deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-60646
Published: 2025-11-12
Description: A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/LockeTom/0a02c0b2e2011abfbdf4e5fdbcc9b371; https://github.com/xuxueli/xxl-api/issues/65
CVE: CVE-2025-61667
Published: 2025-11-12
Description: The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-scripts/__pycache__` directory during installation. Code in this directory is only run by the Agent during Agent install/upgrades.  This could allow an attacker with local access to modify files in this directory, which would then subsequently be run when the Agent is upgraded, resulting in local privilege escalation. This issue requires local access to the host and a valid low privilege account to be vulnerable. Note that this vulnerability only impacts the Linux Host Agent. Other variations of the Agent including the container, kubernetes, windows host and other agents are not impacted. Version 7.71.0 contains a patch for the issue.
CWE: CWE-276
References: https://github.com/DataDog/datadog-agent/security/advisories/GHSA-6852-76c5-6cmg
CVE: CVE-2025-63679
Published: 2025-11-12
Description: free5gc v4.1.0 and before is vulnerable to Buffer Overflow. When AMF receives an UplinkRANConfigurationTransfer NGAP message from a gNB, the AMF process crashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://gist.github.com/DDGod2025/5483d94b028d7a0c111ca23844e8a94d; https://github.com/free5gc/free5gc/issues/725
CVE: CVE-2025-63927
Published: 2025-11-12
Description: A heap-use-after-free vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). During multi-threaded client execution, the function Iec10x_Scheduled can access memory that has already been freed, potentially causing program crashes or undefined behavior. This may be exploited to trigger a denial-of-service or memory corruption.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-122
References: https://github.com/airpig2011/IEC104/issues/20; https://songsong.host/mybugs/CVE-2025-63927.html
CVE: CVE-2025-63929
Published: 2025-11-12
Description: A null pointer dereference vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). When multiple threads enqueue elements concurrently via IEC10X_PrioEnQueue, the function may dereference a null or freed queue pointer, resulting in a segmentation fault and potential denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/airpig2011/IEC104/issues/21; https://songsong.host/mybugs/CVE-2025-63929.html
CVE: CVE-2025-64099
Published: 2025-11-12
Description: Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.
CWE: CWE-74
References: https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-39hr-239p-fhqc
CVE: CVE-2024-48829
Published: 2025-11-12
Description: Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-94
References: https://www.dell.com/support/kbdoc/en-us/000391062/dsa-2025-407-security-update-for-dell-networking-os10-vulnerabilities
CVE: CVE-2025-10495
Published: 2025-11-12
Description: A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://iknow.lenovo.com.cn/detail/434328
CVE: CVE-2025-12047
Published: 2025-11-12
Description: A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to disclose sensitive user files from the application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://iknow.lenovo.com.cn/detail/434327
CVE: CVE-2025-12048
Published: 2025-11-12
Description: An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the affected system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://iknow.lenovo.com.cn/detail/434326
CVE: CVE-2025-13058
Published: 2025-11-12
Description: A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The manipulation results in cross site scripting. The attack may be launched remotely. The patch is identified as 002def70b985f7012586df2c44368845bf405ab3. Applying a patch is advised to resolve this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/soerennb/extplorer/; https://github.com/soerennb/extplorer/commit/002def70b985f7012586df2c44368845bf405ab3; https://github.com/soerennb/extplorer/issues/33
CVE: CVE-2025-13059
Published: 2025-11-12
Description: A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manage_career.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/CaseyW33/CVE/issues/1; https://vuldb.com/?ctiid.332186; https://vuldb.com/?id.332186
CVE: CVE-2025-13060
Published: 2025-11-12
Description: A security vulnerability has been detected in SourceCodester Survey Application System 1.0. This affects an unknown function of the file /view_survey.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lakshayyverma/CVE-Discovery/blob/main/Survey%20Application%20System%202%20.md; https://vuldb.com/?ctiid.332187; https://vuldb.com/?id.332187
CVE: CVE-2025-27368
Published: 2025-11-12
Description: IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. An authenticated user is able to obtain certain information about system metadata for areas beyond what the user is intended to view.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7250238
CVE: CVE-2025-46427
Published: 2025-11-12
Description: Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.dell.com/support/kbdoc/en-us/000391062/dsa-2025-407-security-update-for-dell-networking-os10-vulnerabilities
CVE: CVE-2025-46428
Published: 2025-11-12
Description: Dell SmartFabric OS10 Software, versions prior to 10.6.1.0,  contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.dell.com/support/kbdoc/en-us/000391062/dsa-2025-407-security-update-for-dell-networking-os10-vulnerabilities
CVE: CVE-2025-64117
Published: 2025-11-12
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99[PII_REDACTED] and Tuleap Enterprise Edition prior to versions 16.13-5 and 16.12-8 don't have cross-site request forgery protection in the management of SVN commit rules and immutable tags. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99[PII_REDACTED], Tuleap Enterprise Edition 16.13-5, and Tuleap Enterprise Edition 16.12-8 contain a fix for the issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352
References: https://github.com/Enalean/tuleap/commit/f49419f63edbbaa31ce8417b737431d944827404; https://github.com/Enalean/tuleap/security/advisories/GHSA-p2f7-qw8p-f2p7; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=f49419f63edbbaa31ce8417b737431d944827404
CVE: CVE-2025-8421
Published: 2025-11-12
Description: An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticated local user to redirect log files with elevated privileges.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-198729
CVE: CVE-2025-8485
Published: 2025-11-12
Description: An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://iknow.lenovo.com.cn/detail/434329
CVE: CVE-2025-13061
Published: 2025-11-12
Description: A vulnerability was detected in itsourcecode Online Voting System 1.0. This impacts an unknown function of the file /index.php?page=manage_voting. Performing manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/yihaofuweng/cve/issues/55; https://itsourcecode.com/; https://vuldb.com/?ctiid.332188
CVE: CVE-2025-13063
Published: 2025-11-12
Description: A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack may be performed from remote. The exploit has been published and may be used. Multiple endpoints are affected.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862, CWE-863
References: https://github.com/DinukaNavaratna/Dee_Store-Simple_Online_Shopping_Website/issues/1; https://vuldb.com/?ctiid.332189; https://vuldb.com/?id.332189
CVE: CVE-2025-36223
Published: 2025-11-12
Description: IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-644
References: https://www.ibm.com/support/pages/node/7250239
CVE: CVE-2025-46608
Published: 2025-11-12
Description: Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability is considered Critical, as it may result in unauthorized access with elevated privileges, compromising system integrity and customer data. Dell recommends customers upgrade to the latest version at the earliest opportunity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000390529/dsa-2025-375-security-update-for-dell-data-lakehouse-multiple-vulnerabilities
CVE: CVE-2025-63396
Published: 2025-11-12
Description: An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (DoS).
CVSS Score: 3.3 (LOW)
CWE: CWE-667
References: http://pytorch.com; https://github.com/Daisy2ang; https://github.com/pytorch/pytorch
CVE: CVE-2025-64170
Published: 2025-11-12
Description: sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the console. This could reveal partial password information, possibly exposing history files when not carefully handled by the user and on screen, usable for Social Engineering or Pass-By attacks. Version 0.2.10 fixes the issue.
CVSS Score: 3.8 (LOW)
CWE: CWE-549
References: https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.10; https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-c978-wq47-pvvw
CVE: CVE-2025-64186
Published: 2025-11-12
Description: Evervault is a payment security solution. A vulnerability was identified in the `evervault-go` SDK’s attestation verification logic in versions of `evervault-go` prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not meet expected integrity guarantees. The exploitability of this issue is limited in Evervault-hosted environments as an attacker would require the pre-requisite ability to serve requests from specific evervault domain names, following from our ACME challenge based TLS certificate acquisition pipeline. The vulnerability primarily affects applications which only check PCR8. Though the efficacy is also reduced for applications that check all PCR values, the impact is largely remediated by checking PCR 0, 1 and 2. The identified issue has been addressed in version 1.3.2 by validating attestation documents before storing in the cache, and replacing the naive equality checks with a new SatisfiedBy check. Those who useevervault-go to attest Enclaves that are hosted outside of Evervault environments and cannot upgrade have two possible workarounds available. Modify the application logic to fail verification if PCR8 is not explicitly present and non-empty and/or add custom pre-validation to reject documents that omit any required PCRs.
CVSS Score: 8.7 (HIGH)
CWE: CWE-347
References: https://github.com/evervault/evervault-go/commit/7c824d289bba11ec0bea46a338023f5b128bbb28; https://github.com/evervault/evervault-go/pull/48; https://github.com/evervault/evervault-go/security/advisories/GHSA-88h9-77c7-p6w4
CVE: CVE-2011-10034
Published: 2025-11-12
Description: AUTOMGEN versions up to and including 8.0.0.7 (also referenced as 8.022) contain a vulnerability in that project file handling frees an object and subsequently dereferences the stale pointer when processing certain malformed fields. The dangling-pointer use enables an attacker to influence an indirect call through attacker-controlled memory, resulting in denial-of-service. In some conditions, remote code execution may be possible.
CWE: CWE-416
References: https://en.iraifrance.com/automgen; https://www.exploit-db.com/exploits/17964; https://www.vulncheck.com/advisories/irai-automgen-use-after-free-remote-dos
CVE: CVE-2016-15055
Published: 2025-11-12
Description: JVC VN-T IP-camera models firmware versions up to 2016-08-22 (confirmed on the VN-T216VPRU model) contain a directory traversal vulnerability in the checkcgi endpoint that accepts a user-controlled file parameter. An unauthenticated remote attacker can leverage this vulnerability to read arbitrary files on the device.
CWE: CWE-22
References: http://pro.jvc.com/prof/attributes/tech_desc.jsp?model_id=MDL102145&feature_id=02; https://web.archive.org/web/[PII_REDACTED]1843/http://www.black-rose.ml/2016/08/analyzing-security-cameras-products.html; https://www.exploit-db.com/exploits/40282
CVE: CVE-2017-20211
Published: 2025-11-12
Description: UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied pointer without sufficient validation. A crafted input may cause the control to dereference an attacker-controlled pointer, enabling remote code execution in the context of the hosting process. The vulnerability requires user interaction (instantiation of the ActiveX control via a web page or a file).
CWE: CWE-823
References: https://www.ucancode.net/; https://www.vulncheck.com/advisories/ucancode-e-xd-visualization-enterprise-suite-untrusted-pointer-dereference-rce; https://www.zerodayinitiative.com/advisories/ZDI-17-422/
CVE: CVE-2021-4463
Published: 2025-11-12
Description: Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.
CWE: CWE-22, CWE-552
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://exchange.xforce.ibmcloud.com/vulnerabilities/206477; https://packetstormsecurity.com/files/163702
CVE: CVE-2021-4464
Published: 2025-11-12
Description: FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('webs') fails to enforce maximum lengths for Cookie header values. When a cookie longer than 511 bytes is processed, a stack buffer is overrun, leading to a crash or potential control of execution flow.
CWE: CWE-121
References: https://pierrekim.github.io/advisories/2021-fiberhome-0x00-ont.txt; https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html#misc-remote-stack-overflow-an5506; https://www.vulncheck.com/advisories/fiberhome-routers-remote-stack-overflow
CVE: CVE-2022-4982
Published: 2025-11-12
Description: DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers (`frame.html` and `frame.A100.html`) that accept a path parameter (`content` or `sidebar`) which is not properly validated or canonicalized. An attacker can supply directory-traversal sequences to cause the server to read and return arbitrary filesystem files that the webserver user can access. Other GoIP models and firmware versions are likely affected. Exploitation evidence was observed by the Shadowserver Foundation on 2024-03-21 UTC.
CWE: CWE-22, CWE-98
References: http://www.dbltek.com/; https://shufflingbytes.com/posts/hacking-goip-gsm-gateway/; https://www.exploit-db.com/exploits/50775
CVE: CVE-2022-4983
Published: 2025-11-12
Description: TEC-IT TBarCode version 11.15 contains a vulnerability in the TBarCode11.ocx ActiveX/OCX control's licensing handling (INI-file based) that can be abused to cause remote creation of files on the host filesystem. Depending on where files can be created and which filenames are allowed, this can allow attackers to write files that lead to code execution or persistence under the context of the hosting process.
CWE: CWE-73
References: https://www.tec-it.com/en/software/barcode-software/tbarcode/history/v10/Default.aspx; https://www.vulncheck.com/advisories/tec-it-tbarcode-sdk-remote-file-create
CVE: CVE-2023-7326
Published: 2025-11-12
Description: The Epson Stylus SX510W embedded web management service fails to properly handle consecutive ampersand characters in query parameters when accessing /PRESENTATION/HTML/TOP/INDEX.HTML. A remote attacker can send a malformed request that triggers improper input parsing or memory handling, resulting in the printer process shutting down or powering off, causing a denial of service condition.
CWE: CWE-400
References: https://www.epson.eu/en_EU/support/sc/epson-stylus-sx510w/s/s837; https://www.exploit-db.com/exploits/51441; https://www.vulncheck.com/advisories/epson-stylus-printer-remote-power-off-dos
CVE: CVE-2023-7327
Published: 2025-11-12
Description: Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Successful exploitation allows an unauthenticated attacker to use URL-encoded traversal sequences to read arbitrary files from the underlying filesystem with the privileges of the gateway service, leading to disclosure of sensitive information.
CWE: CWE-22
References: https://ozeki-sms-gateway.com/; https://www.exploit-db.com/exploits/51646; https://www.vulncheck.com/advisories/ozeki-sms-gateway-unauthenticated-arbitrary-file-read
CVE: CVE-2023-7329
Published: 2025-11-12
Description: Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configuration loss.
CWE: CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275810; https://packetstormsecurity.com/files/174455/; https://tinycontrol.pl/en/archives/lan-controller-35/
CVE: CVE-2025-33119
Published: 2025-11-12
Description: IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-260
References: https://www.ibm.com/support/pages/node/7250932