deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0432
Published: 2025-01-28
Description: EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-319
References: https://hmsnetworks.blob.core.windows.net/nlw/docs/default-source/products/ewon/manuals-and-guides---installation-guides/best-practices-for-a-secure-usage-of-the-ewon-solution-en.pdf?sfvrsn=37160847_4; https://support.hms-networks.com/hc/en-us/articles/[PII_REDACTED]818-How-to-block-all-the-unused-Ewon-Flexy-Cosy131-services-on-the-LAN-WAN-and-or-VPN-interface; https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-06
CVE: CVE-2025-0659
Published: 2025-01-28
Description: A path
traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifying the character
sequence in the body of the vulnerable endpoint, it is possible to overwrite
files outside of the intended directory. A threat actor with admin privileges could
leverage this vulnerability to overwrite reports including user projects.
CWE: CWE-200
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1715.html
CVE: CVE-2025-23045
Published: 2025-01-28
Description: Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run any of the serverless functions of type tracker from the CVAT Git repository, namely TransT and SiamMask. Deployments with custom functions of type tracker may also be affected, depending on how they handle state serialization. If a function uses an unsafe serialization library such as pickle or jsonpickle, it's likely to be vulnerable. Upgrade to CVAT 2.26.0 or later. If you are unable to upgrade, shut down any instances of the TransT or SiamMask functions you're running.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/cvat-ai/cvat/commit/563e1dfde64b15fa042b23f9d09cd854b35f0366; https://github.com/cvat-ai/cvat/security/advisories/GHSA-wq36-mxf8-hv62
CVE: CVE-2025-23211
Published: 2025-01-28
Description: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-1336, CWE-94
References: https://github.com/TandoorRecipes/recipes/blob/4f9bff20c858180d0f7376de443a9fe4c123a50c/cookbook/helper/template_helper.py#L95; https://github.com/TandoorRecipes/recipes/commit/e6087d5129cc9d0c[PII_REDACTED]2377e66c2a2c20; https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-r6rj-h75w-vj8v
CVE: CVE-2025-23212
Published: 2025-01-28
Description: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200
References: https://github.com/TandoorRecipes/recipes/commit/36e83a9d0108ac56b9538b45ead57efc8b97c5ff; https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-jrgj-35jx-2qq7; https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-jrgj-35jx-2qq7
CVE: CVE-2025-23213
Published: 2025-01-28
Description: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.
CVSS Score: 8.7 (HIGH)
CWE: CWE-434
References: https://github.com/TandoorRecipes/recipes/commit/3e37d11c6a3841a00eb27670d1d003f1a713e1cf; https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-56jp-j3x5-hh2w
CVE: CVE-2025-23385
Published: 2025-01-28
Description: In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible
CVSS Score: 7.8 (HIGH)
CWE: CWE-114
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-24800
Published: 2025-01-28
Description: Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or compromise other kinds of cross-chain applications. This vulnerability is fixed in 15.0.1.
CWE: CWE-347, CWE-670
References: https://github.com/polytope-labs/hyperbridge/pull/372/commits/f0e85db718f5165b06585a49b14a66f8ad643aea; https://github.com/polytope-labs/hyperbridge/security/advisories/GHSA-wwx5-gpgr-vxr7; https://github.com/polytope-labs/ismp-substrate/pull/64/commits/5ca3351a19151f1a439c30d5cbdbfdc72a11f1a8#diff-3835cc24fb2011b3e[PII_REDACTED]acd8c2c2a9a869eedf7a210d18edb6543318dL262
CVE: CVE-2017-13317
Published: 2025-01-28
Description: In HeifDecoderImpl::getScanline of HeifDecoderImpl.cpp, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-05-01
CVE: CVE-2017-13318
Published: 2025-01-28
Description: In HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125, CWE-190
References: https://source.android.com/security/bulletin/pixel/2018-05-01
CVE: CVE-2018-9373
Published: 2025-01-28
Description: In TdlsexRxFrameHandle of the MTK WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9378
Published: 2025-01-28
Description: In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2024-8401
Published: 2025-01-28
Description: CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
vulnerability exists when an authenticated attacker modifies folder names within the context of
the product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-254-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-254-02.pdf
CVE: CVE-2025-0781
Published: 2025-01-28
Description: An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level.
CVSS Score: 8.6 (HIGH)
CWE: CWE-863
References: https://gitlab.com/flightgear/flightgear/-/commit/ad37afce28083fad7f79467b3ffdead753584358; https://gitlab.com/flightgear/flightgear/-/issues/3025; https://gitlab.com/flightgear/simgear/-/commit/5bb[PII_REDACTED]67141a7610e8f1ca7d6f4f5a5a8
CVE: CVE-2024-13484
Published: 2025-01-28
Description: A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.
CVSS Score: 8.2 (HIGH)
CWE: CWE-668
References: https://access.redhat.com/errata/RHSA-2025:7753; https://access.redhat.com/errata/RHSA-2025:8274; https://access.redhat.com/errata/RHSA-2025:9506
CVE: CVE-2025-23053
Published: 2025-01-28
Description: A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US
CVE: CVE-2025-23054
Published: 2025-01-28
Description: A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US
CVE: CVE-2025-23055
Published: 2025-01-28
Description: A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US
CVE: CVE-2025-23056
Published: 2025-01-28
Description: A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US
CVE: CVE-2025-23057
Published: 2025-01-28
Description: A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US
CVE: CVE-2025-0631
Published: 2025-01-28
Description: A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being sent in clear text.
CWE: CWE-319
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1717.html
CVE: CVE-2025-0783
Published: 2025-01-28
Description: A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpoint. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://docs.google.com/document/d/1FCJveTlXtJd8EJRW2-LXwuhno92JaVt3_98Iqrdoc6M/edit?tab=t.0#heading=h.bbpri264qnth; https://drive.google.com/file/d/1KqzS5bMyPtgO9eIk_-que50tZU097RVi/view; https://vuldb.com/?ctiid.293907
CVE: CVE-2025-22217
Published: 2025-01-28
Description: Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products. 

A malicious user with network access may be able to use specially crafted SQL queries to gain database access.
CVSS Score: 8.6 (HIGH)
CWE: CWE-89
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25346
CVE: CVE-2025-24478
Published: 2025-01-28
Description: A denial-of-service vulnerability exists in the affected products. The vulnerability could allow a remote, non-privileged user to send malicious requests resulting in a major nonrecoverable fault causing a denial-of-service.
CWE: CWE-755
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1718.html
CVE: CVE-2025-24479
Published: 2025-01-28
Description: A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access to the Command Prompt as a higher privileged user.
CWE: CWE-863
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1719.html
CVE: CVE-2025-24480
Published: 2025-01-28
Description: A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation and could allow a remote attacker to run commands or code as a high privileged user.
CWE: CWE-78
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1719.html
CVE: CVE-2024-34732
Published: 2025-01-28
Description: In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-34733
Published: 2025-01-28
Description: In DevmemXIntMapPages of devicemem_server.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-34748
Published: 2025-01-28
Description: In _DevmemXReservationPageAddress of devicemem_server.c, there is a possible use-after-free due to improper casting. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40649
Published: 2025-01-28
Description: In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40651
Published: 2025-01-28
Description: In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40669
Published: 2025-01-28
Description: In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40670
Published: 2025-01-28
Description: In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40672
Published: 2025-01-28
Description: In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-281
References: https://android.googlesource.com/platform/packages/modules/IntentResolver/+/ccd29124d0d2276a3071c0418c14dec188cd3727; https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40673
Published: 2025-01-28
Description: In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://android.googlesource.com/platform/libcore/+/b17fd2f8fe468e7d32e713b442f610cd33e4e7a9; https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40674
Published: 2025-01-28
Description: In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://android.googlesource.com/platform/packages/modules/Wifi/+/debc548ac085ba1ab0582172b97d965e9a1ea43a; https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40675
Published: 2025-01-28
Description: In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://android.googlesource.com/platform/frameworks/base/+/c6b5490ec659b5854fd429f453f75de5befa6359; https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40676
Published: 2025-01-28
Description: In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.7 (HIGH)
CWE: CWE-843
References: https://android.googlesource.com/platform/frameworks/base/+/e8a53246607b52b15269f97aef9ba7e928ba2473; https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-40677
Published: 2025-01-28
Description: In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-862
References: https://android.googlesource.com/platform/packages/apps/Settings/+/db26138f07db830e3fb78283d37de3c0296d93cb; https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2025-0784
Published: 2025-01-28
Description: A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic. This vulnerability affects unknown code of the file /v1/usuario/ of the component Registered User Handler. The manipulation leads to cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.59 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.7 (LOW)
CWE: CWE-310, CWE-319
References: https://eldruin.notion.site/Intelbras-InControl-v2-21-57-Password-exposed-in-clear-text-17d27474cccb806fba1efda195c78258?pvs=4; https://vuldb.com/?ctiid.293908; https://vuldb.com/?id.293908
CVE: CVE-2025-24481
Published: 2025-01-28
Description: An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permissions being assigned to the remote debugger port and can allow for unauthenticated access to the system configuration.
CWE: CWE-732
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1720.html
CVE: CVE-2025-24482
Published: 2025-01-28
Description: A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions.
CWE: CWE-94
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1720.html
CVE: CVE-2025-24826
Published: 2025-01-28
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4625.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://security-advisory.acronis.com/advisories/SEC-6436
CVE: CVE-2024-29869
Published: 2025-01-28
Description: Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/apache/hive; https://github.com/apache/hive/commit/20106e254527f7d71b2e34455c4322e14950c620; https://issues.apache.org/jira/browse/HIVE-28134
CVE: CVE-2024-55968
Published: 2025-01-28
Description: An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC interprocess communication (IPC). Specifically, the service does not verify the code requirements, entitlements, security flags, or version of any client attempting to establish a connection. This lack of proper logic validation allows malicious actors to exploit the service's methods via unauthorized client connections, and escalate privileges to root by abusing the DTConnectionHelperProtocol protocol's submitQuery method over an unauthorized XPC connection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-267
References: https://github.com/Wi1DN00B/CVE-2024-55968; https://github.com/null-event/CVE-2024-55968
CVE: CVE-2024-57376
Published: 2025-01-28
Description: Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthenticated users to execute remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.dlink.com/en/security-bulletin/