deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54068
Published: 2025-07-17
Description: Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc; https://github.com/livewire/livewire/releases/tag/v3.6.4; https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3
CVE: CVE-2025-54070
Published: 2025-07-17
Description: OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the `lastIndexOf(bytes,byte,uint256)` function of the `Bytes.sol` library may access uninitialized memory when the following two conditions hold: 1) the provided buffer length is empty (i.e. `buffer.length == 0`) and position is not `2**256 - 1` (i.e. `pos != type(uint256).max`). The `pos` argument could be used to access arbitrary data outside of the buffer bounds. This could lead to the operation running out of gas, or returning an invalid index (outside of the empty buffer). Processing this invalid result for accessing the `buffer` would cause a revert under normal conditions. When triggered, the function reads memory at offset `buffer + 0x20 + pos`. If memory at that location (outside the `buffer`) matches the search pattern, the function would return an out of bound index instead of the expected `type(uint256).max`. This creates unexpected behavior where callers receive a valid-looking index pointing outside buffer bounds. Subsequent memory accesses that don't check bounds and use the returned index must carefully review the potential impact depending on their setup. Code relying on this function returning `type(uint256).max` for empty buffers or using the returned index without bounds checking could exhibit undefined behavior. Users should upgrade to version 5.4.0 to receive a patch.
CWE: CWE-125
References: https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v5.4.0; https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9rcw-c2f9-2j55
CVE: CVE-2025-7472
Published: 2025-07-17
Description: A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer is run as SYSTEM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-427
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20250717-cix-lpe
CVE: CVE-2025-7750
Published: 2025-07-17
Description: A vulnerability, which was classified as critical, was found in code-projects Online Appointment Booking System 1.0. Affected is an unknown function of the file /admin/adddoctorclinic.php. The manipulation of the argument clinic leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/26; https://vuldb.com/?ctiid.316740
CVE: CVE-2024-39289
Published: 2025-07-17
Description: A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-95, CWE-94
References: https://www.ros.org/blog/noetic-eol/
CVE: CVE-2024-39835
Published: 2025-07-17
Description: A code injection vulnerability has been identified in the Robot Operating System (ROS) 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() method to process user-supplied, unsanitized parameter values within the substitution args mechanism, which roslaunch evaluates before launching a node. This flaw allows attackers to craft and execute arbitrary Python code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-95, CWE-94
References: https://www.ros.org/blog/noetic-eol/
CVE: CVE-2024-41148
Published: 2025-07-17
Description: A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-95, CWE-94
References: https://www.ros.org/blog/noetic-eol/
CVE: CVE-2024-41921
Published: 2025-07-17
Description: A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'echo' verb, which allows a user to introspect a ROS topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-95
References: https://www.ros.org/blog/noetic-eol/
CVE: CVE-2024-42209
Published: 2025-07-17
Description: HCL Connections is vulnerable to an information disclosure vulnerability that could allow a user to obtain sensitive information they are not entitled to, which is caused by improper handling of request data.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122628
CVE: CVE-2025-0886
Published: 2025-07-17
Description: An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.lenovo.com/us/en/product_security/LEN-182738
CVE: CVE-2025-1700
Published: 2025-07-17
Description: A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate privileges during installation of the software.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://en-us.support.motorola.com/app/answers/detail/a_id/186730/~/motorola-software-fix-installer-vulnerability; https://support.lenovo.com/us/en/product_security/LEN-194483
CVE: CVE-2025-1729
Published: 2025-07-17
Description: A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://support.lenovo.com/us/en/product_security/LEN-189489
CVE: CVE-2025-23266
Published: 2025-07-17
Description: NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-426
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5659; https://kidbomb.github.io/posts/nvidia-container-escape-cve-2025-23266-part-2/; https://kidbomb.github.io/posts/nvidia-container-escape-cve-2025-23266/
CVE: CVE-2025-23267
Published: 2025-07-17
Description: NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a specially crafted container image. A successful exploit of this vulnerability might lead to data tampering and denial of service.
CVSS Score: 8.5 (HIGH)
CWE: CWE-59
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5659; http://www.openwall.com/lists/oss-security/2025/07/16/3
CVE: CVE-2025-23270
Published: 2025-07-17
Description: NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local attacker may cause exposure of sensitive information via a side channel vulnerability. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
CVSS Score: 7.1 (HIGH)
CWE: CWE-392
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5662
CVE: CVE-2025-2818
Published: 2025-07-17
Description: A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Application that could allow a nearby attacker within the Bluetooth interaction range to intercept files when transferred to a device not paired in Smart Connect.
CVSS Score: 3.5 (LOW)
CWE: CWE-319
References: https://en-us.support.motorola.com/app/answers/detail/a_id/186727; https://support.lenovo.com/us/en/product_security/LEN-188742
CVE: CVE-2025-3753
Published: 2025-07-17
Description: A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-95
References: https://www.ros.org/blog/noetic-eol/
CVE: CVE-2025-4657
Published: 2025-07-17
Description: A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and Lenovo App Store could allow a local attacker with elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-122
References: https://iknow.lenovo.com.cn/detail/430155
CVE: CVE-2025-53964
Published: 2025-07-17
Description: GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and then searches for any term included in that dictionary.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-749
References: https://github.com/goldendict/goldendict/releases; https://github.com/tigr78/CVE-2025-53964
CVE: CVE-2025-6230
Published: 2025-07-17
Description: A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite commands.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://support.lenovo.com/us/en/product_security/LEN-196648
CVE: CVE-2025-6231
Published: 2025-07-17
Description: An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying an application configuration file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-88
References: https://support.lenovo.com/us/en/product_security/LEN-196648
CVE: CVE-2025-6232
Published: 2025-07-17
Description: An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying specific registry locations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-88
References: https://support.lenovo.com/us/en/product_security/LEN-196648
CVE: CVE-2025-6248
Published: 2025-07-17
Description: A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information if a user visits a web page with specially crafted content.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: https://iknow.lenovo.com.cn/detail/430154
CVE: CVE-2025-6249
Published: 2025-07-17
Description: An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions access to application data.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-602
References: https://www.filez.com/securityPolicy/3.html?[PII_REDACTED]
CVE: CVE-2025-7433
Published: 2025-07-17
Description: A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20250717-cix-lpe
CVE: CVE-2025-7751
Published: 2025-07-17
Description: A vulnerability has been found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/addclinic.php. The manipulation of the argument cid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/24; https://vuldb.com/?ctiid.316741
CVE: CVE-2025-7752
Published: 2025-07-17
Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/deletedoctor.php. The manipulation of the argument did leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/23; https://vuldb.com/?ctiid.316742
CVE: CVE-2025-7753
Published: 2025-07-17
Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/adddoctor.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/22; https://vuldb.com/?ctiid.316743
CVE: CVE-2025-7754
Published: 2025-07-17
Description: A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /xray_form.php. The manipulation of the argument itr_no leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Damon-Gilbert/damon-blog/blob/main/cve-zy.pdf; https://vuldb.com/?ctiid.316744
CVE: CVE-2025-23269
Published: 2025-07-17
Description: NVIDIA Jetson Linux contains a vulnerability in the kernel where an attacker may cause an exposure of sensitive information due to a shared microarchitectural predictor state that influences transient execution. A successful exploit of this vulnerability may lead to information disclosure.
CVSS Score: 4.7 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5662
CVE: CVE-2025-7755
Published: 2025-07-17
Description: A vulnerability was found in code-projects Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/edit_product.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/AlbaDove/cve/issues/4; https://vuldb.com/?ctiid.316745
CVE: CVE-2025-7756
Published: 2025-07-17
Description: A vulnerability classified as problematic has been found in code-projects E-Commerce Site 1.0. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://code-projects.org/; https://github.com/BalanceLee/CVE/issues/3; https://vuldb.com/?ctiid.316746
CVE: CVE-2025-7757
Published: 2025-07-17
Description: A vulnerability classified as critical was found in PHPGurukul Land Record System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit-property.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/hex31415926/cve/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.316747
CVE: CVE-2025-6391
Published: 2025-07-17
Description: Brocade ASCG before 3.3.0 logs JSON 
Web Tokens (JWT) in log files. An attacker with access to the log files 
 can withdraw the unencrypted tokens with security implications, such as
 unauthorized access, session hijacking, and information disclosure.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-532
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35951
CVE: CVE-2025-7397
Published: 2025-07-17
Description: A vulnerability in the ascgshell, of 
Brocade ASCG before 3.3.0 stores any command executed in the Command 
Line Interface (CLI) in plain text within the command history. A local 
authenticated user that can access sensitive information like passwords 
within the CLI history leading to unauthorized access and potential data
 breaches.
CVSS Score: 7.1 (HIGH)
CWE: CWE-312
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35949
CVE: CVE-2025-7398
Published: 2025-07-17
Description: Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-326
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35950
CVE: CVE-2025-7758
Published: 2025-07-17
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/3.md; https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/3.md#poc; https://vuldb.com/?ctiid.316748
CVE: CVE-2025-7759
Published: 2025-07-17
Description: A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java of the component UEditor Image Grabber. Such manipulation of the argument Source leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 1c5e49b[PII_REDACTED]148e0f8ff69ed04cb8fefdc. It is advisable to implement a patch to correct this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/MentalityXt/jeesite_ssrf/tree/main; https://github.com/thinkgem/jeesite5/commit/1c5e49b[PII_REDACTED]148e0f8ff69ed04cb8fefdc; https://github.com/thinkgem/jeesite5/issues/27
CVE: CVE-2025-7762
Published: 2025-07-17
Description: A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing of the file /menu_nat_more.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/XiDP0/MyCVE/blob/main/CVE/D-Link%20DI_8100-16.07.26A1/menu_nat_more_asp/menu_nat_more_asp.md; https://vuldb.com/?ctiid.316757; https://vuldb.com/?id.316757
CVE: CVE-2025-7763
Published: 2025-07-17
Description: A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/thinkgem/jeesite5/commit/3d06b8d009d0267f0255acc87ea19d29d07cedc3; https://github.com/thinkgem/jeesite5/issues/28; https://github.com/thinkgem/jeesite5/issues/28#issuecomment[PII_REDACTED]
CVE: CVE-2025-7764
Published: 2025-07-17
Description: A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. Affected is an unknown function of the file /admin/deletedoctorclinic.php. The manipulation of the argument clinic leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/jaynewboy/cve/issues/2; https://vuldb.com/?ctiid.316764
CVE: CVE-2025-7765
Published: 2025-07-17
Description: A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/addmanagerclinic.php. The manipulation of the argument clinic leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/jaynewboy/cve/issues/1; https://vuldb.com/?ctiid.316765
CVE: CVE-2025-6185
Published: 2025-07-18
Description: Leviton AcquiSuite and Energy Monitoring Hub 
are susceptible to a cross-site scripting vulnerability, allowing 
an attacker to craft a malicious payload in URL parameters, which would 
execute in a client browser when accessed by a user, steal session 
tokens, and control the service.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79
References: https://leviton.com/support/resources/product-support; https://www.cisa.gov/news-events/ics-advisories/icsa-25-198-01
CVE: CVE-2025-7767
Published: 2025-07-18
Description: A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/edit-art-medium-detail.php. The manipulation of the argument artmed leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/wanglu-cell/myCVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.316766