deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-53266
Published: 2025-02-04
Description: Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/discourse/discourse/security/advisories/GHSA-hw4j-4hg7-22h2
CVE: CVE-2024-53851
Published: 2025-02-04
Description: Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs wasn't enforcing limits on the number of URLs that it accepted, allowing a malicious user to inflict denial of service on some parts of the app. This vulnerability is only exploitable by authenticated users. This issue has been patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. Users unable to upgrade should turn off the `enable inline onebox on all domains` site setting and remove all entries from the `allowed inline onebox domains` site setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/discourse/discourse/commit/416ec83ae57924d721e6e374f4cda78bd77a4599; https://github.com/discourse/discourse/security/advisories/GHSA-49rv-574x-wgpc
CVE: CVE-2024-53994
Published: 2025-02-04
Description: Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be reachable in some cases. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable the chat plugin within site settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-281
References: https://github.com/discourse/discourse/security/advisories/GHSA-mrpw-gwj7-98r6
CVE: CVE-2024-8125
Published: 2025-02-04
Description: Improper Validation of Specified Type of Input vulnerability in OpenText™ Content Management (Extended ECM) allows Parameter Injection. 

A bad actor with the required OpenText Content Management privileges (not root) could expose
the vulnerability to carry out a remote code execution attack on the target system.

This issue affects Content Management (Extended ECM): from 10.0 through 24.4 

 with WebReports module
installed and enabled.
CWE: CWE-1287
References: https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0834058
CVE: CVE-2023-39943
Published: 2025-02-04
Description: In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03
CVE: CVE-2023-40222
Published: 2025-02-04
Description: In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing CO files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03
CVE: CVE-2024-11467
Published: 2025-02-04
Description: Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successful exploitation of this issue may allow attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is installed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://static.omnissa.com/sites/default/files/OMSA-2024-0002.pdf; https://www.omnissa.com/omnissa-security-response/
CVE: CVE-2024-11468
Published: 2025-02-04
Description: Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process. Successful exploitation of this issue may allow attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is installed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://static.omnissa.com/sites/default/files/OMSA-2024-0002.pdf; https://www.omnissa.com/omnissa-security-response/
CVE: CVE-2024-48445
Published: 2025-02-04
Description: An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://packetstorm.news/files/id/188996/; https://packetstorm.news/files/id/188996/
CVE: CVE-2024-53962
Published: 2025-02-05
Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE: CVE-2024-53963
Published: 2025-02-05
Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated link or input data into a vulnerable page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE: CVE-2024-53964
Published: 2025-02-05
Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE: CVE-2024-53965
Published: 2025-02-05
Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated link or input data into a vulnerable page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE: CVE-2024-53966
Published: 2025-02-05
Description: Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html
CVE: CVE-2025-0413
Published: 2025-02-05
Description: Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. 
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Technical Data Reporter component. By creating a symbolic link, an attacker can abuse the service to change the permissions of arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-25014.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://kb.parallels.com/130212; https://www.zerodayinitiative.com/advisories/ZDI-25-082/
CVE: CVE-2025-23114
Published: 2025-02-05
Description: A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-295
References: https://www.veeam.com/kb4712
CVE: CVE-2025-1028
Published: 2025-02-05
Description: The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to, and including, 8.6.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in specific configurations where the first extension is processed over the final. This vulnerability also requires successfully exploiting a race condition in order to exploit.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset?old_path=/contact-manager/tags/8.6.4&new_path=/contact-manager/tags/8.6.5&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f51a8e-4a59-4b64-b0c6-2ce3933a1df5?source=cve
CVE: CVE-2025-1022
Published: 2025-02-05
Description: Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341; https://github.com/spatie/browsershot/commit/bcfd608b264fab654bf78e199bdfbb03e9323eb7; https://github.com/spatie/browsershot/commit/e[PII_REDACTED]865a24fbb5b65b534d8d4b8dfbf72
CVE: CVE-2025-1025
Published: 2025-02-05
Description: Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://gist.github.com/CHOOCS/fe[PII_REDACTED]d5d74c33982814f290af; https://github.com/Cockpit-HQ/Cockpit/commit/984ef9ad270357b843af63c81db95178eae42cae; https://github.com/Cockpit-HQ/Cockpit/commit/becca806c7071ecc732521bb5ad0bb9c64299592
CVE: CVE-2025-1026
Published: 2025-02-05
Description: Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files.**Note:**This is a bypass of the fix for [CVE-2024-21549](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023).
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://gist.github.com/chuajianshen/[PII_REDACTED]fcf1543fa7b43862112be6; https://gist.github.com/mrdgef/54a[PII_REDACTED]c67c1b859df38a52d65; https://github.com/spatie/browsershot/commit/e[PII_REDACTED]865a24fbb5b65b534d8d4b8dfbf72
CVE: CVE-2025-25246
Published: 2025-02-05
Description: NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://kb.netgear.com/000066558/Security-Advisory-for-Unauthenticated-RCE-on-Some-WiFi-Routers-PSV-2023-0039
CVE: CVE-2024-13829
Published: 2025-02-05
Description: The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.0.8 via the 'attachments.php' file. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via forms.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/attachments.php; https://plugins.trac.wordpress.org/changeset/3231968/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a938042-bad6-4fe0-8905-148d07a22996?source=cve
CVE: CVE-2023-52924
Published: 2025-02-05
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: don't skip expired elements during walk

There is an asymmetry between commit/abort and preparation phase if the
following conditions are met:

1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled

In this case, following sequence is problematic:

1. element E in set S refers to chain C
2. userspace requests removal of set S
3. kernel does a set walk to decrement chain->use count for all elements
   from preparation phase
4. kernel does another set walk to remove elements from the commit phase
   (or another walk to do a chain->use increment for all elements from
    abort phase)

If E has already expired in 1), it will be ignored during list walk, so its use count
won't have been changed.

Then, when set is culled, ->destroy callback will zap the element via
nf_tables_set_elem_destroy(), but this function is only safe for
elements that have been deactivated earlier from the preparation phase:
lack of earlier deactivate removes the element but leaks the chain use
count, which results in a WARN splat when the chain gets removed later,
plus a leak of the nft_chain structure.

Update pipapo_get() not to skip expired elements, otherwise flush
command reports bogus ENOENT errors.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1da4874d05da1526b11b82fc7f3c7ac38749ddf8; https://git.kernel.org/stable/c/24138933b97b055d486e8064b4a[PII_REDACTED]a9b; https://git.kernel.org/stable/c/59dab3bf0b8fc08eb802721c0532f13dd89209b8
CVE: CVE-2023-52925
Published: 2025-02-05
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: don't fail inserts if duplicate has expired

nftables selftests fail:
run-tests.sh testcases/sets/0044interval_overlap_0
Expected: 0-2 . 0-3, got:
W: [FAILED]     ./testcases/sets/0044interval_overlap_0: got 1

Insertion must ignore duplicate but expired entries.

Moreover, there is a strange asymmetry in nft_pipapo_activate:

It refetches the current element, whereas the other ->activate callbacks
(bitmap, hash, rhash, rbtree) use elem->priv.
Same for .remove: other set implementations take elem->priv,
nft_pipapo_remove fetches elem->priv, then does a relookup,
remove this.

I suspect this was the reason for the change that prompted the
removal of the expired check in pipapo_get() in the first place,
but skipping exired elements there makes no sense to me, this helper
is used for normal get requests, insertions (duplicate check)
and deactivate callback.

In first two cases expired elements must be skipped.

For ->deactivate(), this gets called for DELSETELEM, so it
seems to me that expired elements should be skipped as well, i.e.
delete request should fail with -ENOENT error.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/156369a702c33ad5434a19c3a689bfb836d4e0b8; https://git.kernel.org/stable/c/59ee68c437c[PII_REDACTED]94a99698c805a686bb3; https://git.kernel.org/stable/c/7845914f45f066497ac75b30c50dbc735e84e884
CVE: CVE-2023-6386
Published: 2025-02-05
Description: A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/433147; https://hackerone.com/reports/2261581
CVE: CVE-2024-1539
Published: 2025-02-05
Description: An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/442049; https://hackerone.com/reports/2369988
CVE: CVE-2024-6356
Published: 2025-02-05
Description: An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-286
References: https://gitlab.com/gitlab-org/gitlab/-/issues/469108; https://hackerone.com/reports/2575051
CVE: CVE-2025-0167
Published: 2025-02-05
Description: When asked to use a `.netrc` file for credentials **and** to follow HTTP
redirects, curl could leak the password used for the first host to the
followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has a `default` entry that
omits both login and password. A rare circumstance.
CVSS Score: 3.4 (LOW)
References: https://curl.se/docs/CVE-2025-0167.html; https://curl.se/docs/CVE-2025-0167.json; https://hackerone.com/reports/2917232
CVE: CVE-2025-0665
Published: 2025-02-05
Description: libcurl would wrongly close the same eventfd file descriptor twice when taking
down a connection channel after having completed a threaded name resolve.
CVSS Score: 7.0 (HIGH)
References: https://curl.se/docs/CVE-2025-0665.html; https://curl.se/docs/CVE-2025-0665.json; https://hackerone.com/reports/2954286
CVE: CVE-2025-0725
Published: 2025-02-05
Description: When libcurl is asked to perform automatic gzip decompression of
content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would
make libcurl perform a buffer overflow.
CVSS Score: 7.3 (HIGH)
CWE: CWE-120
References: https://curl.se/docs/CVE-2025-0725.html; https://curl.se/docs/CVE-2025-0725.json; https://hackerone.com/reports/2956023
CVE: CVE-2024-49352
Published: 2025-02-05
Description: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://www.ibm.com/support/pages/node/7181480
CVE: CVE-2024-5528
Published: 2025-02-05
Description: An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows a subdomain takeover in GitLab Pages.
CVSS Score: 3.5 (LOW)
CWE: CWE-1023, CWE-697
References: https://gitlab.com/gitlab-org/gitlab/-/issues/464558; https://hackerone.com/reports/2523654; https://about.gitlab.com/releases/2024/07/10/patch-release-gitlab-17-1-2-released/
CVE: CVE-2024-9631
Published: 2025-02-05
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407, CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/480867; https://hackerone.com/reports/2650086; https://gitlab.com/gitlab-org/gitlab/-/issues/480867
CVE: CVE-2024-3976
Published: 2025-02-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to unauthorised instance users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/457140; https://hackerone.com/reports/2470939; https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/
CVE: CVE-2024-49348
Published: 2025-02-05
Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 



allows restricting access to organizational data to valid contexts. The fact that tasks of type comment can be reassigned via API implicitly grants access to user queries in an unexpected context.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266
References: https://www.ibm.com/support/pages/node/7182403
CVE: CVE-2024-52364
Published: 2025-02-05
Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7182403
CVE: CVE-2024-52365
Published: 2025-02-05
Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 

is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7182403
CVE: CVE-2024-2878
Published: 2025-02-05
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/451918; https://hackerone.com/reports/2416356; https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/
CVE: CVE-2024-9097
Published: 2025-02-05
Description: ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat.
CVSS Score: 3.5 (LOW)
CWE: CWE-639
References: https://www.manageengine.com/products/desktop-central/cve-2024-9097.html
CVE: CVE-2025-21117
Published: 2025-02-05
Description: Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vulnerability, leading to fully impersonating the user.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-672
References: https://www.dell.com/support/kbdoc/en-us/000281275/dsa-2025-071-security-update-for-dell-avamar-for-multiple-component-vulnerabilities
CVE: CVE-2025-0858
Published: 2025-02-05
Description: A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in certain Poly devices. The firmware flaw does not properly prevent path traversal and could lead to information disclosure.
CWE: CWE-35
References: https://support.hp.com/us-en/document/ish_1[PII_REDACTED]6148-16/hpsbpy03996