deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-23006
Published: 2025-01-23
Description: Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23006
CVE: CVE-2024-10539
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uyumsoft Informatin Systems Uyumsoft ERP allows XSS Using Invalid Characters, Reflected XSS.This issue affects Uyumsoft ERP: before Erp4.2109.166p45.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0017
CVE: CVE-2024-57947
Published: 2025-01-23
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_set_pipapo: fix initial map fill

The initial buffer has to be inited to all-ones, but it must restrict
it to the size of the first field, not the total field size.

After each round in the map search step, the result and the fill map
are swapped, so if we have a set where f->bsize of the first element
is smaller than m->bsize_max, those one-bits are leaked into future
rounds result map.

This makes pipapo find an incorrect matching results for sets where
first field size is not the largest.

Followup patch adds a test case to nft_concat_range.sh selftest script.

Thanks to Stefano Brivio for pointing out that we need to zero out
the remainder explicitly, only correcting memset() argument isn't enough.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/69b6a67f7052905e928d75a0c5871de50e686986; https://git.kernel.org/stable/c/77bf0c4ab928ca4c9a99311f4f70ba0c17fecba9; https://git.kernel.org/stable/c/791a615b7ad2258c560f91852be54b0480837c93
CVE: CVE-2024-10846
Published: 2025-01-23
Description: The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions  v2.27.0 to v2.29.7 included
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://github.com/compose-spec/compose-go/security/advisories/GHSA-36gq-35j3-p9r9; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-52325
Published: 2025-01-23
Description: ECOVACS robot lawnmowers and vacuums are vulnerable to command injection via SetNetPin() over an unauthenticated BLE connection.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.pdf; https://www.ecovacs.com/global/userhelp/dsa20241119; https://www.ecovacs.com/global/userhelp/dsa[PII_REDACTED]1
CVE: CVE-2024-55971
Published: 2025-01-23
Description: SQL Injection vulnerability in the default configuration of the Logitime WebClock application <= 5.43.0 allows an unauthenticated user to run arbitrary code on the backend database server.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://en.logitime.com/time-attendance/; https://nl.logitime.com/; https://nl.logitime.com/download/webclock-v5-43-0-13-12-2024/
CVE: CVE-2025-0637
Published: 2025-01-23
Description: It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles. The vulnerability has been identified at least in the file or path ‘/app/tools.html’.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-beta10
CVE: CVE-2025-22264
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel WP Query Creator wp-query-creator allows Reflected XSS.This issue affects WP Query Creator: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-query-creator/vulnerability/wordpress-wp-query-creator-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22768
Published: 2025-01-23
Description: Cross-Site Request Forgery (CSRF) vulnerability in JinHan Park Rocket Media Library Mime Type rocket-media-library-mime-type allows Stored XSS.This issue affects Rocket Media Library Mime Type: from n/a through <= 2.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/rocket-media-library-mime-type/vulnerability/wordpress-rocket-media-library-mime-type-plugin-2-1-0-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23540
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin Khan WP Front-end login and register wp-front-end-login-and-register allows Reflected XSS.This issue affects WP Front-end login and register: from n/a through <= 2.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-front-end-login-and-register/vulnerability/wordpress-wp-front-end-login-and-register-plugin-2-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23541
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in edmon.parker Download, Downloads  ydn-download allows Reflected XSS.This issue affects Download, Downloads : from n/a through <= 1.4.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ydn-download/vulnerability/wordpress-download-downloads-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23544
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in heart5 StatPressCN statpresscn allows Reflected XSS.This issue affects StatPressCN: from n/a through <= 1.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/statpresscn/vulnerability/wordpress-statpresscn-plugin-1-9-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23545
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Navnish Bhardwaj WP Social Broadcast wp-social-broadcast allows Reflected XSS.This issue affects WP Social Broadcast: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-social-broadcast/vulnerability/wordpress-wp-social-broadcast-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23624
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alessandro Benoit WpDevTool wpdevtool allows Reflected XSS.This issue affects WpDevTool: from n/a through <= 0.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpdevtool/vulnerability/wordpress-wpdevtool-plugin-0-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23626
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fukushima Kumihimo kumihimo allows Reflected XSS.This issue affects Kumihimo: from n/a through <= 1.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kumihimo/vulnerability/wordpress-kumihimo-plugin-1-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23628
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NewMediaOne GeoDigs geodigs allows Reflected XSS.This issue affects GeoDigs: from n/a through <= 3.4.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/geodigs/vulnerability/wordpress-geodigs-plugin-3-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23629
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Subhasis Laha Gallerio gallerio allows Reflected XSS.This issue affects Gallerio: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gallerio/vulnerability/wordpress-gallerio-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23634
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Reflected XSS.This issue affects Youtube Video Grid: from n/a through <= 1.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/youmax-channel-embeds-for-youtube-businesses/vulnerability/wordpress-youtube-video-grid-plugin-1-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23636
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitar A. My Favorite Car my-favorite-cars allows Reflected XSS.This issue affects My Favorite Car: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/my-favorite-cars/vulnerability/wordpress-my-favorite-car-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23722
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mind3dom Mind3doM RyeBread Widgets mind3dom-ryebread-widgets allows Reflected XSS.This issue affects Mind3doM RyeBread Widgets: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mind3dom-ryebread-widgets/vulnerability/wordpress-mind3dom-ryebread-widgets-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23723
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hdw player Plestar Directory Listing plestar-directory-listing allows Reflected XSS.This issue affects Plestar Directory Listing: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/plestar-directory-listing/vulnerability/wordpress-plestar-directory-listing-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23724
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oleksandr87 University Quizzes Online university-quizzes-online allows Reflected XSS.This issue affects University Quizzes Online: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/university-quizzes-online/vulnerability/wordpress-university-quizzes-online-plugin-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23725
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pshikli Accessibility Task Manager accessibility-task-manager allows Reflected XSS.This issue affects Accessibility Task Manager: from n/a through <= 1.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/accessibility-task-manager/vulnerability/wordpress-accessibility-task-manager-plugin-1-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23727
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonzaroutski AZ Content Finder az-content-finder allows Reflected XSS.This issue affects AZ Content Finder: from n/a through <= 0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/az-content-finder/vulnerability/wordpress-az-content-finder-plugin-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23729
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fures XTRA Settings xtra-settings allows Reflected XSS.This issue affects XTRA Settings: from n/a through <= 2.1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/xtra-settings/vulnerability/wordpress-xtra-settings-plugin-2-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23730
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flx0 FLX Dashboard Groups flx-dashboard-groups allows Reflected XSS.This issue affects FLX Dashboard Groups: from n/a through <= 0.0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/flx-dashboard-groups/vulnerability/wordpress-flx-dashboard-groups-plugin-0-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23733
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sayoko SC Simple Zazzle sc-simple-zazzle allows Reflected XSS.This issue affects SC Simple Zazzle: from n/a through <= 1.1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sc-simple-zazzle/vulnerability/wordpress-sc-simple-zazzle-plugin-1-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23834
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RaminMT Links/Problem Reporter report-broken-links allows Reflected XSS.This issue affects Links/Problem Reporter: from n/a through <= 2.6.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/report-broken-links/vulnerability/wordpress-links-problem-reporter-plugin-2-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23835
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jmraya Legal + legal-plus allows Reflected XSS.This issue affects Legal +: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/legal-plus/vulnerability/wordpress-legal-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23836
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SuryaBhan Custom Coming Soon custom-coming-soon allows Reflected XSS.This issue affects Custom Coming Soon: from n/a through <= 2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-coming-soon/vulnerability/wordpress-custom-coming-soon-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23894
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tatsuya wp-flickr-press wp-flickr-press allows Reflected XSS.This issue affects wp-flickr-press: from n/a through <= 2.6.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-flickr-press/vulnerability/wordpress-wp-flickr-press-plugin-2-6-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23960
Published: 2025-01-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in basteln3rk Save & Import Image from URL save-import-image-from-url allows Reflected XSS.This issue affects Save & Import Image from URL: from n/a through <= 0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/save-import-image-from-url/vulnerability/wordpress-save-import-image-from-url-plugin-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-11147
Published: 2025-01-23
Description: ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root.
CVSS Score: 7.6 (HIGH)
CWE: CWE-798
References: https://builder.dontvacuum.me/ecopassword.php; https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf; https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
CVE: CVE-2024-12078
Published: 2025-01-23
Description: ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-321
References: https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf; https://youtu.be/_wUsM0Mlenc?t=2041
CVE: CVE-2024-12079
Published: 2025-01-23
Description: ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism.
CVSS Score: 3.3 (LOW)
CWE: CWE-312
References: https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
CVE: CVE-2024-52327
Published: 2025-01-23
Description: The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-603, CWE-807
References: https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf; https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf; https://www.ecovacs.com/global/userhelp/dsa[PII_REDACTED]2
CVE: CVE-2024-52328
Published: 2025-01-23
Description: ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.
CVSS Score: 2.3 (LOW)
CWE: CWE-732
References: https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf; https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf
CVE: CVE-2024-52329
Published: 2025-01-23
Description: ECOVACS HOME mobile app plugins for specific robots do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic and obtain authentication tokens.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf; https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf; https://www.ecovacs.com/global/userhelp/dsa[PII_REDACTED]1
CVE: CVE-2024-52330
Published: 2025-01-23
Description: ECOVACS lawnmowers and vacuums do not properly validate TLS certificates. An unauthenticated attacker can read or modify TLS traffic, possibly modifying firmware updates.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf; https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf; https://www.ecovacs.com/global/userhelp/dsa[PII_REDACTED]1
CVE: CVE-2024-52331
Published: 2025-01-23
Description: ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-494, CWE-1391
References: https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf; https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html
CVE: CVE-2024-55925
Published: 2025-01-23
Description: In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE: CVE-2025-0650
Published: 2025-01-23
Description: A flaw was found in the Open Virtual Network (OVN). Specially crafted UDP packets may bypass egress access control lists (ACLs) in OVN installations configured with a logical switch with DNS records set on it and if the same switch has any egress ACLs configured. This issue can lead to unauthorized access to virtual machines and containers running on the OVN network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://access.redhat.com/errata/RHSA-2025:1083; https://access.redhat.com/errata/RHSA-2025:1084; https://access.redhat.com/errata/RHSA-2025:1085
CVE: CVE-2024-45672
Published: 2025-01-23
Description: IBM Security Verify Bridge 1.0.0 through 1.0.15 could allow a local privileged user to overwrite files due to excessive privileges granted to the agent. which could also cause a denial of service.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-471
References: https://www.ibm.com/support/pages/node/7181370
CVE: CVE-2024-55926
Published: 2025-01-23
Description: A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data
CVSS Score: 7.6 (HIGH)
CWE: CWE-22, CWE-434
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE: CVE-2024-55927
Published: 2025-01-23
Description: A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions.
CVSS Score: 7.6 (HIGH)
CWE: CWE-798
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE: CVE-2024-55928
Published: 2025-01-23
Description: Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE: CVE-2024-55929
Published: 2025-01-23
Description: A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
CVE: CVE-2024-55930
Published: 2025-01-23
Description: Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf