deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27036
Published: 2025-09-24
Description: Information disclosure when Video engine escape input data is less than expected minimum size.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-27037
Published: 2025-09-24
Description: Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-27077
Published: 2025-09-24
Description: Memory corruption while processing message in guest VM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-47314
Published: 2025-09-24
Description: Memory corruption while processing data sent by FE driver.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-47315
Published: 2025-09-24
Description: Memory corruption while handling repeated memory unmap requests from guest VM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-47316
Published: 2025-09-24
Description: Memory corruption due to double free when multiple threads race to set the timestamp store.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-47317
Published: 2025-09-24
Description: Memory corruption due to global buffer overflow when a test command uses an invalid payload type.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-47318
Published: 2025-09-24
Description: Transient DOS while parsing the EPTM test control message to get the test pattern.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-47326
Published: 2025-09-24
Description: Transient DOS while handling command data during power control processing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-47327
Published: 2025-09-24
Description: Memory corruption while encoding the image data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-47328
Published: 2025-09-24
Description: Transient DOS while processing power control requests with invalid antenna or stream values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-47329
Published: 2025-09-24
Description: Memory corruption while handling invalid inputs in application info setup.
CVSS Score: 7.8 (HIGH)
CWE: CWE-763
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE: CVE-2025-56819
Published: 2025-09-24
Description: An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/h2database/h2database; https://github.com/xyyzxc/CVE-2025-56819; https://h2database.com/html/features.html#runscript
CVE: CVE-2025-10500
Published: 2025-09-24
Description: Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/435875050
CVE: CVE-2025-10501
Published: 2025-09-24
Description: Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/440737137
CVE: CVE-2025-10502
Published: 2025-09-24
Description: Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/438038775
CVE: CVE-2025-10585
Published: 2025-09-24
Description: Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/445380761; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10585
CVE: CVE-2025-10890
Published: 2025-09-24
Description: Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1300, CWE-203, CWE-203
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/430336833
CVE: CVE-2025-10891
Published: 2025-09-24
Description: Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-472
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/443765373
CVE: CVE-2025-10892
Published: 2025-09-24
Description: Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-472, CWE-190
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_23.html; https://issues.chromium.org/issues/444048019
CVE: CVE-2025-10909
Published: 2025-09-24
Description: A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-10909/; https://karinagante.github.io/cve-2025-10909/#proof-of-concept-poc; https://vuldb.com/?ctiid.325696
CVE: CVE-2025-20334
Published: 2025-09-24
Description: A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with root privileges into the underlying operating system.
 This vulnerability is due to insufficient input validation. An attacker with administrative privileges could exploit this vulnerability by authenticating to an affected system and performing an API call with crafted input. Alternatively, an unauthenticated attacker could persuade a legitimate user with administrative privileges who is currently logged in to the system to click a crafted link. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cmd-inject-rPJM8BGL
CVE: CVE-2025-20339
Published: 2025-09-24
Description: A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to bypass a configured ACL.

This vulnerability is due to the improper enforcement of the implicit deny all at the end of a configured ACL. An attacker could exploit this vulnerability by attempting to send unauthorized traffic to an interface on an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-defaultacl-pSJk9nVF
CVE: CVE-2025-20364
Published: 2025-09-24
Description: A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information.
 This vulnerability is due to insufficient verification checks of incoming 802.11 action frames. An attacker could exploit this vulnerability by sending 802.11 Device Analytics action frames with arbitrary parameters. A successful exploit could allow the attacker to inject Device Analytics action frames with arbitrary information, which could modify the Device Analytics data of valid wireless clients that are connected to the same wireless controller.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-action-frame-inj-QqCNcz8H
CVE: CVE-2025-20365
Published: 2025-09-24
Description: A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to modify the IPv6 gateway on an affected device.
 This vulnerability is due to a logic error in the processing of IPv6 RA packets that are received from wireless clients. An attacker could exploit this vulnerability by associating to a wireless network and sending a series of crafted IPv6 RA packets. A successful exploit could allow the attacker to temporarily change the IPv6 gateway of an affected device. This could also lead to intermittent packet loss for any wireless clients that are associated with the affected device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-940
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ipv6-gw-tUAzpn9O
CVE: CVE-2025-56815
Published: 2025-09-24
Description: Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the file name.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://github.com/running-elephant/datart/tags; https://github.com/xiaoxiaoranxxx/CVE-2025-56815
CVE: CVE-2025-56816
Published: 2025-09-24
Description: Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load() or loadAs() method without input sanitization. This allows deserialization of attacker-controlled YAML content, leading to arbitrary class instantiation. Under certain conditions, this can be exploited to achieve remote code execution (RCE).
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-502
References: https://github.com/running-elephant/datart; https://github.com/xiaoxiaoranxxx/CVE-2025-56815
CVE: CVE-2025-20149
Published: 2025-09-24
Description: A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.
 This vulnerability is due to a buffer overflow. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the CLI prompt. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-cli-EB7cZ6yO
CVE: CVE-2025-20160
Published: 2025-09-24
Description: A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. 
 This vulnerability exists because the system does not properly check whether the required TACACS+ shared secret is configured. A machine-in-the-middle attacker could exploit this vulnerability by intercepting and reading unencrypted TACACS+ messages or impersonating the TACACS+ server and falsely accepting arbitrary authentication requests. A successful exploit could allow the attacker to view sensitive information in a TACACS+ message or bypass authentication and gain access to the affected device.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-tacacs-hdB7thJw
CVE: CVE-2025-20240
Published: 2025-09-24
Description: A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device.
 This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-692
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-xss-VWyDgjOU
CVE: CVE-2025-20293
Published: 2025-09-24
Description: A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthenticated, remote attacker to access the public-key infrastructure (PKI) server that is running on an affected device.
 This vulnerability is due to incomplete cleanup upon completion of the Day One setup process. An attacker could exploit this vulnerability by sending Simple Certificate Enrollment Protocol (SCEP) requests to an affected device. A successful exploit could allow the attacker to request a certificate from the virtual wireless controller and then use the acquired certificate to join an attacker-controlled device to the virtual wireless controller.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-459
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-9800cl-openscep-SB4xtxzP
CVE: CVE-2025-20311
Published: 2025-09-24
Description: A vulnerability in the handling of certain Ethernet frames in Cisco IOS XE Software for Catalyst 9000 Series Switches could allow an unauthenticated, adjacent attacker to cause an egress port to become blocked and drop all outbound traffic.
 This vulnerability is due to improper handling of crafted Ethernet frames. An attacker could exploit this vulnerability by sending crafted Ethernet frames through an affected switch. A successful exploit could allow the attacker to cause the egress port to which the crafted frame is forwarded to start dropping all frames, resulting in a denial of service (DoS) condition.
CVSS Score: 7.4 (HIGH)
CWE: CWE-19
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cat9k-PtmD7bgy
CVE: CVE-2025-20312
Published: 2025-09-24
Description: A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
 This vulnerability is due to improper error handling when parsing a specific SNMP request. An attacker could exploit this vulnerability by sending a specific SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
 This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMPv2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMPv3, the attacker must have valid SNMP user credentials for the affected system.
CVSS Score: 7.7 (HIGH)
CWE: CWE-835
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmpwred-x3MJyf5M
CVE: CVE-2025-20313
Published: 2025-09-24
Description: Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust.
 These vulnerabilities are due path traversal and improper image integrity validation.  A successful exploit could allow the attacker to execute persistent code on the underlying operating system.
 Because this allows the attacker to bypass a major security feature of the device, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
 For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.
   
  
  
 ERP
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-35
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secboot-UqFD8AvC
CVE: CVE-2025-20314
Published: 2025-09-24
Description: A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to an affected device to execute persistent code at boot time and break the chain of trust. This vulnerability is due to improper validation of software packages. An attacker could exploit this vulnerability by placing a crafted file into a specific location on an affected device. A successful exploit could allow the attacker to execute persistent code on the underlying operating system. Because this vulnerability allows an attacker to bypass a major security feature of a device, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-232
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secboot-UqFD8AvC
CVE: CVE-2025-20315
Published: 2025-09-24
Description: A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, causing a denial of service (DoS) condition.
 This vulnerability is due to improper handling of malformed Control and Provisioning of Wireless Access Points (CAPWAP) packets. An attacker could exploit this vulnerability by sending malformed CAPWAP packets through an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-805
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nbar-dos-LAvwTmeT
CVE: CVE-2025-20316
Published: 2025-09-24
Description: A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device.
 This vulnerability is due to the flooding of traffic from an unlearned MAC address on a switch virtual interface (SVI) that has an egress ACL applied. An attacker could exploit this vulnerability by causing the VLAN to flush its MAC address table. This condition can also occur if the MAC address table is full. A successful exploit could allow the attacker to bypass an egress ACL on an affected device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cat9k-acl-L4K7VXgD
CVE: CVE-2025-20327
Published: 2025-09-24
Description: A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device.
 This vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a crafted URL in an HTTP request. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
CVSS Score: 7.7 (HIGH)
CWE: CWE-1287
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-invalid-url-dos-Nvxszf6u
CVE: CVE-2025-20338
Published: 2025-09-24
Description: A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underlying operating system of an affected device.
 This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by logging in to the device CLI with valid administrative (level 15) credentials and using crafted commands at the CLI prompt. A successful exploit could allow the attacker to execute arbitrary commands as root.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-141
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-arg-inject-EyDDbh4e
CVE: CVE-2025-20352
Published: 2025-09-24
Description: A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following:
  An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or Cisco IOS XE Software. To cause the DoS, the attacker must have the SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials.  An authenticated, remote attacker with high privileges could execute code as the root user on an affected device that is running Cisco IOS XE Software. To execute code as the root user, the attacker must have the SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials and administrative or privilege 15 credentials on the affected device.   An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device over IPv4 or IPv6 networks. 
 This vulnerability is due to a stack overflow condition in the SNMP subsystem of the affected software. A successful exploit could allow a low-privileged attacker to cause the affected system to reload, resulting in a DoS condition, or allow a high-privileged attacker to execute arbitrary code as the root user and obtain full control of the affected system.
 Note: This vulnerability affects all versions of SNMP.
CVSS Score: 7.7 (HIGH)
CWE: CWE-121
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20352