deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-29311
Published: 2025-03-24
Description: Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage this vulnerability into creating crafted LLDP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331
References: https://gist.github.com/Saber-Berserker/790f2a75ae482df3fd0fce569f30504a;
CVE: CVE-2025-29312
Published: 2025-03-24
Description: An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect to direct.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-670
References: https://gist.github.com/Saber-Berserker/4e54c2aa70abab2b133ce2c2b7e91249; https://gist.github.com/Saber-Berserker/4e54c2aa70abab2b133ce2c2b7e91249
CVE: CVE-2025-29313
Published: 2025-03-24
Description: Use of incorrectly resolved name or reference in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://blog.csdn.net/weixin_43959580/article/details/146018191
CVE: CVE-2025-29314
Published: 2025-03-24
Description: Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to access sensitive information via a man-in-the-middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311
References: https://blog.csdn.net/weixin_43959580/article/details/146018166; https://blog.csdn.net/weixin_43959580/article/details/146018166
CVE: CVE-2025-29315
Published: 2025-03-24
Description: An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attackers to execute privileged operations via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://blog.csdn.net/weixin_43959580/article/details/144794289; https://blog.csdn.net/weixin_43959580/article/details/144794289
CVE: CVE-2025-2710
Published: 2025-03-24
Description: A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This issue affects some unknown processing of the file /menu.jsp. The manipulation of the argument flag leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/Hebing123/cve/issues/85; https://vuldb.com/?ctiid.300731; https://vuldb.com/?id.300731
CVE: CVE-2025-2711
Published: 2025-03-24
Description: A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been classified as problematic. Affected is an unknown function of the file /help/systop.jsp. The manipulation of the argument langcode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/86; https://vuldb.com/?ctiid.300732; https://vuldb.com/?id.300732
CVE: CVE-2025-26512
Published: 2025-03-24
Description: SnapCenter versions prior to 
6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an 
authenticated SnapCenter Server user to become an admin user on a remote
 system where a SnapCenter plug-in has been installed.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-266
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-2712
Published: 2025-03-24
Description: A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/Hebing123/cve/issues/86; https://vuldb.com/?ctiid.300733; https://vuldb.com/?id.300733
CVE: CVE-2025-2714
Published: 2025-03-24
Description: A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /extensions/realestate/index.php/agents/agent-register/addagent. The manipulation of the argument plan_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.300734; https://vuldb.com/?id.300734; https://vuldb.com/?submit.517638
CVE: CVE-2025-2715
Published: 2025-03-24
Description: A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatch_Invoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/janssensjelle/published-pocs/blob/main/weberp-xss-confirm-dispatch.md; https://vuldb.com/?ctiid.300735; https://vuldb.com/?id.300735
CVE: CVE-2025-2716
Published: 2025-03-24
Description: A vulnerability classified as problematic was found in China Mobile P22g-CIac 1.0.00.488. This vulnerability affects unknown code of the component Samba Path Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: https://github.com/rookiiiiiiie/China-Mobile-Internet-of-Things-Co.-Ltd./blob/main/Issues.md; https://vuldb.com/?ctiid.300736; https://vuldb.com/?id.300736
CVE: CVE-2025-1097
Published: 2025-03-25
Description: A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/kubernetes/kubernetes/issues/131007; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.exploit-db.com/exploits/52475
CVE: CVE-2025-1098
Published: 2025-03-25
Description: A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/kubernetes/kubernetes/issues/131008; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.exploit-db.com/exploits/52475
CVE: CVE-2025-1974
Published: 2025-03-25
Description: A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-653
References: https://https://github.com/kubernetes/kubernetes/issues/131009; https://github.com/B1ack4sh/Blackash-CVE-2025-1974; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-24513
Published: 2025-03-25
Description: A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20
References: https://github.com/kubernetes/kubernetes/issues/131005; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-24514
Published: 2025-03-25
Description: A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/kubernetes/kubernetes/issues/131006; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.exploit-db.com/exploits/52475
CVE: CVE-2025-2717
Published: 2025-03-25
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub_41710C of the file /goform/diag_nslookup of the component HTTP POST Request Handler. The manipulation of the argument target_addr leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/mono7s/Dir-823x/blob/main/diag_nslookup/diag_nslookup.md; https://vuldb.com/?ctiid.300737; https://vuldb.com/?id.300737
CVE: CVE-2025-2720
Published: 2025-03-25
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: According to the code maintainer the call of the POC is invalid because the buffer pointed to by "data" must have "len" valid bytes. The docs were updated to make that clear.
CVE: CVE-2025-2721
Published: 2025-03-25
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "[the] call is invalid [as] the buffer pointed to by "data" must have "len" valid bytes." The documentation was fixed to make that clear.
CVE: CVE-2025-2722
Published: 2025-03-25
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "[the] call is invalid [because] p_n_param is an input-output parameter indicating how big an array has already been allocated.
CVE: CVE-2025-2723
Published: 2025-03-25
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "[the] call is invalid [as] the buffer pointed to by "data" must have "len" valid bytes." The documentation was fixed to make that clear.
CVE: CVE-2025-2724
Published: 2025-03-25
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "the only way to get an object of type GsfMSOleSortingKey is via gsf_msole_sorting_key_new which adds that extra zero element".
CVE: CVE-2025-2725
Published: 2025-03-25
Description: A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md; https://vuldb.com/?ctiid.300745; https://vuldb.com/?id.300745
CVE: CVE-2025-2726
Published: 2025-03-25
Description: A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this issue is some unknown functionality of the file /api/esps of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_2.md; https://vuldb.com/?ctiid.300746; https://vuldb.com/?id.300746
CVE: CVE-2025-2727
Published: 2025-03-25
Description: A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/ggstrunk/CVE/blob/main/wizard_getNetworkStatus.md; https://vuldb.com/?ctiid.300747; https://vuldb.com/?id.300747
CVE: CVE-2025-2728
Published: 2025-03-25
Description: A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the file /api/wizard/getNetworkConf. The manipulation leads to command injection. The attack needs to be approached within the local network. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/RK1Y8/cve_cve/blob/main/h3c.md; https://vuldb.com/?ctiid.300748; https://vuldb.com/?id.300748
CVE: CVE-2025-2729
Published: 2025-03-25
Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_1.md; https://vuldb.com/?ctiid.300749; https://vuldb.com/?id.300749
CVE: CVE-2025-2730
Published: 2025-03-25
Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_2.md; https://vuldb.com/?ctiid.300750; https://vuldb.com/?id.300750
CVE: CVE-2025-2731
Published: 2025-03-25
Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/wizard/getDualbandSync of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_3.md; https://vuldb.com/?ctiid.300751; https://vuldb.com/?id.300751
CVE: CVE-2025-2732
Published: 2025-03-25
Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/wizard/getWifiNeighbour of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_4.md; https://vuldb.com/?ctiid.300752; https://vuldb.com/?id.300752
CVE: CVE-2024-10206
Published: 2025-03-25
Description: A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force the web server to request arbitrary URLs.
CWE: CWE-918
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-10207
Published: 2025-03-25
Description: A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the web server to request arbitrary URLs.
CWE: CWE-918
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-10208
Published: 2025-03-25
Description: An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user’s browser session.
CWE: CWE-79
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-10209
Published: 2025-03-25
Description: An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker to read and alter the configuration of another engineering or runtime user.
CWE: CWE-732
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-45480
Published: 2025-03-25
Description: An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system.
CWE: CWE-94
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-45481
Published: 2025-03-25
Description: An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to authenticate as another legitimate user.
CWE: CWE-791
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-45482
Published: 2025-03-25
Description: An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands.
CWE: CWE-829
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-45483
Published: 2025-03-25
Description: A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical attacker to alter the boot configuration of the operating system.
CWE: CWE-306
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-45484
Published: 2025-03-25
Description: An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an unauthenticated adjacent attacker to per-form Denial-of-Service (DoS) attacks against the product.
CWE: CWE-770
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-8313
Published: 2025-03-25
Description: An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMP component of B&R APROL <4.4-00P5 may allow an unauthenticated adjacent-based attacker to read and alter configuration using SNMP.
CWE: CWE-497, CWE-1188
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-8314
Published: 2025-03-25
Description: An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL <4.4-00P5 may allow an authenticated network attacker to take over a currently active user session without login credentials.
CWE: CWE-303, CWE-488
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2024-8315
Published: 2025-03-25
Description: An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker to read credential information.
CWE: CWE-280
References: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf
CVE: CVE-2025-2733
Published: 2025-03-25
Description: A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://magnificent-dill-351.notion.site/Command-Execution-in-Openmanus-2025-3-13-1b6c693918ed80b2826ef6bb385693fa; https://vuldb.com/?ctiid.300753; https://vuldb.com/?id.300753
CVE: CVE-2025-2734
Published: 2025-03-25
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/0xabandon/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.300756