deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8837
Published: 2025-08-11
Description: A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-416, CWE-416
References: https://drive.google.com/file/d/17Ic_DDOlH7mMT7IbTN2Bmo6SrujIUh24/view?usp=sharing; https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a; https://github.com/jasper-software/jasper/issues/402
CVE: CVE-2025-8838
Published: 2025-08-11
Description: A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argument uri leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The code maintainer responded to the issue that "[he] tried it, and using this link automatically redirects to the login page."
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/WinterChenS/my-site/issues/97; https://github.com/WinterChenS/my-site/issues/97#issuecomment[PII_REDACTED]; https://github.com/WinterChenS/my-site/issues/97#issuecomment[PII_REDACTED]
CVE: CVE-2025-8839
Published: 2025-08-11
Description: A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/jishenghua/jshERP/issues/125; https://vuldb.com/?ctiid.319373; https://vuldb.com/?id.319373
CVE: CVE-2025-8853
Published: 2025-08-11
Description: Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://www.chtsecurity.com/news/8618a2f0-390a-4506-9ff8-a9e74030d19e; https://www.chtsecurity.com/news/a9a90f0b-c2cb-4c66-b3d1-bc7f252fd108; https://www.twcert.org.tw/en/cp-139-10320-ad540-2.html
CVE: CVE-2025-8840
Published: 2025-08-11
Description: A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/jishenghua/jshERP/issues/126; https://vuldb.com/?ctiid.319374; https://vuldb.com/?id.319374
CVE: CVE-2025-8841
Published: 2025-08-11
Description: A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/zlt2000/microservices-platform/issues/77; https://github.com/zlt2000/microservices-platform/issues/77#issue[PII_REDACTED]; https://vuldb.com/?ctiid.319375
CVE: CVE-2025-8842
Published: 2025-08-11
Description: A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected by this issue is the function do_directive of the file preproc.c. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-416, CWE-416
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392933; https://drive.google.com/file/d/11vEV1vMHXO4BrDGhvWAMm0Qo1woiUwVV/view?usp=drive_link; https://vuldb.com/?ctiid.319376
CVE: CVE-2025-8843
Published: 2025-08-11
Description: A vulnerability was found in NASM Netwide Assember 2.17rc0. This affects the function macho_no_dead_strip of the file outmacho.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392934; https://drive.google.com/file/d/1JRHWdjW6FGHDV0CMJe8VinmCQ4vP9ZpR/view?usp=drive_link; https://vuldb.com/?ctiid.319377
CVE: CVE-2025-8844
Published: 2025-08-11
Description: A vulnerability was determined in NASM Netwide Assember 2.17rc0. This vulnerability affects the function parse_smacro_template of the file preproc.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392936; https://drive.google.com/file/d/10TSdMErFTBtLFIwfh_fia635cmtmFuei/view?usp=drive_link; https://vuldb.com/?ctiid.319378
CVE: CVE-2025-8672
Published: 2025-08-11
Description: MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions
granted by the user to the main application bundle. An attacker with local user access can
invoke this interpreter with arbitrary commands or scripts, leveraging the
application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of GIMP, potentially disguising attacker's malicious intent.

This issue has been fixed in 3.1.4.2 version of GIMP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://cert.pl/en/posts/2025/08/tcc-bypass/; https://gitlab.gnome.org/GNOME/gimp/-/issues/13848; https://gitlab.gnome.org/Infrastructure/gimp-macos-build
CVE: CVE-2025-8845
Published: 2025-08-11
Description: A vulnerability was identified in NASM Netwide Assember 2.17rc0. This issue affects the function assemble_file of the file nasm.c. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392937; https://drive.google.com/file/d/1pEQb6lcdohWV53DzPPU7kaCCNg-qAaau/view?usp=drive_link; https://vuldb.com/?ctiid.319379
CVE: CVE-2025-8846
Published: 2025-08-11
Description: A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected is the function parse_line of the file parser.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392938; https://drive.google.com/file/d/1MQGtdnz58vRF2fAeJMJ4VGiBQWXpnqfy/view?usp=drive_link; https://vuldb.com/?ctiid.319380
CVE: CVE-2025-8847
Published: 2025-08-11
Description: A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is the function Edit of the file /system/notice/edit. The manipulation of the argument noticeTitle/noticeContent leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/yangzongzhuan/RuoYi/issues/298; https://github.com/yangzongzhuan/RuoYi/issues/298#issue[PII_REDACTED]; https://vuldb.com/?ctiid.319381
CVE: CVE-2025-8862
Published: 2025-08-11
Description: YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacted.
CWE: CWE-201
References: https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
CVE: CVE-2025-8863
Published: 2025-08-11
Description: YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission
CWE: CWE-319
References: https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
CVE: CVE-2025-8851
Published: 2025-08-11
Description: A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121
References: http://www.libtiff.org/; https://gitlab.com/libtiff/libtiff/-/commit/8a7a48d7a645992ca83062b3a1873c951661e2b3; https://vuldb.com/?ctiid.319382
CVE: CVE-2025-8852
Published: 2025-08-11
Description: A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-209, CWE-209
References: https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26; https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26#issue[PII_REDACTED]; https://vuldb.com/?ctiid.319383
CVE: CVE-2025-8864
Published: 2025-08-11
Description: Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs
CWE: CWE-532
References: https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
CVE: CVE-2012-10037
Published: 2025-08-11
Description: PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required.
CWE: CWE-78
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/phptax_exec.rb; https://sourceforge.net/projects/phptax/; https://www.exploit-db.com/exploits/21665
CVE: CVE-2012-10038
Published: 2025-08-11
Description: Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/ directory and can be executed directly, resulting in remote code execution.
CWE: CWE-434
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/auxilium_upload_exec.rb; https://web.archive.org/web/[PII_REDACTED]2419/http://www.auxiliumsoftware.com/; https://www.exploit-db.com/exploits/21329
CVE: CVE-2012-10039
Published: 2025-08-11
Description: ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. ZEN Load Balancer is the predecessor of ZEVENET and SKUDONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained successor.
CWE: CWE-78
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/zen_load_balancer_exec.rb; https://web.archive.org/web/[PII_REDACTED]1540/http://www.zenloadbalancer.com/; https://web.archive.org/web/[PII_REDACTED]5056/https://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/
CVE: CVE-2012-10040
Published: 2025-08-11
Description: Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec() with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the openfiler user. Due to misconfigured sudoers, the openfiler user can escalate privileges to root via sudo /bin/bash without a password.
CWE: CWE-78
References: http://web.archive.org/web/[PII_REDACTED]0411/https://itsecuritysolutions.org/2012-09-06-Openfiler-v2.x-multiple-vulnerabilities/; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/openfiler_networkcard_exec.rb; https://sourceforge.net/projects/openfiler/
CVE: CVE-2025-8859
Published: 2025-08-11
Description: A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slider.php of the component File Upload Module. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/unjoke/newvul/issues/1; https://vuldb.com/?ctiid.319399
CVE: CVE-2025-8865
Published: 2025-08-11
Description: The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain malformed inputs. An authenticated attacker could exploit this issue to crash the YCQL tablet server, resulting in a denial of service.
CWE: CWE-476
References: https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
CVE: CVE-2025-38499
Published: 2025-08-11
Description: In the Linux kernel, the following vulnerability has been resolved:

clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

What we want is to verify there is that clone won't expose something
hidden by a mount we wouldn't be able to undo.  "Wouldn't be able to undo"
may be a result of MNT_LOCKED on a child, but it may also come from
lacking admin rights in the userns of the namespace mount belongs to.

clone_private_mnt() checks the former, but not the latter.

There's a number of rather confusing CAP_SYS_ADMIN checks in various
userns during the mount, especially with the new mount API; they serve
different purposes and in case of clone_private_mnt() they usually,
but not always end up covering the missing check mentioned above.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/36fecd740de2d542d2091d65d36554ee2bcf9c65; https://git.kernel.org/stable/c/38628ae06e2a37770cd794802a3f1310cf9846e3; https://git.kernel.org/stable/c/c28f922c9dcee0e4876a2c095939d77fe7e15116
CVE: CVE-2025-45146
Published: 2025-08-11
Description: ModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via the component /manager/data_manager.py. This vulnerability allows attackers to execute arbitrary code via supplying crafted data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/EDMPL/Vulnerability-Research/blob/main/CVE-2025-45146/README.md; https://github.com/codefuse-ai/ModelCache/blob/e053e0d57b532d4ad9378d2f31bb85a009b77d64/modelcache/manager/data_manager.py#L84C1-L84C43; https://github.com/codefuse-ai/ModelCache/blob/e053e0d57b532d4ad9378d2f31bb85a009b77d64/modelcache/manager/factory.py#L18C1-L18C71
CVE: CVE-2025-8866
Published: 2025-08-11
Description: YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.
CWE: CWE-200
References: https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
CVE: CVE-2025-25231
Published: 2025-08-11
Description: Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://static.omnissa.com/sites/default/files/OMSA-2025-0004.pdf; https://www.omnissa.com/omnissa-security-response/
CVE: CVE-2025-53187
Published: 2025-08-11
Description: Due to an issue in configuration, code that was intended for debugging purposes was included in the market release of the ASPECT FW allowing an attacker to bypass authentication. This vulnerability may allow an attacker to change the system time, access files, and make function calls without prior authentication. This issue affects all versions of ASPECT prior to 3.08.04-s01
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A4462&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE: CVE-2025-54063
Published: 2025-08-11
Description: Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on any website. If a victim clicks the exploit link in their browser, the app’s custom URL handler is triggered, leading to remote code execution on the victim’s machine. This issue has been patched in version 1.5.1.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://github.com/CherryHQ/cherry-studio/commit/ff72c007c03ff47de21a4d0bf52a1ff1fb35cd89; https://github.com/CherryHQ/cherry-studio/pull/8218; https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-p6vw-w3p8-4g72
CVE: CVE-2025-25229
Published: 2025-08-11
Description: Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://www.omnissa.com/omnissa-security-response/; https://www.omnissa.com/omsa-2025-0004/
CVE: CVE-2025-44001
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-44004
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.
CVSS Score: 7.2 (HIGH)
CWE: CWE-306
References: https://mattermost.com/security-updates
CVE: CVE-2025-48731
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the user does not have access for via edit subscription endpoint.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-49221
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint.
CVSS Score: 3.7 (LOW)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-51823
Published: 2025-08-11
Description: libcsp 2.0 is vulnerable to Buffer Overflow in the csp_eth_init() function due to improper handling of the ifname parameter. The function uses strcpy to copy the interface name into a structure member (ctx->name) without validating the input length.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/libcsp/libcsp/issues/850; https://github.com/libcsp/libcsp/pull/852
CVE: CVE-2025-51824
Published: 2025-08-11
Description: libcsp 2.0 is vulnerable to Buffer Overflow in the csp_usart_open() function at drivers/usart/zephyr.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/libcsp/libcsp/issues/851; https://github.com/libcsp/libcsp/pull/853
CVE: CVE-2025-52931
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://mattermost.com/security-updates
CVE: CVE-2025-53188
Published: 2025-08-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-53189
Published: 2025-08-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-53190
Published: 2025-08-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-53191
Published: 2025-08-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-53514
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-754
References: https://mattermost.com/security-updates
CVE: CVE-2025-53857
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.
CVSS Score: 3.7 (LOW)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-53910
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription without proper access to the channel via API call to the edit channel subscription endpoint.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-54458
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a Confluence space the user does not have access to via the create subscription endpoint.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862
References: https://mattermost.com/security-updates