deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-20357
Published: 2025-10-01
Description: A vulnerability in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.

This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
To exploit this vulnerability, the attacker must have valid administrative credentials that allow access to the Reports page. By default, all pre-defined users have this access, as do any custom users that are configured to allow access to the Reports page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cv-xss-rwRAKAJ9
CVE: CVE-2025-20361
Published: 2025-10-01
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-stored-xss-Fnj66YLy
CVE: CVE-2025-20366
Published: 2025-10-01
Description: In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privileged user that does not hold the admin or power Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job in the background. If the low privileged user guesses the search job’s unique Search ID (SID), the user could retrieve the results of that job, potentially exposing sensitive search results. For more information see https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/about-jobs-and-job-management and https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/manage-search-jobs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://advisory.splunk.com/advisories/SVD-2025-1001
CVE: CVE-2025-20367
Published: 2025-10-01
Description: In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious payload through the `dataset.command` parameter of the `/app/search/table` endpoint, which could result in execution of unauthorized JavaScript code in the browser of a user.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://advisory.splunk.com/advisories/SVD-2025-1002
CVE: CVE-2025-20368
Published: 2025-10-01
Description: In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through the error messages and job inspection details of a saved search. This could result in execution of unauthorized JavaScript code in the browser of a user.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://advisory.splunk.com/advisories/SVD-2025-1003
CVE: CVE-2025-20369
Published: 2025-10-01
Description: In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-776, CWE-611
References: https://advisory.splunk.com/advisories/SVD-2025-1004
CVE: CVE-2025-20370
Published: 2025-10-01
Description: In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a user who holds a role that contains the high-privilege capability `change_authentication`, could send multiple LDAP bind requests to a specific internal endpoint, resulting in high server CPU usage, which could potentially lead to a denial of service (DoS) until the Splunk Enterprise instance is restarted. See https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities and https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/use-ldap-as-an-authentication-scheme/configure-ldap-with-splunk-web#cfe47e31_007f_460d_8b3d_8505ffc3f0dd__Configure_LDAP_with_Splunk_Web for more information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://advisory.splunk.com/advisories/SVD-2025-1005
CVE: CVE-2025-20371
Published: 2025-10-01
Description: In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://advisory.splunk.com/advisories/SVD-2025-1006
CVE: CVE-2025-34182
Published: 2025-10-01
Description: In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfaces_assign.php, which can result in stored cross-site scripting. The attacker must be authenticated with at-least "Interfaces: PPPs: Edit" permission. This vulnerability has been addressed by the vendor in the product release notes as "ui: legacy_html_escape_form_data() was not escaping keys only data elements."
CWE: CWE-79
References: https://docs.opnsense.org/releases/CE_25.7.html#september-30-2025; https://www.vulncheck.com/advisories/decisio-opnsense-stored-xss
CVE: CVE-2025-61596
Published: 2025-10-01
Description: Rejected reason: This is a fork and is not in the Rust registry.
CVE: CVE-2024-57494
Published: 2025-10-01
Description: Cross Site Scripting vulnerability in Neto E-Commerce CMS v.6.313.0 through v.6.3115 allows a remote attacker to escalate privileges via the kw parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2024-57494.md
CVE: CVE-2025-28357
Published: 2025-10-01
Description: A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-93
References: http://neto.com; https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-28357.md
CVE: CVE-2025-57393
Published: 2025-10-01
Description: A stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2vallows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://kissflow.com; https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-57393.md
CVE: CVE-2025-60991
Published: 2025-10-01
Description: A reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload injected into the cat parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://codazon.com; https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-60991.md; https://github.com/shadowByte1
CVE: CVE-2025-8679
Published: 2025-10-01
Description: In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000130289
CVE: CVE-2025-10578
Published: 2025-10-01
Description: A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_13[PII_REDACTED]8785-16/hpsbgn04053
CVE: CVE-2025-43718
Published: 2025-10-01
Description: Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).
CVSS Score: 2.9 (LOW)
CWE: CWE-674
References: https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-43718.md; https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408
CVE: CVE-2025-46205
Published: 2025-10-01
Description: A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted PDF file. NOTE: this is disputed by the Supplier because there is no available file to reproduce the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-46205.md; https://github.com/ShadowByte1/CVE-Reports/issues/1; https://github.com/podofo/podofo
CVE: CVE-2025-58054
Published: 2025-10-01
Description: Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. This issue is fixed in version 3.5.1.
CVSS Score: 3.5 (LOW)
CWE: CWE-80
References: https://github.com/discourse/discourse/commit/3a224fd546d894ee408e7414b6879e814a792f91; https://github.com/discourse/discourse/security/advisories/GHSA-7p47-8m82-m2vf
CVE: CVE-2025-58055
Published: 2025-10-01
Description: Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, and “Tags” allowed authenticated users to extract information about topics that they weren’t authorized to access. By modifying the “topic_id” value in API requests to the AI suggestion endpoints, users could target specific restricted topics. The AI model’s responses then disclosed information that the authenticated user couldn’t normally access. This issue is fixed in version 3.5.1. To workaround this issue, users can restrict group access to the AI helper feature through the "composer_ai_helper_allowed_groups" and "post_ai_helper_allowed_groups" site settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-639, CWE-639
References: https://github.com/discourse/discourse/commit/28d569cae9b33cd55d647bf41806106e33d975c9; https://github.com/discourse/discourse/security/advisories/GHSA-32v2-x274-vfhr; https://www.vicarius.io/vsociety/posts/cve-2025-58055-detect-discourse-vulnerability
CVE: CVE-2025-59681
Published: 2025-10-01
Description: An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/g/django-announce; https://www.djangoproject.com/weblog/2025/oct/01/security-releases/
CVE: CVE-2025-59682
Published: 2025-10-01
Description: An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
CVSS Score: 3.1 (LOW)
CWE: CWE-23
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/g/django-announce; https://www.djangoproject.com/weblog/2025/oct/01/security-releases/
CVE: CVE-2025-56588
Published: 2025-10-01
Description: Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://dolibarr.com; https://github.com/PhDg1410/Research
CVE: CVE-2025-57444
Published: 2025-10-01
Description: An authenticated cross-site scripting (XSS) vulnerability in the Administrative interface of Radware AlteonOS Web UI Management v33.0.4.50 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://binqqer.com/posts/CVE-2025-57444/
CVE: CVE-2025-58769
Published: 2025-10-01
Description: auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. The vulnerability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.0–8.16.0) or indirectly relies on those versions through the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs. This issue is fixed in version 8.17.0.
CVSS Score: 3.3 (LOW)
CWE: CWE-22, CWE-73
References: https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c; https://github.com/auth0/auth0-PHP/releases/tag/8.17.0; https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
CVE: CVE-2025-59147
Published: 2025-10-01
Description: Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sends multiple SYN packets with different sequence numbers within the same flow tuple, which can cause Suricata to fail to pick up the TCP session. In IDS mode this can lead to a detection and logging bypass. In IPS mode this will lead to the flow getting blocked. This issue is fixed in versions 7.0.12 and 8.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018; https://github.com/OISF/suricata/commit/be6315dba0d9101b11d16e9dacfe2822b3792f1b; https://github.com/OISF/suricata/commit/e91b03c90385db15e21cf1a0e85b921bf92b039e
CVE: CVE-2025-59148
Published: 2025-10-01
Description: Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 8.0.0 and below incorrectly handle the entropy keyword when not anchored to a "sticky" buffer, which can lead to a segmentation fault. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules using the entropy keyword, or validate they are anchored to a sticky buffer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018; https://github.com/OISF/suricata/commit/9f32550e18f97ea5d610dd7c36aab0ba142c096c; https://github.com/OISF/suricata/security/advisories/GHSA-5qf6-92xg-3rr3
CVE: CVE-2025-59149
Published: 2025-10-01
Description: Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-121
References: https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018; https://github.com/OISF/suricata/commit/38a2cba5c397002047d84645f5ab770ff88020e1; https://github.com/OISF/suricata/security/advisories/GHSA-vxcg-38x4-gj7j
CVE: CVE-2025-61188
Published: 2025-10-01
Description: Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-24
References: https://github.com/jeecgboot/JeecgBoot/issues/8826
CVE: CVE-2025-61189
Published: 2025-10-01
Description: Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-24
References: https://github.com/jeecgboot/JeecgBoot/issues/8827
CVE: CVE-2025-57389
Published: 2025-10-01
Description: A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. This vulnerability was fixed in OpenWRT v19.07.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/amalcew/CVE-2025-57389; https://github.com/openwrt/luci/blob/20b3600d4d64bf60588cf4975c7a[PII_REDACTED]0e/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm#L73; https://github.com/amalcew/CVE-2025-57389
CVE: CVE-2025-59150
Published: 2025-10-01
Description: Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed in version 8.0.1. To workaround this issue, disable rules using the tls.subjectaltname keyword.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018; https://github.com/OISF/suricata/commit/d590fdfe42e995fd558315f0c24f9a352e21479d; https://github.com/OISF/suricata/security/advisories/GHSA-mhv7-qfmj-m3f3
CVE: CVE-2025-59337
Published: 2025-10-01
Description: Discourse is an open-source community discussion platform. In versions 3.5.0 and below, malicious meta-commands could be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. This issue is fixed in version 3.5.1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: https://github.com/discourse/discourse/commit/43536b60d012cc8084e7e701d6afab9ba01e28a5; https://github.com/discourse/discourse/security/advisories/GHSA-7xjr-4f4g-9887
CVE: CVE-2025-59531
Published: 2025-10-01
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. Without a configured webhook.bitbucketserver.secret, Argo CD's /api/webhook endpoint crashes when receiving a malformed Bitbucket Server payload (non-array repository.links.clone field). A single unauthenticated request triggers CrashLoopBackOff, and targeting all replicas causes complete API outage. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703
References: https://github.com/argoproj/argo-cd/commit/5c466a4e39802e059e75c0008ae7b7b8e842538f; https://github.com/argoproj/argo-cd/security/advisories/GHSA-f9gq-prrc-hrhc; https://github.com/argoproj/argo-cd/security/advisories/GHSA-f9gq-prrc-hrhc
CVE: CVE-2025-59537
Published: 2025-10-01
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-476, CWE-476
References: https://github.com/argoproj/argo-cd/commit/761fc27068d2d4cd24e1f784eb2a9033b5ee7f43; https://github.com/argoproj/argo-cd/security/advisories/GHSA-wp4p-9pxh-cgx2; https://github.com/argoproj/argo-cd/security/advisories/GHSA-wp4p-9pxh-cgx2
CVE: CVE-2025-59538
Published: 2025-10-01
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248, CWE-703
References: https://github.com/argoproj/argo-cd/commit/1a023f1ca7fe4ec942b4b[PII_REDACTED]d5a632baf; https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv; https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv
CVE: CVE-2025-23297
Published: 2025-10-01
Description: NVIDIA Installer for NvAPP for Windows contains a vulnerability in the FrameviewSDK installation process, where an attacker with local unprivileged access could modify files in the Frameview SDK directory. A successful exploit of this vulnerability might lead to escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23297; https://nvidia.custhelp.com/app/answers/detail/a_id/5682; https://www.cve.org/CVERecord?id=CVE-2025-23297