deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-55923
Published: 2025-01-14
Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Indexed Search Module” allows attackers to delete items of the component. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. There are no known workarounds for this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-749
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-7r5q-4qgx-v545; https://typo3.org/security/advisory/typo3-core-sa-2025-008
CVE: CVE-2024-55924
Published: 2025-01-14
Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component “Scheduler Module” allows attackers to trigger pre-defined command classes - which can lead to unauthorized import or export of data in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS which fixes the problem described. There are no known workarounds for this vulnerability.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352, CWE-749
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-7835-fcv3-g256; https://typo3.org/security/advisory/typo3-core-sa-2025-009
CVE: CVE-2024-55945
Published: 2025-01-14
Description: TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to `lax` or `none`. The vulnerability in the affected downstream component “DB Check Module” allows attackers to manipulate data through unauthorized actions. Users are advised to update to TYPO3 versions 11.5.42 ELTS which fixes the problem described. There are no known workarounds for this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-749
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-8mv3-37rc-pvxj; https://typo3.org/security/advisory/typo3-core-sa-2025-010
CVE: CVE-2024-5175
Published: 2025-01-14
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-21135
Published: 2025-01-14
Description: Animate versions 24.0.6, 23.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://helpx.adobe.com/security/products/animate/apsb25-05.html
CVE: CVE-2025-21136
Published: 2025-01-14
Description: Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb25-06.html
CVE: CVE-2025-21137
Published: 2025-01-14
Description: Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb25-06.html
CVE: CVE-2025-21138
Published: 2025-01-14
Description: Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb25-06.html
CVE: CVE-2025-21139
Published: 2025-01-14
Description: Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb25-06.html
CVE: CVE-2025-23018
Published: 2025-01-14
Description: IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spoof and route arbitrary traffic via an exposed network interface. This is a similar issue to CVE-2020-10136.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-940
References: https://datatracker.ietf.org/doc/html/rfc2473; https://papers.mathyvanhoef.com/usenix2025-tunnels.pdf; https://www.top10vpn.com/research/tunneling-protocol-vulnerability/
CVE: CVE-2025-23019
Published: 2025-01-14
Description: IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-940
References: https://datatracker.ietf.org/doc/html/rfc4213; https://papers.mathyvanhoef.com/usenix2025-tunnels.pdf; https://www.top10vpn.com/research/tunneling-protocol-vulnerability/
CVE: CVE-2024-10253
Published: 2025-01-14
Description: A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-122
References: https://iknow.lenovo.com.cn/detail/425367
CVE: CVE-2024-10254
Published: 2025-01-14
Description: A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-122
References: https://iknow.lenovo.com.cn/detail/425367
CVE: CVE-2024-45102
Published: 2025-01-14
Description: A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instance when using LXCA as a Single Sign On (SSO) provider for XCC instances.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-319
References: https://support.lenovo.com/us/en/product_security/LEN-154748
CVE: CVE-2024-48760
Published: 2025-01-14
Description: An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacker can upload a malicious perlcmd.cgi file that overwrites the original upload.cgi file, enabling remote command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.gestioip.net/index.html; https://github.com/maxibelino/CVEs/tree/main/CVE-2024-48760; https://github.com/muebel/gestioip-docker-compose
CVE: CVE-2024-50857
Published: 2025-01-14
Description: The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.gestioip.net; https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50857; https://github.com/muebel/gestioip-docker-compose
CVE: CVE-2024-50858
Published: 2025-01-14
Description: Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.gestioip.net; https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50858; https://github.com/muebel/gestioip-docker-compose
CVE: CVE-2024-50859
Published: 2025-01-14
Description: The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.gestioip.net; https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50859; https://github.com/muebel/gestioip-docker-compose
CVE: CVE-2024-50861
Published: 2025-01-14
Description: The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.gestioip.net; https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861; https://github.com/muebel/gestioip-docker-compose
CVE: CVE-2024-57471
Published: 2025-01-14
Description: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 2.4G wireless network processing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://h3c.com; https://gist.github.com/XiaoCurry/88a43c9a[PII_REDACTED]1eb7592da39d4c
CVE: CVE-2024-57479
Published: 2025-01-14
Description: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address update function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://h3c.com; https://gist.github.com/XiaoCurry/c7214be67a44a4a8858c5138ecd05984
CVE: CVE-2024-57480
Published: 2025-01-14
Description: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the AP configuration function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://h3c.com; https://gist.github.com/XiaoCurry/16213a4d68f95f17cd0fc2cd07e78a90
CVE: CVE-2024-57482
Published: 2025-01-14
Description: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 5G wireless network processing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://h3c.com; https://gist.github.com/XiaoCurry/d39f76a025df8b78a5f9e1aa48c16d18
CVE: CVE-2024-42911
Published: 2025-01-14
Description: ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-94
References: http://ecovacs.com; https://www.ecovacs.com/global/userhelp/dsa[PII_REDACTED]1
CVE: CVE-2024-47605
Published: 2025-01-14
Description: silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/silverstripe/silverstripe-asset-admin/security/advisories/GHSA-7cmp-cgg8-4c82; https://github.com/silverstripe/silverstripe-framework/commit/09b5052c86932f273e0d733428c9aade70ff2a4a; https://www.silverstripe.org/download/security-releases/cve-2024-47605
CVE: CVE-2024-53277
Published: 2025-01-14
Description: Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links and other relevant HTML markup for the given message. Some form messages include content that the user can provide. There are scenarios in the CMS where that content doesn't get correctly sanitised prior to being included in the form message, resulting in an XSS vulnerability. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/silverstripe/silverstripe-framework/commit/74904f539347b7d1f8c5b5fb9e28d62ff251ee00; https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-ff6q-3c9c-6cf5; https://www.silverstripe.org/download/security-releases/cve-2024-53277
CVE: CVE-2024-54142
Published: 2025-01-14
Description: Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox to said conversation. This issue has been addressed in commit `92f122c`. Users are advised to update. Users unable to update may remove all groups from `ai bot public sharing allowed groups` site setting.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/discourse/discourse-ai/commit/92f122c54d9d7ead9223a056270bff5b4c42c73f; https://github.com/discourse/discourse-ai/security/advisories/GHSA-94c2-qr2h-88jv
CVE: CVE-2024-54730
Published: 2025-01-14
Description: Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/Startr4ck/CVE_lists/blob/main/flatnotes/flatnotes%20webserver%20dos.md; https://github.com/dullage/flatnotes/issues/259
CVE: CVE-2024-57473
Published: 2025-01-14
Description: H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address editing function. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands by sending a POST request to /bin/webs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://h3c.com; https://gist.github.com/XiaoCurry/85ae28b7437d24d9c531c970612d3bd8
CVE: CVE-2024-57483
Published: 2025-01-14
Description: Tenda i24 V2.0.0.5 is vulnerable to Buffer Overflow in the addWifiMacFilter function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://tenda.com; https://gist.github.com/XiaoCurry/7dd5c6ab5af9df49883535b997cef7a4
CVE: CVE-2024-57757
Published: 2025-01-15
Description: JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKBM
CVE: CVE-2024-57760
Published: 2025-01-15
Description: JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IBFTVK
CVE: CVE-2024-57761
Published: 2025-01-15
Description: An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IBFTZ7
CVE: CVE-2024-57762
Published: 2025-01-15
Description: MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVAT
CVE: CVE-2024-57763
Published: 2025-01-15
Description: MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVFD
CVE: CVE-2024-57764
Published: 2025-01-15
Description: MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVCZ
CVE: CVE-2024-57765
Published: 2025-01-15
Description: MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVK9
CVE: CVE-2024-57766
Published: 2025-01-15
Description: MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVHR
CVE: CVE-2024-57767
Published: 2025-01-15
Description: MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVM9
CVE: CVE-2025-22996
Published: 2025-01-15
Description: A stored cross-site scripting (XSS) vulnerability in the spf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/SunnyYANGyaya/firmcrosser/blob/main/Linksys/E5600-2.md; https://github.com/SunnyYANGyaya/firmcrosser/blob/main/Linksys/E5600-2.md
CVE: CVE-2025-22997
Published: 2025-01-15
Description: A stored cross-site scripting (XSS) vulnerability in the prf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/SunnyYANGyaya/firmcrosser/blob/main/Linksys/E5600-1.md; https://github.com/SunnyYANGyaya/firmcrosser/blob/main/Linksys/E5600-1.md
CVE: CVE-2025-0343
Published: 2025-01-15
Description: Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes that certain objects can only be provided in either constructed or primitive forms, and will trigger a preconditionFailure if that constraint isn't met.

Importantly, these constraints are actually required to be true in DER, but that correctness wasn't enforced on the early node parser side so it was incorrect to rely on it later on in decoding, which is what the library did.

These crashes can be triggered when parsing any DER/BER format object. There is no memory-safety issue here: the crash is a graceful one from the Swift runtime. The impact of this is that it can be used as a denial-of-service vector when parsing BER/DER data from unknown sources, e.g. when parsing TLS certificates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-228
References: https://github.com/apple/swift-asn1/security/advisories/GHSA-w8xv-rwgf-4fwh
CVE: CVE-2024-13334
Published: 2025-01-15
Description: The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_condition' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/car-demon/trunk/search/search-form.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d50b1c0-9687-4ce2-bfba-c2d6a2fc28dd?source=cve
CVE: CVE-2025-23013
Published: 2025-01-15
Description: In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
CWE: CWE-394
References: https://www.yubico.com/support/security-advisories/ysa-2025-01/; http://www.openwall.com/lists/oss-security/2025/01/15/1; http://www.openwall.com/lists/oss-security/2025/01/16/2
CVE: CVE-2025-21101
Published: 2025-01-15
Description: Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability.
A local malicious user could potentially exploit this vulnerability during installation, leading to arbitrary folder or file deletion.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-362
References: https://www.dell.com/support/kbdoc/en-us/000267927/dsa-2025-033
CVE: CVE-2025-22394
Published: 2025-01-15
Description: Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to code execution and possibly privilege escalation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-367
References: https://www.dell.com/support/kbdoc/en-us/000267927/dsa-2025-033