deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-36613
Published: 2025-08-14
Description: SupportAssist for Home PCs versions 4.6.3 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.
CVSS Score: 2.8 (LOW)
CWE: CWE-266
References: https://www.dell.com/support/kbdoc/en-us/000356690/dsa-2025-296-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities
CVE: CVE-2025-38738
Published: 2025-08-14
Description: SupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in the Installer. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-266
References: https://www.dell.com/support/kbdoc/en-us/000356690/dsa-2025-296-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities
CVE: CVE-2025-38745
Published: 2025-08-14
Description: Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Restore. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000356351/dsa-2025-314-security-update-for-dell-openmanage-enterprise-vulnerability
CVE: CVE-2025-40758
Published: 2025-08-14
Description: A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.
CVSS Score: 8.7 (HIGH)
CWE: CWE-347
References: https://cert-portal.siemens.com/productcert/html/ssa-395458.html
CVE: CVE-2025-43983
Published: 2025-08-14
Description: KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/goform_get_cmd_process. These allow an unauthenticated attacker to retrieve sensitive information (including the device admin username and password), modify critical device settings, and send arbitrary SMS messages.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://drive.proton.me/urls/CN629YJ3F4#NUgX6IB4clos; https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43983.txt; https://github.com/actuator/cve/tree/main/KuWfi
CVE: CVE-2025-7971
Published: 2025-08-14
Description: A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash.
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1734.html
CVE: CVE-2025-7972
Published: 2025-08-14
Description: A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-286
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1735.html
CVE: CVE-2025-8875
Published: 2025-08-14
Description: Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8875
CVE: CVE-2025-8876
Published: 2025-08-14
Description: Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-78
References: https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8876
CVE: CVE-2025-8962
Published: 2025-08-14
Description: A vulnerability was found in code-projects Hostel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file hostel_manage.exe of the component Login Form. The manipulation of the argument uname leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121
References: https://code-projects.org/; https://vuldb.com/?ctiid.319957; https://vuldb.com/?id.319957
CVE: CVE-2025-8964
Published: 2025-08-14
Description: A vulnerability was identified in code-projects Hostel Management System 1.0. This affects an unknown part of the file hostel_manage.exe of the component Login. The manipulation leads to improper authentication. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://code-projects.org/; https://vuldb.com/?ctiid.319959; https://vuldb.com/?id.319959
CVE: CVE-2025-9041
Published: 2025-08-14
Description: A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle.
CWE: CWE-1287
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1737.html
CVE: CVE-2025-9042
Published: 2025-08-14
Description: A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle.
CWE: CWE-1287
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1737.html
CVE: CVE-2023-43694
Published: 2025-08-14
Description: An issue was discovered in Malwarebytes 4.6.14.326 and before and 5.1.5.116 and before (and Nebula 2020-10-21 and later). An Out of bounds read in several disassembling utilities causes stability issues and denial of service.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-125
References: https://www.malwarebytes.com/secure/cves/cve-2023-43694
CVE: CVE-2025-33142
Published: 2025-08-14
Description: IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://www.ibm.com/support/pages/node/7242172
CVE: CVE-2025-36047
Published: 2025-08-14
Description: IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7242086; https://www.kb.cert.org/vuls/id/767506
CVE: CVE-2025-50518
Published: 2025-08-14
Description: A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library. This issue occurs due to improper handling of memory after the freeing of a PDU object, leading to potential memory corruption or the possibility of executing arbitrary code. NOTE: this is disputed by the Supplier because it only occurs when an application uses libcoap incorrectly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/IreneTheITCrowd/blog/blob/main/libcoap-vulnerability.md; https://github.com/IreneTheITCrowd/blog/issues/1; https://github.com/obgm/libcoap/issues/1724#issuecomment[PII_REDACTED]
CVE: CVE-2025-53631
Published: 2025-08-14
Description: flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution (XSS) on all pages the post is reflected on including /, /post/[ID], /admin/posts, and /user/[ID] of the user that made the post. At time of publication, there are no public patches available.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/DogukanUrker/flaskBlog/security/advisories/GHSA-cj43-h8qf-7rw7
CVE: CVE-2025-54389
Published: 2025-08-14
Description: AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE.  An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-117
References: https://github.com/aide/aide/commit/64c8f32b0349c33fb8382784af[PII_REDACTED]51f9; https://github.com/aide/aide/releases/tag/v0.19.2; https://github.com/aide/aide/security/advisories/GHSA-522j-vvx9-gg28
CVE: CVE-2025-54409
Published: 2025-08-14
Description: AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a; https://github.com/aide/aide/releases/tag/v0.19.2; https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh
CVE: CVE-2025-54867
Published: 2025-08-14
Description: Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.
CVSS Score: 7.0 (HIGH)
CWE: CWE-61
References: https://github.com/youki-dev/youki/commit/0d9b4f2aa5ceaf988f3eb568711d2acf0a4ace37; https://github.com/youki-dev/youki/releases/tag/v0.5.5; https://github.com/youki-dev/youki/security/advisories/GHSA-j26p-6wx7-f3pw
CVE: CVE-2025-8965
Published: 2025-08-14
Description: A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminStorageController.java of the component Endpoint. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/linlinjava/litemall/issues/565; https://github.com/linlinjava/litemall/issues/565#issue[PII_REDACTED]; https://vuldb.com/?ctiid.319960
CVE: CVE-2025-8966
Published: 2025-08-14
Description: A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/tax.php. The manipulation of the argument tname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/37; https://itsourcecode.com/; https://vuldb.com/?ctiid.319961
CVE: CVE-2025-8967
Published: 2025-08-14
Description: A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/operations/packages.php. The manipulation of the argument pname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/36; https://itsourcecode.com/; https://vuldb.com/?ctiid.319962
CVE: CVE-2023-43683
Published: 2025-08-14
Description: An issue was discovered in Malwarebytes 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). A Stack buffer out-of-bounds access exists because of an integer underflow when handling newline characters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-125
References: https://www.malwarebytes.com/secure/cves/cve-2023-43683
CVE: CVE-2023-43692
Published: 2025-08-14
Description: An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). Out-of-bound reads in strings detection utilities lead to system crashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.malwarebytes.com/secure/cves/cve-2023-43692
CVE: CVE-2025-20127
Published: 2025-08-14
Description: A vulnerability in the TLS 1.3 implementation for a specific cipher for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Firepower 3100 and 4200 Series devices could allow an authenticated, remote attacker to consume resources that are associated with incoming TLS 1.3 connections, which eventually could cause the device to stop accepting any new SSL/TLS or VPN requests.

This vulnerability is due to the implementation of the TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. An attacker could exploit this vulnerability by sending a large number of TLS 1.3 connections with the specific TLS 1.3 Cipher TLS_CHACHA20_POLY1305_SHA256. A successful exploit could allow the attacker to cause a denial of service (DoS) condition where no new incoming encrypted connections are accepted. The device must be reloaded to clear this condition.
Note: These incoming TLS 1.3 connections include both data traffic and user-management traffic. After the device is in the vulnerable state, no new encrypted connections can be accepted.
CVSS Score: 7.7 (HIGH)
CWE: CWE-404
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-3100_4200_tlsdos-2yNSCd54
CVE: CVE-2025-20133
Published: 2025-08-14
Description: A vulnerability in the management and VPN web servers of the Remote Access SSL VPN feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly stop responding, resulting in a DoS condition.

This vulnerability is due to ineffective validation of user-supplied input during the Remote Access SSL VPN authentication process. An attacker could exploit this vulnerability by sending a crafted request to the VPN service on an affected device. A successful exploit could allow the attacker to cause a DoS condition where the device stops responding to Remote Access SSL VPN authentication requests.
CVSS Score: 8.6 (HIGH)
CWE: CWE-401
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-mfPekA6e
CVE: CVE-2025-20134
Published: 2025-08-14
Description: A vulnerability in the certificate processing of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to improper parsing of SSL/TLS certificates. An attacker could exploit this vulnerability by sending crafted DNS packets that match a static Network Address Translation (NAT) rule with DNS inspection enabled through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-415
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ssltls-dos-eHw76vZe
CVE: CVE-2025-20135
Published: 2025-08-14
Description: A vulnerability in the DHCP client functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to exhaust available memory.

This vulnerability is due to improper validation of incoming DHCP packets. An attacker could exploit this vulnerability by repeatedly sending crafted DHCPv4 packets to an affected device. A successful exploit could allow the attacker to exhaust available memory, which would affect availability of services and prevent new processes from starting, resulting in a Denial of Service (DoS) condition that would require a manual reboot.
Note: On Cisco Secure FTD Software, this vulnerability does not affect management interfaces.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-401
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dhcp-qj7nGs4N
CVE: CVE-2025-20136
Published: 2025-08-14
Description: A vulnerability in the function that performs IPv4 and IPv6 Network Address Translation (NAT) DNS inspection for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.&nbsp;

This vulnerability is due to an infinite loop condition that occurs when a Cisco Secure ASA or Cisco Secure FTD device processes DNS packets with DNS inspection enabled and the device is configured for NAT44, NAT64, or NAT46. An attacker could exploit this vulnerability by sending crafted DNS packets that match a static NAT rule with DNS inspection enabled through an affected device. A successful exploit could allow the attacker to create an infinite loop and cause the device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-835
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-nat-dns-dos-bqhynHTM
CVE: CVE-2025-20148
Published: 2025-08-14
Description: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document.

This vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by submitting malicious content to an affected device and using the device to generate a document that contains sensitive information. A successful exploit could allow the attacker to alter the standard layout of the device-generated documents, read arbitrary files from the underlying operating system, and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Security Analyst (Read Only).
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-html-inj-MqjrZrny
CVE: CVE-2025-20217
Published: 2025-08-14
Description: A vulnerability in the packet inspection functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to incorrect processing of traffic that is inspected by an affected device. An attacker could exploit this vulnerability by sending crafted traffic through the affected device. A successful exploit could allow the attacker to cause the affected device to enter an infinite loop while inspecting traffic, resulting in a DoS condition. The system watchdog will restart the Snort process automatically.
CVSS Score: 8.6 (HIGH)
CWE: CWE-835
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-dos-SvKhtjgt
CVE: CVE-2025-20218
Published: 2025-08-14
Description: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to retrieve sensitive information from an affected device.

This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to retrieve sensitive information from the affected device.
To exploit this vulnerability, the attacker must have valid administrative credentials.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-643
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xpathinj-COrThdMb
CVE: CVE-2025-20219
Published: 2025-08-14
Description: A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should have been blocked to a loopback interface.

This vulnerability is due to improper enforcement of access control rules for loopback interfaces. An attacker could exploit this vulnerability by sending traffic to a loopback interface on an affected device. A successful exploit could allow the attacker to bypass configured access control rules and send traffic&nbsp;that should have been blocked to a loopback interface on the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-acl-bypass-mtPze9Yh
CVE: CVE-2025-20220
Published: 2025-08-14
Description: A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root.
 This vulnerability is due to improper input validation for specific CLI commands. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.
 For more information about vulnerable scenarios, see the Details ["#details"] section of this advisory.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-ftd-cmdinj-PhE7kmT