deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-29980
Published: 2025-03-20
Description: A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.77. eTRAKiT.Net is no longer supported, and users are recommended to migrate to the latest version of CentralSquare Community Development.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/cisagov/CSAF/pull/182/files#diff[PII_REDACTED]1a59578b21f5e4b4b6be7b2a6267c5d0fe81eda2a849bf6915ed8d; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-079-01.json
CVE: CVE-2025-2557
Published: 2025-03-20
Description: A vulnerability, which was classified as critical, has been found in Audi UTR Dashcam 2.0. Affected by this issue is some unknown functionality of the component Command API. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 2.89 and 2.90 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about these issues and acted very professional. Version 2.89 is fixing this issue for new customers and 2.90 is going to fix it for existing customers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/geo-chen/Audi/blob/main/README.md#finding-4-execute-remote-commands; https://vuldb.com/?ctiid.300170; https://vuldb.com/?id.300170
CVE: CVE-2025-30160
Published: 2025-03-20
Description: Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore_preferences form. This leads to excessive memory consumption and potential system instability, which can be exploited to disrupt Redlib instances. This vulnerability is fixed in 0.36.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-502
References: https://github.com/redlib-org/redlib/commit/15147cea8e42f6569a11603d661d71122f6a02dc; https://github.com/redlib-org/redlib/commit/2e95e1fc6e2064ccfae87964b4860bda55eddb9a; https://github.com/redlib-org/redlib/security/advisories/GHSA-g8vq-v3mg-7mrg
CVE: CVE-2025-26852
Published: 2025-03-20
Description: DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.descor.com/prodotti/infocad; https://www.infocadfm.com/changelog/sql-injection/
CVE: CVE-2025-26853
Published: 2025-03-20
Description: DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-863, CWE-862
References: https://www.descor.com/prodotti/infocad; https://www.infocadfm.com/changelog/broken-authorization-schema/
CVE: CVE-2025-25758
Published: 2025-03-20
Description: An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://pastebin.com/0cb0KsGS; https://pastebin.com/0cb0KsGS
CVE: CVE-2025-2538
Published: 2025-03-20
Description: A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthenticated attacker to gain administrative access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://support.esri.com/en-us/patches-updates/2025/portal-for-arcgis-security-2025-update-3-patch
CVE: CVE-2025-2574
Published: 2025-03-20
Description: Out-of-bounds array write in Xpdf 4.05 and earlier, due to incorrect integer overflow checking in the PostScript function interpreter code.
CWE: CWE-190
References: https://www.xpdfreader.com/security-bug/CVE-2025-2574.html
CVE: CVE-2025-30334
Published: 2025-03-20
Description: In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-131
References: https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/015_wg.patch.sig; https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/006_wg.patch.sig; https://github.com/openbsd/src/commit/c[PII_REDACTED]4d958552a581d72b4c0f910e68d7c
CVE: CVE-2025-2198
Published: 2025-03-20
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-44199
Published: 2025-03-21
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.6. An app may be able to cause unexpected system termination or read kernel memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/120911
CVE: CVE-2024-44305
Published: 2025-03-21
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.6. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://support.apple.com/en-us/120911
CVE: CVE-2024-54551
Published: 2025-03-21
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing web content may lead to a denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120913
CVE: CVE-2024-54564
Published: 2025-03-21
Description: This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, visionOS 1.3. A file received from AirDrop may not have the quarantine flag applied.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120915
CVE: CVE-2023-28207
Published: 2025-03-21
Description: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A plug-in may be able to inherit app permissions and access user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-277
References: https://support.apple.com/en-us/102784; https://support.apple.com/en-us/102833; https://support.apple.com/en-us/120945
CVE: CVE-2025-29807
Published: 2025-03-21
Description: Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.
CVSS Score: 8.7 (HIGH)
CWE: CWE-94, CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29807
CVE: CVE-2025-29814
Published: 2025-03-21
Description: Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29814
CVE: CVE-2025-2585
Published: 2025-03-21
Description: EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10022-8e28e-2.html; https://www.twcert.org.tw/tw/cp-132-10021-8786e-1.html
CVE: CVE-2025-26336
Published: 2025-03-21
Description: Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40[PII_REDACTED]30302, and Dell Chassis Management Controller Firmware for Dell PowerEdge VRTX version(s) prior to 3.4[PII_REDACTED]00499, contain(s) a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
CVSS Score: 8.3 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000297463/dsa-2025-123-security-update-for-dell-chassis-management-controller-firmware-for-dell-poweredge-fx2-and-vrtx-vulnerabilities
CVE: CVE-2025-2581
Published: 2025-03-21
Description: A vulnerability has been found in xmedcon 0.25.0 and classified as problematic. Affected by this vulnerability is the function malloc of the component DICOM File Handler. The manipulation leads to integer underflow. The attack can be launched remotely. Upgrading to version 0.25.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189, CWE-191, CWE-191
References: https://vuldb.com/?ctiid.300541; https://vuldb.com/?id.300541; https://vuldb.com/?submit.522216
CVE: CVE-2024-50053
Published: 2025-03-21
Description: Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.manageengine.com/products/service-desk/CVE-2024-50053.html
CVE: CVE-2025-30342
Published: 2025-03-21
Description: An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly encoded when reflected; however, adding attributes to links is possible, which allows the injection of JavaScript via the onmouseover attribute and others. When a user moves the mouse over such a prepared link, JavaScript is executed in that user's session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides
CVE: CVE-2025-30343
Published: 2025-03-21
Description: A directory traversal issue was discovered in OpenSlides before 4.2.5. Files can be uploaded to OpenSlides meetings and organized in folders. The interface allows users to download a ZIP archive that contains all files in a folder and its subfolders. If an attacker specifies the title of a file or folder as a relative or absolute path (e.g., ../../../etc/passwd), the ZIP archive generated for download converts that title into a path. Depending on the extraction tool used by the user, this might overwrite files locally outside of the chosen directory.
CVSS Score: 3.0 (LOW)
CWE: CWE-24, CWE-22
References: https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides
CVE: CVE-2025-30344
Published: 2025-03-21
Description: An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a user exists in the system. The timing discrepancy stems from the omitted hashing of the password (e.g., more than 100 milliseconds).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-208, CWE-203
References: https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides
CVE: CVE-2025-30345
Published: 2025-03-21
Description: An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when deleting chats or deleting messages in these chats. This potentially allows attackers to interfere with the layout of the rendered website, but it is unlikely that victims would click on deleted chats or deleted messages.
CVSS Score: 3.5 (LOW)
CWE: CWE-116, CWE-79
References: https://www.x41-dsec.de/lab/advisories/x41-2025-001-OpenSlides
CVE: CVE-2024-13903
Published: 2025-03-21
Description: A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JS_GetRuntime of the file quickjs.c of the component qjs. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. Upgrading to version 0.9.0 is able to address this issue. The patch is named 99c02eb45170775a9a679c32b45dd4000ea67aff. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/quickjs-ng/quickjs/commit/99c02eb45170775a9a679c32b45dd4000ea67aff; https://github.com/quickjs-ng/quickjs/issues/775; https://github.com/quickjs-ng/quickjs/releases/tag/v0.9.0
CVE: CVE-2025-2582
Published: 2025-03-21
Description: A vulnerability was found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the file ManageAttachments.php. The manipulation of the argument Notice leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a security vulnerability due to authentication requirements before being able to access any feature in the software that allows file modification.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Fewword/Poc/blob/main/smf/smf-poc3.md; https://github.com/Fewword/Poc/blob/main/smf/smf-poc4.md; https://vuldb.com/?ctiid.300542
CVE: CVE-2025-2583
Published: 2025-03-21
Description: A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The manipulation of the argument subject/message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a security vulnerability due to authentication requirements before being able to access any feature in the software that allows file modification.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Fewword/Poc/blob/main/smf/smf-poc5.md; https://github.com/Fewword/Poc/blob/main/smf/smf-poc6.md; https://vuldb.com/?ctiid.300543
CVE: CVE-2025-30346
Published: 2025-03-21
Description: Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://varnish-cache.org/security/VSV00015.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html
CVE: CVE-2025-30347
Published: 2025-03-21
Description: Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stevedore objects.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://docs.varnish-software.com/security/VEV00001/
CVE: CVE-2025-30348
Published: 2025-03-21
Description: encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-407, CWE-407
References: https://codereview.qt-project.org/c/qt/qtbase/+/581442
CVE: CVE-2025-2584
Published: 2025-03-21
Description: A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/WebAssembly/wabt/issues/2557; https://github.com/WebAssembly/wabt/issues/2557#issue[PII_REDACTED]; https://vuldb.com/?ctiid.300544
CVE: CVE-2025-24920
Published: 2025-03-21
Description: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-25068
Published: 2025-03-21
Description: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://mattermost.com/security-updates
CVE: CVE-2025-25274
Published: 2025-03-21
Description: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-77
References: https://mattermost.com/security-updates
CVE: CVE-2025-27715
Published: 2025-03-21
Description: Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.
CVSS Score: 3.3 (LOW)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-27933
Published: 2025-03-21
Description: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-30179
Published: 2025-03-21
Description: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-2587
Published: 2025-03-21
Description: A vulnerability, which was classified as critical, was found in Jinher OA C6 1.0. This affects an unknown part of the file IncentivePlanFulfillAppprove.aspx. The manipulation of the argument httpOID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E; https://vuldb.com/?ctiid.300567; https://vuldb.com/?id.300567
CVE: CVE-2025-2588
Published: 2025-03-21
Description: A vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the file src/fa.c. The manipulation of the argument re leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://github.com/hercules-team/augeas/issues/852; https://github.com/hercules-team/augeas/issues/852#issue[PII_REDACTED]; https://vuldb.com/?ctiid.300568
CVE: CVE-2025-2597
Published: 2025-03-21
Description: Reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies. This vulnerability could allow an attacker to execute malicious Javascript code via GET and POST requests to the ‘/index.php’ endpoint and injecting code into the ‘id_session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-vulnerability-itium-6050
CVE: CVE-2025-2589
Published: 2025-03-21
Description: A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file \handler\Account.go. The manipulation of the argument user_cookie leads to improper authorization. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-266, CWE-285, CWE-862
References: https://code-projects.org/; https://github.com/38279/1/issues/1; https://vuldb.com/?ctiid.300569
CVE: CVE-2025-2590
Published: 2025-03-21
Description: A vulnerability was found in code-projects Human Resource Management System 1.0.1. It has been classified as problematic. Affected is the function UpdateRecruitmentById of the file \handler\recruitment.go. The manipulation of the argument c leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/38279/1/issues/2; https://vuldb.com/?ctiid.300570
CVE: CVE-2024-57490
Published: 2025-03-21
Description: Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system account including the system administrator through a logical flaw.
CVSS Score: 7.7 (HIGH)
CWE: CWE-287
References: https://gist.github.com/NaliangzzZ/44bfcc1d9c2cf275d2b6683ca9e20980; https://www.ioffice.cn
CVE: CVE-2025-2591
Published: 2025-03-21
Description: A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-369, CWE-404
References: https://github.com/assimp/assimp/issues/6009; https://github.com/assimp/assimp/issues/6009#issue[PII_REDACTED]; https://github.com/assimp/assimp/pull/6047
CVE: CVE-2025-2592
Published: 2025-03-21
Description: A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/assimp/assimp/commit/2690e354da0c681db000cfd892a55226788f2743; https://github.com/assimp/assimp/issues/6010; https://github.com/assimp/assimp/issues/6010#issue[PII_REDACTED]
CVE: CVE-2021-25635
Published: 2025-03-21
Description: An Improper Certificate Validation vulnerability in LibreOffice allowed 
an attacker to self sign an ODF document, with a signature untrusted by 
the target, then modify it to change the signature algorithm to an 
invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a 
valid signature issued by a trusted person


This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-295
References: https://www.libreoffice.org/about-us/security/advisories/cve-2021-25635/
CVE: CVE-2025-24915
Published: 2025-03-21
Description: When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-directories.  This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.tenable.com/security/tns-2025-02