deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-50891
Published: 2025-08-19
Description: The server-side backend for Adform Site Tracking before 2025-08-28 allows attackers to inject HTML or execute arbitrary code via cookie hijacking. NOTE: a customer does not need to take any action to update locally installed software (such as Adform Site Tracking 1.1).
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-77
References: https://github.com/nikolas-ch/CVEs/blob/main/AdformTracking_ReflectedXSS/AdformTracking_ReflectedXSS.txt; https://github.com/nikolas-ch/CVEs/tree/main/AdformTracking_ReflectedXSS; https://www.adformhelp.com/hc/en-us/categories/[PII_REDACTED]233-Adform-Site-Tracking
CVE: CVE-2025-52338
Published: 2025-08-19
Description: An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-288
References: https://cwe.mitre.org/data/definitions/521.html; https://cwe.mitre.org/data/definitions/522.html; https://github.com/TrustStackSecurity/Advisories/tree/main/CVE-2025-52338
CVE: CVE-2025-55303
Published: 2025-08-19
Description: Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images. A bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png. This vulnerability is fixed in 5.13.2 and 4.16.18.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-115
References: https://github.com/withastro/astro/commit/4d16de7f95db5d1ec1ce88610d2a95e606e83820; https://github.com/withastro/astro/security/advisories/GHSA-xf8x-j4p2-f749; https://github.com/withastro/astro/security/advisories/GHSA-xf8x-j4p2-f749
CVE: CVE-2025-55306
Published: 2025-08-19
Description: GenX_FX is an advance IA trading platform that will focus on forex trading. A vulnerability was identified in the GenX FX backend where API keys and authentication tokens may be exposed if environment variables are misconfigured. Unauthorized users could gain access to cloud resources (Google Cloud, Firebase, GitHub, etc.).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/Mouy-leng/GenX_FX/security/advisories/GHSA-2xjq-pvwj-mvm6
CVE: CVE-2025-55733
Published: 2025-08-19
Description: DeepChat is a smart assistant that connects powerful AI to your personal world.  DeepChat before 0.3.1 has a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted deepchat: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (deepchat:), causing the DeepChat application to launch and process the URL, leading to remote code execution on the victim’s machine. This vulnerability is fixed in 0.3.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-94
References: https://github.com/ThinkInAIXYZ/deepchat/commit/a0ff6f362e01ddceb7fd42d0af0b28b6184fb4d2; https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-hqr4-4gfc-5p2j; https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-hqr4-4gfc-5p2j
CVE: CVE-2025-55734
Published: 2025-08-19
Description: flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when visiting its subroutes. Specifically, only the file routes/adminPanel.py checks the user role when a user is trying to access the admin page, but that control is not done for the pages routes/adminPanelComments.py and routes/adminPanelPosts.py. Thus, an unauthorized user can bypass the intended restrictions, leaking sensitive data and accessing the following pages: /admin/posts, /adminpanel/posts, /admin/comments, and /adminpanel/comments.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-h239-vv39-v3vx; https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-jw79-2xvp-76p8
CVE: CVE-2025-55735
Published: 2025-08-19
Description: flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the variable "postContent". The vulnerability arises when displaying the content of the post using the | safe filter, that tells the engine to not escape the rendered content. This can lead to a stored XSS inside the content of the post. The code that causes the problem is in template/routes.html.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-807, CWE-79
References: https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-gj9v-qhc3-gcfx
CVE: CVE-2025-55736
Published: 2025-08-19
Description: flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-425, CWE-807
References: https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-6q83-vfmq-wf72
CVE: CVE-2025-9153
Published: 2025-08-19
Description: A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument photo results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/HjsCS/CVE/issues/4; https://itsourcecode.com/; https://vuldb.com/?ctiid.320533
CVE: CVE-2025-9154
Published: 2025-08-19
Description: A flaw has been found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /user/page-login.php. This manipulation of the argument email causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/HjsCS/CVE/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.320534
CVE: CVE-2025-2988
Published: 2025-08-19
Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.4, and 6.2.1.0 could disclose sensitive server information to an unauthorized user that could aid in further attacks against the system.
CVSS Score: 2.7 (LOW)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7242391
CVE: CVE-2025-43743
Published: 2025-08-19
Description: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumerate the names of other users, given an attacker the possibility to send phishing to these users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43743
CVE: CVE-2025-43744
Published: 2025-08-19
Description: A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 exists in the Asset Publisher configuration UI within the Source.js module. This vulnerability allows attackers to inject arbitrary JavaScript via DDM structure field labels which are then inserted into the DOM using innerHTML without proper encoding.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43744
CVE: CVE-2025-50926
Published: 2025-08-19
Description: Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the List All Email Addresses function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://packetstorm.news/files/id/207907; https://www.ehcp.net/?p=402
CVE: CVE-2025-51543
Published: 2025-08-19
Description: An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/reset_password endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://cicool.com; https://github.com/JustDinooo/CVEs/blob/main/CVE-2025-51543/poc.md
CVE: CVE-2025-52337
Published: 2025-08-19
Description: An authenticated arbitrary file upload vulnerability in the Content Explorer feature of LogicData eCommerce Framework v5.0.9.7000 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://cwe.mitre.org/data/definitions/434.html; https://github.com/TrustStackSecurity/Advisories/blob/main/CVE-2025-52337/README.md; https://nvd.nist.gov/vuln/detail/CVE-2022-22947
CVE: CVE-2025-55737
Published: 2025-08-19
Description: flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-6hp9-jv2f-88wr
CVE: CVE-2025-55740
Published: 2025-08-19
Description: nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files
config.yaml and docker-compose.yml contain default credentials (default_[CREDENTIAL_REDACTED]_me_please", GF_SECURITY_ADMIN_[CREDENTIAL_REDACTED]). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1392
References: https://github.com/Anipaleja/nginx-defender/security/advisories/GHSA-pr72-8fxw-xx22
CVE: CVE-2025-9155
Published: 2025-08-19
Description: A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Impacted is an unknown function of the file /user/forget_password.php. Such manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/HjsCS/CVE/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.320535
CVE: CVE-2025-9156
Published: 2025-08-19
Description: A vulnerability was found in itsourcecode Sports Management System 1.0. The affected element is an unknown function of the file /Admin/sports.php. Performing manipulation of the argument code results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/kangsf1989/2025/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.320536
CVE: CVE-2025-9157
Published: 2025-08-19
Description: A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2. The impacted element is the function untrunc_packet of the file src/tcpedit/edit_packet.c of the component tcprewrite. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. This patch is called 73008f261f1cdf7a1087dc[PII_REDACTED]696d35da. Applying a patch is advised to resolve this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://drive.google.com/file/d/1_aONM_TOF96JbnYviPyZhVk-7HObtX8H/view?usp=sharing; https://github.com/appneta/tcpreplay/commit/73008f261f1cdf7a1087dc[PII_REDACTED]696d35da; https://github.com/appneta/tcpreplay/issues/970
CVE: CVE-2025-9165
Published: 2025-08-19
Description: A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because "this is a memory leak on a command line tool that is about to exit anyway". In the reply the project maintainer declares this issue as "a simple 'bug' when leaving the command line tool and (...) not a security issue at all".
CVSS Score: 2.5 (LOW)
CWE: CWE-401, CWE-404
References: http://www.libtiff.org/; https://drive.google.com/file/d/1FWhmkzksH8-qU0ZM6seBzGNB3aPnX3G8/view?usp=sharing; https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0
CVE: CVE-2025-54143
Published: 2025-08-19
Description: Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-693
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1912671; https://www.mozilla.org/security/advisories/mfsa2025-60/
CVE: CVE-2025-54144
Published: 2025-08-19
Description: The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a user was tricked into clicking a link. This vulnerability was fixed in Firefox for iOS 141.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1946062; https://www.mozilla.org/security/advisories/mfsa2025-60/
CVE: CVE-2025-54145
Published: 2025-08-19
Description: The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme. This vulnerability was fixed in Firefox for iOS 141.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1946122; https://www.mozilla.org/security/advisories/mfsa2025-60/
CVE: CVE-2025-55028
Published: 2025-08-19
Description: Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This vulnerability was fixed in Firefox for iOS 142.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1850240; https://www.mozilla.org/security/advisories/mfsa2025-68/
CVE: CVE-2025-55029
Published: 2025-08-19
Description: Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks. This vulnerability was fixed in Firefox for iOS 142.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1973577; https://www.mozilla.org/security/advisories/mfsa2025-68/
CVE: CVE-2025-55030
Published: 2025-08-19
Description: Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks. This vulnerability was fixed in Firefox for iOS 142.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-640
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1976304; https://www.mozilla.org/security/advisories/mfsa2025-68/
CVE: CVE-2025-55031
Published: 2025-08-19
Description: Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target account. This vulnerability was fixed in Firefox for iOS 142 and Focus for iOS 142.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1979499; https://bugzilla.mozilla.org/show_bug.cgi?id=1979804; https://www.mozilla.org/security/advisories/mfsa2025-68/
CVE: CVE-2025-55032
Published: 2025-08-19
Description: Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks. This vulnerability was fixed in Focus for iOS 142.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1976296; https://www.mozilla.org/security/advisories/mfsa2025-69/
CVE: CVE-2025-55033
Published: 2025-08-19
Description: Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. This vulnerability was fixed in Focus for iOS 142.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1913825; https://www.mozilla.org/security/advisories/mfsa2025-69/
CVE: CVE-2025-8041
Published: 2025-08-19
Description: In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1670725; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://bugzilla.mozilla.org/show_bug.cgi?id=1670725
CVE: CVE-2025-8042
Published: 2025-08-19
Description: Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1791322; https://www.mozilla.org/security/advisories/mfsa2025-56/
CVE: CVE-2025-8364
Published: 2025-08-19
Description: A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack.
*Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 141.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1909609; https://bugzilla.mozilla.org/show_bug.cgi?id=1969937; https://www.mozilla.org/security/advisories/mfsa2025-56/
CVE: CVE-2025-9167
Published: 2025-08-19
Description: A vulnerability has been found in SolidInvoice up to 2.4.0. This vulnerability affects unknown code of the file /invoice/recurring of the component Recurring Invoice Module. The manipulation of the argument client name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%95%B5%EF%B8%8F%E2%80%8D%E2%99%82%EF%B8%8F%20PoC%20-%20Stored%20XSS%201.md; https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%95%B5%EF%B8%8F%E2%80%8D%E2%99%82%EF%B8%8F%20PoC%20-%20Stored%20XSS%201.md#-exploitation-steps; https://vuldb.com/?ctiid.320544
CVE: CVE-2025-9168
Published: 2025-08-19
Description: A vulnerability was found in SolidInvoice up to 2.4.0. This issue affects some unknown processing of the file /invoice of the component Invoice Creation Module. The manipulation of the argument Client Name results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84POC%20Stored%20XSS%202.md; https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84POC%20Stored%20XSS%202.md#-exploitation-steps; https://vuldb.com/?ctiid.320545
CVE: CVE-2025-9179
Published: 2025-08-19
Description: An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1979527; https://www.mozilla.org/security/advisories/mfsa2025-64/; https://www.mozilla.org/security/advisories/mfsa2025-65/
CVE: CVE-2025-9180
Published: 2025-08-19
Description: Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1979782; https://www.mozilla.org/security/advisories/mfsa2025-64/; https://www.mozilla.org/security/advisories/mfsa2025-65/
CVE: CVE-2025-9181
Published: 2025-08-19
Description: Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-457
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1977130; https://www.mozilla.org/security/advisories/mfsa2025-64/; https://www.mozilla.org/security/advisories/mfsa2025-66/
CVE: CVE-2025-9182
Published: 2025-08-19
Description: Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1975837; https://www.mozilla.org/security/advisories/mfsa2025-64/; https://www.mozilla.org/security/advisories/mfsa2025-67/
CVE: CVE-2025-9183
Published: 2025-08-19
Description: Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1976102; https://www.mozilla.org/security/advisories/mfsa2025-64/; https://www.mozilla.org/security/advisories/mfsa2025-67/
CVE: CVE-2025-9184
Published: 2025-08-19
Description: Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1929482%2C1976376%2C1979163%2C1979955; https://www.mozilla.org/security/advisories/mfsa2025-64/; https://www.mozilla.org/security/advisories/mfsa2025-67/