deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54594
Published: 2025-08-06
Description: react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pull_request_target event trigger, which allowed for untrusted code from a forked pull request to be executed in a privileged context. An attacker could create a pull request containing a malicious preinstall script in the package.json file and then trigger the vulnerable workflow by posting a specific comment (!canary). This allowed for arbitrary code execution, leading to the exfiltration of sensitive secrets such as GITHUB_TOKEN and NPM_TOKEN, and could have allowed an attacker to push malicious code to the repository or publish compromised packages to the NPM registry. There is a remediation commit which removes github/workflows/release-canary.yml, but a version with this fix has yet to be released.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94, CWE-269
References: https://callstack.notion.site/Post-Incident-Security-Measures-GitHub-Actions-Workflow-Vulnerability-2405d027c0f8804ab7f7cdfb43366a31; https://github.com/callstackincubator/react-native-bottom-tabs/commit/9e1c9c61d742c435ac5e0901b7e0c9249b9fc70c; https://github.com/callstackincubator/react-native-bottom-tabs/security/advisories/GHSA-588g-38p4-gr6x
CVE: CVE-2025-54801
Published: 2025-08-06
Description: Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test[PII_REDACTED]3704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-789
References: https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef[PII_REDACTED]d; https://github.com/gofiber/fiber/security/advisories/GHSA-qx2q-88mx-vhg7; https://github.com/gofiber/fiber/security/advisories/GHSA-qx2q-88mx-vhg7
CVE: CVE-2025-54869
Published: 2025-08-06
Description: FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that uses FPDI to process user-supplied PDF files is at risk, causing a Denial of Service (DoS) vulnerability. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability. This issue is fixed in version 2.6.3.
CWE: CWE-770
References: https://github.com/Setasign/FPDI/commit/ba671ba9221cffd32c2dda87316c19f522a1c5f0; https://github.com/Setasign/FPDI/security/advisories/GHSA-jxhh-4648-vpp3
CVE: CVE-2025-54872
Published: 2025-08-06
Description: onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd89 contain a baked-in tor image if the secrets were copied from an existing onion domain. A website could be compromised if a user shared the baked-in image, or if someone were able to acquire access to the user's device outside of a containerized environment. This is fixed by commit bc9ba0fd.
CWE: CWE-798
References: https://github.com/Vessel9817/onion-site-template/commit/bc9ba0fd8cc7fbb3abc6759b351885a4501bce84; https://github.com/Vessel9817/onion-site-template/security/advisories/GHSA-mj8m-c8w9-rw55
CVE: CVE-2025-54873
Published: 2025-08-06
Description: RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0.0 through 2.1.0 and risc0-circuit-rv32im and risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 contain vulnerabilities where signed integer division allows multiple outputs for certain inputs with only one being valid, and division by zero results are underconstrained. This issue is fixed in risc0-zkvm version 2.2.0 and version 3.0.0 for the  risc0-circuit-rv32im and risc0-circuit-rv32im-sys packages.
CWE: CWE-369
References: https://github.com/risc0/risc0/pull/3235; https://github.com/risc0/risc0/security/advisories/GHSA-f6rc-24x4-ppxp; https://github.com/risc0/zirgen/pull/249
CVE: CVE-2025-54876
Published: 2025-08-06
Description: The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local cli_cmd.log file. This is fixed in the nightly prerelease.
CWE: CWE-522
References: https://github.com/JanssenProject/jans/commit/[PII_REDACTED]fe48b956e3140ca17b8ef7cac00a47; https://github.com/JanssenProject/jans/discussions/11886; https://github.com/JanssenProject/jans/pull/11903
CVE: CVE-2025-54879
Published: 2025-08-06
Description: Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/mastodon/mastodon/commit/e2592419d93fb41be03c2f3ff6a122fecb0e0952; https://github.com/mastodon/mastodon/releases/tag/v4.4.3; https://github.com/mastodon/mastodon/security/advisories/GHSA-84ch-6436-c7mg
CVE: CVE-2025-54883
Published: 2025-08-06
Description: Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the getSecureRandomInt function in security-kit versions prior to 3.5.0 (packaged in Vision-ui <= 1.4.0) contains a critical cryptographic weakness. Due to a silent 32-bit integer overflow in its internal masking logic, the function fails to produce a uniform distribution of random numbers when the requested range between min and max is larger than 2³². The root cause is the use of a 32-bit bitwise left-shift operation (<<) to generate a bitmask for the rejection sampling algorithm. This causes the mask to be incorrect for any range requiring 32 or more bits of entropy. This issue is fixed in version 1.5.0.
CWE: CWE-338
References: https://github.com/DavidOsipov/Vision-ui/commit/347355859f05e98047efbd96fc0e61b9191324f1; https://github.com/DavidOsipov/Vision-ui/security/advisories/GHSA-c9xg-x7h3-mq2q
CVE: CVE-2025-54884
Published: 2025-08-06
Description: Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the generateSecureId and getSecureRandomInt functions in security-kit versions prior to 3.5.0 (packaged in Vision UI 1.4.0 and below) are vulnerable to Denial of Service (DoS) attacks. The generateSecureId(length) function directly used the length parameter to size a Uint8Array buffer, allowing attackers to exhaust server memory through repeated requests for large IDs since the previous 1024 limit was insufficient. The getSecureRandomInt(min, max) function calculated buffer size based on the range between min and max, where large ranges caused excessive memory allocation and CPU-intensive rejection-sampling loops that could hang the thread. This issue is fixed in version 1.5.0.
CWE: CWE-400, CWE-770
References: https://github.com/DavidOsipov/Vision-ui/commit/74802cd688b661a35e638fc96938d65ca7c05ff5; https://github.com/DavidOsipov/Vision-ui/releases/tag/1.5.0; https://github.com/DavidOsipov/Vision-ui/security/advisories/GHSA-gg28-wc2c-jjj3
CVE: CVE-2025-54652
Published: 2025-08-06
Description: Path traversal vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualization module.
CVSS Score: 8.4 (HIGH)
CWE: CWE-22
References: https://consumer.huawei.com/cn/support/bulletinlaptops/2025/8/
CVE: CVE-2025-54653
Published: 2025-08-06
Description: Path traversal vulnerability in the virtualization file module. Successful exploitation of this vulnerability may affect the confidentiality of the virtualization file module.
CVSS Score: 8.4 (HIGH)
CWE: CWE-22
References: https://consumer.huawei.com/cn/support/bulletinlaptops/2025/8/
CVE: CVE-2025-54655
Published: 2025-08-06
Description: Race condition vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality and integrity of the virtualization graphics module.
CVSS Score: 8.1 (HIGH)
CWE: CWE-367
References: https://consumer.huawei.com/cn/support/bulletinlaptops/2025/8/
CVE: CVE-2025-54606
Published: 2025-08-06
Description: Status verification vulnerability in the lock screen module.
Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
CVSS Score: 7.3 (HIGH)
CWE: CWE-840
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54607
Published: 2025-08-06
Description: Authentication management vulnerability in the ArkWeb module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.7 (HIGH)
CWE: CWE-295
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54608
Published: 2025-08-06
Description: Vulnerability that allows setting screen rotation direction without permission verification in the screen management module.
Impact: Successful exploitation of this vulnerability may cause device screen orientation to be arbitrarily set.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264, CWE-862
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54609
Published: 2025-08-06
Description: Out-of-bounds access vulnerability in the audio codec module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54610
Published: 2025-08-06
Description: Out-of-bounds access vulnerability in the audio codec module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-129
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54611
Published: 2025-08-06
Description: EXTRA_REFERRER resource read vulnerability in the Gallery module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.3 (HIGH)
CWE: CWE-840
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54612
Published: 2025-08-06
Description: Iterator failure vulnerability in the card management module.
Impact: Successful exploitation of this vulnerability may affect function stability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-664
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54613
Published: 2025-08-06
Description: Iterator failure vulnerability in the card management module.
Impact: Successful exploitation of this vulnerability may affect function stability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-664
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54614
Published: 2025-08-06
Description: Input verification vulnerability in the home screen module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54615
Published: 2025-08-06
Description: Vulnerability of insufficient information protection in the media library module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54616
Published: 2025-08-06
Description: Out-of-bounds array access vulnerability in the ArkUI framework.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54617
Published: 2025-08-06
Description: Stack-based buffer overflow vulnerability in the dms_fwk module.
Impact: Successful exploitation of this vulnerability can cause RCE.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54618
Published: 2025-08-06
Description: Permission control vulnerability in the distributed clipboard module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-275, CWE-732
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54619
Published: 2025-08-06
Description: Iterator failure issue in the multi-mode input module.
Impact: Successful exploitation of this vulnerability may cause iterator failures and affect availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-664
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54620
Published: 2025-08-06
Description: Deserialization vulnerability of untrusted data in the ability module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54621
Published: 2025-08-06
Description: Iterator failure issue in the WantAgent module.
Impact: Successful exploitation of this vulnerability may cause memory release failures.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-664
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54622
Published: 2025-08-06
Description: Binding authentication bypass vulnerability in the devicemanager module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 8.3 (HIGH)
CWE: CWE-305
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-54623
Published: 2025-08-06
Description: Out-of-bounds read vulnerability in the devicemanager module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-680, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE: CVE-2025-6256
Published: 2025-08-06
Description: The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/flex-guten/trunk/build/blocks/dwp-latest-posts/render.php#L107; https://plugins.trac.wordpress.org/changeset/3340743/; https://wordpress.org/plugins/flex-guten/#developers
CVE: CVE-2025-6259
Published: 2025-08-06
Description: The esri-map-view plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's esri-map-view shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/esri-map-view/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/67001e61-c7f5-46bc-9d32-b121ce5d6fd5?source=cve
CVE: CVE-2025-6690
Published: 2025-08-06
Description: The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-tournament-registration/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/bf3c6dd5-498e-4aff-90fb-15ede66f5e3e?source=cve
CVE: CVE-2025-6986
Published: 2025-08-06
Description: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 6.4.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/filebird/trunk/includes/Controller/FolderController.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338922%40filebird&new=3338922%40filebird&sfp_email=&sfph_mail=#file11; https://www.wordfence.com/threat-intel/vulnerabilities/id/ce70da8e-7273-4eca-b187-2db7c36f1a50?source=cve
CVE: CVE-2025-7036
Published: 2025-08-06
Description: The CleverReach® WP plugin for WordPress is vulnerable to time-based SQL Injection via the ‘title’ parameter in all versions up to, and including, 1.5.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2025-49059 may be a duplicate of this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/cleverreach-wp/tags/1.5.20/Controllers/class-clever-reach-article-search-controller.php#L159; https://plugins.trac.wordpress.org/changeset/3340958/cleverreach-wp/trunk/Controllers/class-clever-reach-article-search-controller.php; https://wordpress.org/plugins/cleverreach-wp/#developers
CVE: CVE-2025-7502
Published: 2025-08-06
Description: The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and including, 8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://kb.wpbakery.com/docs/preface/release-notes/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c80143-c328-4cd1-95db-67de2edc058c?source=cve
CVE: CVE-2025-8628
Published: 2025-08-06
Description: Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26064.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-25-776/
CVE: CVE-2025-8629
Published: 2025-08-06
Description: Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26252.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-25-777/
CVE: CVE-2025-8630
Published: 2025-08-06
Description: Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26253.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-25-778/
CVE: CVE-2025-8631
Published: 2025-08-06
Description: Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26254.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-25-779/
CVE: CVE-2025-8632
Published: 2025-08-06
Description: Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26255.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-25-780/
CVE: CVE-2025-8633
Published: 2025-08-06
Description: Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26256.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-25-781/