deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54463
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-754
References: https://mattermost.com/security-updates
CVE: CVE-2025-54478
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.
CVSS Score: 7.2 (HIGH)
CWE: CWE-306
References: https://mattermost.com/security-updates
CVE: CVE-2025-54525
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoint with an invalid request body.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2025-7677
Published: 2025-08-11
Description: A denial-of-service (DoS) attack is possible if access to the local network is provided to unauthorized users. This is due to a buffer copy issue that may lead to a software crash. 
This issue affects all versions of ASPECT.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-120
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A4462&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE: CVE-2025-7679
Published: 2025-08-11
Description: The ASPECT system allows users to bypass authentication.
 This issue affects all versions of ASPECT
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A4462&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE: CVE-2025-8285
Published: 2025-08-11
Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2024-32640
Published: 2025-08-11
Description: MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/MasaCMS/MasaCMS/commit/259fc6061d022d5025a3289a3f8de9852ad9c91d; https://github.com/MasaCMS/MasaCMS/commit/280489e2d6c8daf5022fdb[PII_REDACTED]dd9d4534; https://github.com/MasaCMS/MasaCMS/commit/3d6319b8775bb6438bc822d[PII_REDACTED]11f5075
CVE: CVE-2025-40920
Published: 2025-08-11
Description: Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library.
  *  Data::UUID does not use a strong cryptographic source for generating UUIDs.
  *  Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562.
  *  The nonces should be generated from a strong cryptographic source, as per RFC 7616.
CVSS Score: 8.6 (HIGH)
CWE: CWE-338, CWE-340
References: https://datatracker.ietf.org/doc/html/rfc7616#section-5.12; https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations; https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18
CVE: CVE-2025-54878
Published: 2025-08-11
Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A heap buffer overflow vulnerability exists in NASA CryptoLib version 1.4.0 and prior in the IV setup logic for telecommand frames. The problem arises from missing bounds checks when copying the Initialization Vector (IV) into a freshly allocated buffer. An attacker can supply a crafted TC frame that causes the library to write one byte past the end of the heap buffer, leading to heap corruption and undefined behaviour. An attacker supplying a malformed telecommand frame can corrupt heap memory. This leads to undefined behaviour, which could manifest itself as a crash (denial of service) or more severe exploitation. This issue has been patched in version 1.4.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-122
References: https://github.com/nasa/CryptoLib/commit/9b5b294ec09da450d2d4d05aea2db604ead48be1; https://github.com/nasa/CryptoLib/security/advisories/GHSA-9qph-pxfm-q9g4
CVE: CVE-2025-25235
Published: 2025-08-11
Description: Server-Side Request Forgery (SSRF) in Omnissa Secure Email Gateway (SEG) in SEG prior to 2.32 running on Windows and SEG prior to 2503 running on UAG allows routing of network traffic such as HTTP requests to internal networks.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://www.omnissa.com/omsa-2025-0003/
CVE: CVE-2025-54992
Published: 2025-08-11
Description: OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity (XXE) injection vulnerability was found in OpenKilda which in combination with GHSL-2025-024 allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is running. This issue may lead to Information disclosure. This issue has been patched in version 1.164.0.
CWE: CWE-611
References: https://github.com/telstra/open-kilda/commit/1eddb4983a6287d083e3e99a56dc4c291abd347e; https://github.com/telstra/open-kilda/pull/5778; https://github.com/telstra/open-kilda/security/advisories/GHSA-43rg-6r66-6hr7
CVE: CVE-2025-55012
Published: 2025-08-11
Description: Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing user permission checks. An AI Agent could have exploited a permissions bypass vulnerability to create or modify a project-specific configuration file, leading to the execution of arbitrary commands on a victim's machine without the explicit approval that would otherwise be required. This vulnerability has been patched in version 0.197.3. A workaround for this issue involves either avoid sending prompts to the Agent Panel, or to limit the AI Agent's file system access.
CWE: CWE-284, CWE-288
References: https://github.com/zed-industries/zed/security/advisories/GHSA-x34m-39xw-g2wr
CVE: CVE-2025-55150
Published: 2025-08-11
Description: Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/html/pdf endpoint to convert HTML to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://github.com/Stirling-Tools/Stirling-PDF/commit/7d6b70871bad2a3ff810825f7382c49f55293943; https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xw8v-9mfm-g2pm
CVE: CVE-2025-55151
Published: 2025-08-11
Description: Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, the "convert file to pdf" functionality (/api/v1/convert/file/pdf) uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabilities exist during the conversion process. This issue has been patched in version 1.1.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://github.com/Stirling-Tools/Stirling-PDF/commit/7d6b70871bad2a3ff810825f7382c49f55293943; https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-76hv-h7g2-xfv3
CVE: CVE-2025-55156
Published: 2025-08-11
Description: pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.
CWE: CWE-89
References: https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271; https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f; https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf
CVE: CVE-2025-55157
Published: 2025-08-11
Description: Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1400, When processing nested tuples in Vim script, an error during evaluation can trigger a use-after-free in Vim’s internal tuple reference management. Specifically, the tuple_unref() function may access already freed memory due to improper lifetime handling, leading to memory corruption. The exploit requires direct user interaction, as the script must be explicitly executed within Vim. This issue has been patched in version 9.1.1400.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://github.com/vim/vim/commit/[PII_REDACTED]bbc46e1518abfea7f89caa95bcaf97; https://github.com/vim/vim/releases/tag/v9.1.1400; https://github.com/vim/vim/security/advisories/GHSA-3r4f-mm4w-wgg6
CVE: CVE-2025-55158
Published: 2025-08-11
Description: Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim’s internal typed value (typval_T) management. Specifically, the clear_tv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://github.com/vim/vim/commit/9772025d24e939fd84b85748ce35c26874c05775; https://github.com/vim/vim/releases/tag/v9.1.1406; https://github.com/vim/vim/security/advisories/GHSA-5fg8-wvx3-583x
CVE: CVE-2025-55159
Published: 2025-08-11
Description: slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.
CWE: CWE-119
References: https://github.com/tokio-rs/slab/commit/2d65c514bc964b192bab212ddf3c1fcea4ae96b8; https://github.com/tokio-rs/slab/pull/152; https://github.com/tokio-rs/slab/security/advisories/GHSA-qx2v-8332-m4fv
CVE: CVE-2025-55161
Published: 2025-08-11
Description: Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://github.com/Stirling-Tools/Stirling-PDF/commit/7d6b70871bad2a3ff810825f7382c49f55293943; https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-ff33-grr6-rmvp
CVE: CVE-2025-42934
Published: 2025-08-12
Description: SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into the 'Trusted Sites' configuration by injecting line feed (LF) characters into application inputs. This vulnerability has a low impact on the application's integrity and no impact on confidentiality or availability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-113
References: https://me.sap.com/notes/3616863; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42935
Published: 2025-08-12
Description: The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privileges and local access to log files to read sensitive information, resulting in information disclosure. This leads to high impact on the confidentiality of the application, with no impact on integrity or availability.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-532
References: https://me.sap.com/notes/3601480; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42936
Published: 2025-08-12
Description: The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266
References: https://me.sap.com/notes/3602656; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42941
Published: 2025-08-12
Description: SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link (<a>) elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary for certain configurations, the attacker does not need the administrative privileges to execute the attack. This could result in unintended manipulation of user sessions or exposure of sensitive information. The issue impacts the confidentiality and integrity of the system, but the availability remains unaffected.
CVSS Score: 3.5 (LOW)
CWE: CWE-1022
References: https://me.sap.com/notes/3624943; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42942
Published: 2025-08-12
Description: SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could access and modify limited information within the scope of victim's browser. This vulnerability has no impact on availability of the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3597355; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42943
Published: 2025-08-12
Description: SAP GUI for Windows may allow the leak of NTML hashes when specific ABAP frontend services are called with UNC paths. For a successful attack, the attacker needs developer authorization in a specific Application Server ABAP to make changes in the code, and the victim needs to execute by using SAP GUI for Windows. This could trigger automatic NTLM authentication, potentially exposing hashed credentials to an attacker. As a result, it has a high impact on the confidentiality.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-250
References: https://me.sap.com/notes/3627845; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42945
Published: 2025-08-12
Description: SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or its manipulation. There is no impact on availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://me.sap.com/notes/3585491; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42946
Published: 2025-08-12
Description: Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank Communication Management could gain unauthorized access to sensitive operating system files. This could allow the attacker to potentially read or delete these files hence causing a high impact on confidentiality and low impact on integrity. There is no impact on availability of the system.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-22
References: https://me.sap.com/notes/3614804; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42948
Published: 2025-08-12
Description: Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resulting in the creation of malicious content. When this malicious content gets executed, the attacker could gain the ability to access/modify information within the scope of victim�s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3629871; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42949
Published: 2025-08-12
Description: Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3626722; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42950
Published: 2025-08-12
Description: SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://me.sap.com/notes/3633838; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42951
Published: 2025-08-12
Description: Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result , it has a high impact on the confidentiality, integrity, and availability of the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://me.sap.com/notes/3625403; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42955
Published: 2025-08-12
Description: Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted request to the endpoint responsible for testing LDAP connections. A successful exploit could lead to reduced performance, hence a low-impact on availability of the service. Confidentiality and integrity of the data are not affected.
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://me.sap.com/notes/3611345; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42957
Published: 2025-08-12
Description: SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://me.sap.com/notes/3627998; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42975
Published: 2025-08-12
Description: SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a malicious script. When a victim clicks on this link, the script executes in the victim's browser, allowing the attacker to access and/or modify information related to the web client without affecting availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3611184; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42976
Published: 2025-08-12
Description: SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory corruption error. On successful exploitation, this results in the crash of the target component. Multiple submissions can make the target completely unavailable. A similarly crafted submission can be used to perform an out-of-bounds read operation as well, revealing sensitive information that is loaded in memory at that time. There is no ability to modify any information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://me.sap.com/notes/3611184; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-4390
Published: 2025-08-12
Description: The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/wp-private-content-plus/trunk/classes/class-wppcp-private-posts-pages.php#L138; https://plugins.trac.wordpress.org/browser/wp-private-content-plus/trunk/classes/class-wppcp-private-posts-pages.php#L211; https://www.wordfence.com/threat-intel/vulnerabilities/id/4c[PII_REDACTED]-4b77-a484-d7c51d829792?source=cve
CVE: CVE-2025-5391
Published: 2025-08-12
Description: The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/wc-purchase-orders/trunk/includes/class-bbpo-purchase-orders-files.php#L148; https://plugins.trac.wordpress.org/browser/wc-purchase-orders/trunk/includes/class-bbpo-purchase-orders.php#L151; https://plugins.trac.wordpress.org/changeset/3356360/
CVE: CVE-2025-8462
Published: 2025-08-12
Description: The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the social URL parameter in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/rt-easy-builder-advanced-addons-for-elementor/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb02fd7-1090-4139-ae0e-977fdec5da7f?source=cve