is only exploitable when the local status page is enabled on the device. An attacker exploiting this vulnerability may obtain access to wireless pre-shared keys, Site-to-Site VPN key and other sensitive information. Under certain circumstances, this information may allow an attacker to obtain administrative-level access to the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://documentation.meraki.com/General_Administration/Privacy_and_Security/Cisco_Meraki_MX67_and_MX68_Sensitive_Information_Disclosure_Vulnerability
CVE: CVE-2020-3122
Published: 2025-03-04
Description: A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to obtain sensitive network information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr92383
CVE: CVE-2025-1946
Published: 2025-03-04
Description: A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the function exportPDF of the file /user/exportPDF. The manipulation of the argument id leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/heiheixz/report/blob/main/nxb_1.md; https://vuldb.com/?ctiid.298520; https://vuldb.com/?id.298520
CVE: CVE-2025-1947
Published: 2025-03-04
Description: A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the function scorm of the file UploadImageController.java. The manipulation of the argument param leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/heiheixz/report/blob/main/nxb_2.md; https://vuldb.com/?ctiid.298521; https://vuldb.com/?id.298521
CVE: CVE-2025-1949
Published: 2025-03-04
Description: A vulnerability, which was classified as problematic, has been found in ZZCMS 2025. This issue affects some unknown processing of the file /3/ucenter_api/code/register_nodb.php of the component URL Handler. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/Sinon2003/cve/blob/main/zzcms/xss-register_nodb.php.md; https://vuldb.com/?ctiid.298541; https://vuldb.com/?id.298541
CVE: CVE-2025-1952
Published: 2025-03-04
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/password-recovery.php. The manipulation of the argument username/mobileno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zrlianc/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.298542
CVE: CVE-2025-1969
Published: 2025-03-04
Description: Improper request input validation in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM.

Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-807
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-004/; https://github.com/aws-samples/iam-identity-center-team/releases/tag/v1.2.2; https://github.com/aws-samples/iam-identity-center-team/security/advisories/GHSA-x9xv-r58p-qh86
CVE: CVE-2025-26202
Published: 2025-03-04
Description: Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in DZS Router Web Interface. An authenticated attacker can inject malicious JavaScript into the passphrase field, which is stored and later executed when an administrator views the passphrase via the "Click here to display" option on the Status page
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/A17-ba/CVE-2025-26202-Details; https://github.com/A17-ba/CVE-2025-26202-Details
CVE: CVE-2025-1080
Published: 2025-03-04
Description: LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments.
This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.libreoffice.org/about-us/security/advisories/cve-2025-1080; https://lists.debian.org/debian-lts-announce/2025/06/msg00002.html