deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1224
Published: 2025-02-12
Description: A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/mapper/xml/UserMapper.xml. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/r1bbit/yimioa/issues/IBI731; https://vuldb.com/?ctiid.295210; https://vuldb.com/?id.295210
CVE: CVE-2025-1225
Published: 2025-02-12
Description: A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to xml external entity reference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-610, CWE-611, CWE-611
References: https://gitee.com/r1bbit/yimioa/issues/IBI81R; https://vuldb.com/?ctiid.295211; https://vuldb.com/?id.295211
CVE: CVE-2024-12673
Published: 2025-02-12
Description: An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow a local attacker to elevate privileges on the system.

This vulnerability only affects Vantage installed on these devices:

  *  Lenovo V Series (Gen 5)
  *  ThinkBook 14 (Gen 6, 7)
  *  ThinkBook 16 (Gen 6, 7)
  *  ThinkPad E Series (Gen 1)
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://support.lenovo.com/us/en/product_security/LEN-183176
CVE: CVE-2025-0108
Published: 2025-02-12
Description: An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access software.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://security.paloaltonetworks.com/CVE-2025-0108; https://github.com/iSee857/CVE-2025-0108-PoC; https://slcyber.io/blog/nginx-apache-path-confusion-to-auth-bypass-in-pan-os/
CVE: CVE-2025-0109
Published: 2025-02-12
Description: An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files.


You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access software.
CWE: CWE-73
References: https://security.paloaltonetworks.com/CVE-2024-0109
CVE: CVE-2025-0110
Published: 2025-02-12
Description: A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands. The commands are run as the “__openconfig” user (which has the Device Administrator role) on the firewall.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2025-0110
CVE: CVE-2025-0111
Published: 2025-02-12
Description: An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.

You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended  best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .



This issue does not affect Cloud NGFW or Prisma Access software.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://security.paloaltonetworks.com/CVE-2025-0111; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0111
CVE: CVE-2025-0113
Published: 2025-02-12
Description: A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to the Cortex XDR server.
CWE: CWE-424
References: https://security.paloaltonetworks.com/CVE-2025-0113
CVE: CVE-2025-1226
Published: 2025-02-12
Description: A vulnerability was found in ywoa up to 2024.07.03. It has been declared as critical. This vulnerability affects unknown code of the file /oa/setup/setup.jsp. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://gitee.com/r1bbit/yimioa/issues/IBI7PG; https://vuldb.com/?ctiid.295216; https://vuldb.com/?id.295216
CVE: CVE-2025-1227
Published: 2025-02-12
Description: A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mapper/xml/AddressDao.xml. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/r1bbit/yimioa/issues/IBI7XH; https://vuldb.com/?ctiid.295217; https://vuldb.com/?id.295217
CVE: CVE-2022-31631
Published: 2025-02-12
Description: In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-74
References: https://bugs.php.net/bug.php?id=81740; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugs.php.net/bug.php?id=81740
CVE: CVE-2023-29164
Published: 2025-02-12
Description: Improper access control in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, before version 02.01.0017 and Intel(R) Server Board M50CYP and Intel(R) Server Board D50TNP before version R01.01.0009 may allow an authenticated user to enable escalation of privilege via local access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00990.html
CVE: CVE-2023-31276
Published: 2025-02-12
Description: Heap-based buffer overflow in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, before version 02.01.0017 and Intel(R) Server Board M50CYP and Intel(R) Server Board D50TNP before version R01.01.0009 may allow a privileged user to enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-122
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00990.html
CVE: CVE-2023-32277
Published: 2025-02-12
Description: Untrusted Pointer Dereference in I/O subsystem for some Intel(R) QAT software before version 2.0.5 may allow authenticated user to potentially enable information disclosure via local operating system access.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-822
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01124.html
CVE: CVE-2023-34440
Published: 2025-02-12
Description: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html
CVE: CVE-2023-43758
Published: 2025-02-12
Description: Improper input validation in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html
CVE: CVE-2023-48267
Published: 2025-02-12
Description: Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.9 (HIGH)
CWE: CWE-119
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01203.html; https://www.dell.com/support/kbdoc/en-us/000236851/dsa-2025-002
CVE: CVE-2023-48366
Published: 2025-02-12
Description: Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01203.html
CVE: CVE-2023-49603
Published: 2025-02-12
Description: Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01203.html
CVE: CVE-2023-49615
Published: 2025-02-12
Description: Improper input validation in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01203.html
CVE: CVE-2023-49618
Published: 2025-02-12
Description: Improper buffer restrictions in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01203.html
CVE: CVE-2024-21830
Published: 2025-02-12
Description: Uncontrolled search path in some Intel(R) VPL software before version 2023.4.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01044.html
CVE: CVE-2024-21859
Published: 2025-02-12
Description: Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01198.html
CVE: CVE-2024-24582
Published: 2025-02-12
Description: Improper input validation in XmlCli feature for UEFI firmware for some Intel(R) processors may allow privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html
CVE: CVE-2024-24852
Published: 2025-02-12
Description: Uncontrolled search path in some Intel(R) Ethernet Adapter Complete Driver Pack install before versions 29.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01144.html
CVE: CVE-2024-25571
Published: 2025-02-12
Description: Improper input validation in some Intel(R) SPS firmware before SPS_E5_06.01.04.059.0 may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 2.3 (LOW)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01120.html
CVE: CVE-2024-26021
Published: 2025-02-12
Description: Improper initialization in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 2.3 (LOW)
CWE: CWE-665
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01152.html
CVE: CVE-2024-28047
Published: 2025-02-12
Description: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html
CVE: CVE-2024-28127
Published: 2025-02-12
Description: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html
CVE: CVE-2024-29214
Published: 2025-02-12
Description: Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html
CVE: CVE-2024-29223
Published: 2025-02-12
Description: Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01124.html
CVE: CVE-2024-30211
Published: 2025-02-12
Description: Improper access control in some Intel(R) ME driver pack installer engines before version 2422.6.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-284
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01152.html
CVE: CVE-2024-31068
Published: 2025-02-12
Description: Improper Finite State Machines (FSMs) in Hardware Logic for some Intel(R) Processors may allow privileged user to potentially enable denial of service via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1245
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01166.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html
CVE: CVE-2024-31153
Published: 2025-02-12
Description: Improper input validation for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01124.html
CVE: CVE-2024-31155
Published: 2025-02-12
Description: Improper buffer restrictions in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01198.html
CVE: CVE-2024-31157
Published: 2025-02-12
Description: Improper initialization in UEFI firmware OutOfBandXML module in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-665
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html
CVE: CVE-2024-31858
Published: 2025-02-12
Description: Out-of-bounds write for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01124.html
CVE: CVE-2024-32938
Published: 2025-02-12
Description: Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01207.html
CVE: CVE-2024-32941
Published: 2025-02-12
Description: NULL pointer dereference for some Intel(R) MLC software before version v3.11b may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 7.9 (HIGH)
CWE: CWE-476
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01238.html
CVE: CVE-2024-32942
Published: 2025-02-12
Description: Incorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01156.html
CVE: CVE-2024-36262
Published: 2025-02-12
Description: Race condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-362
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01203.html
CVE: CVE-2024-36274
Published: 2025-02-12
Description: Out-of-bounds write in the Intel(R) 800 Series Ethernet Driver for Intel(R) Ethernet Adapter Complete Driver Pack before versions 29.1 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01144.html
CVE: CVE-2024-36280
Published: 2025-02-12
Description: Uncontrolled search path for some Intel(R) High Level Synthesis Compiler software before version 24.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01214.html
CVE: CVE-2024-36283
Published: 2025-02-12
Description: Uncontrolled search path for the Intel(R) Thread Director Visualizer software before version 1.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01232.html
CVE: CVE-2024-36285
Published: 2025-02-12
Description: Race condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-362
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01224.html
CVE: CVE-2024-36291
Published: 2025-02-12
Description: Uncontrolled search path for some Intel(R) Chipset Software Installation Utility before version 10.1.19867.8574 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01184.html
CVE: CVE-2024-36293
Published: 2025-02-12
Description: Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01213.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html; https://www.dell.com/support/kbdoc/en-us/000283897/dsa-2025-041-security-update-for-dell-poweredge-server-for-intel-2025-security-advisories-2025-1-ipu
CVE: CVE-2024-37020
Published: 2025-02-12
Description: Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 3.8 (LOW)
CWE: CWE-1281
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01194.html; https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html
CVE: CVE-2024-37355
Published: 2025-02-12
Description: Improper access control in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01235.html
CVE: CVE-2024-38307
Published: 2025-02-12
Description: Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authenticated user to potentially enable denial of service via network access.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01152.html
CVE: CVE-2024-38310
Published: 2025-02-12
Description: Improper access control in some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01235.html
CVE: CVE-2024-39271
Published: 2025-02-12
Description: Improper restriction of communication channel to intended endpoints in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software before version 23.80 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
CVSS Score: 2.6 (LOW)
CWE: CWE-923
References: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01224.html