deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0685
Published: 2025-03-03
Description: A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_jfs_lookup_symlink() function will write past the internal buffer length during grub_jfs_read_file(). This issue can be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution, by-passing secure boot protections.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-787
References: https://access.redhat.com/security/cve/CVE-2025-0685; https://bugzilla.redhat.com/show_bug.cgi?id=2346120
CVE: CVE-2025-0686
Published: 2025-03-03
Description: A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_romfs_read_symlink() may cause out-of-bounds writes when the calling grub_disk_read() function. This issue may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution by-passing secure boot protections.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-787
References: https://access.redhat.com/security/cve/CVE-2025-0686; https://bugzilla.redhat.com/show_bug.cgi?id=2346121
CVE: CVE-2025-27370
Published: 2025-03-03
Description: OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issuer identifiers of other Authorization Servers. The malicious Authorization Server could then use these private key JWTs to impersonate the Client.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-305
References: https://eprint.iacr.org/2025/629; https://github.com/OWASP/ASVS/issues/2678; https://openid.net/notice-of-a-security-vulnerability/
CVE: CVE-2025-27371
Published: 2025-03-03
Description: In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-305
References: https://eprint.iacr.org/2025/629; https://github.com/OWASP/ASVS/issues/2678; https://openid.net/notice-of-a-security-vulnerability/
CVE: CVE-2024-30154
Published: 2025-03-03
Description: HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0119437
CVE: CVE-2025-1877
Published: 2025-03-03
Description: A vulnerability, which was classified as critical, was found in D-Link DAP-1562 1.10. This affects the function pure_auth_check of the component HTTP POST Request Handler. The manipulation of the argument a1 leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404, CWE-476, CWE-476
References: https://vuldb.com/?ctiid.298191; https://vuldb.com/?id.298191; https://vuldb.com/?submit.506526
CVE: CVE-2025-1878
Published: 2025-03-03
Description: A vulnerability has been found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This vulnerability affects unknown code of the component WiFi. The manipulation leads to use of default password. Access to the local network is required for this attack to succeed. The complexity of an attack is rather high. The exploitation appears to be difficult. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
CVSS Score: 3.1 (LOW)
CWE: CWE-1393
References: https://github.com/geo-chen/i-Drive; https://vuldb.com/?ctiid.298192; https://vuldb.com/?id.298192
CVE: CVE-2025-1889
Published: 2025-03-03
Description: picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-646
References: https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v; https://www.sonatype.com/security-advisories/cve-2025-1889
CVE: CVE-2025-25939
Published: 2025-03-03
Description: Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/SamR2406/CVE-IDs/blob/main/Reprise%20License%20Manager%2014.2%20-%20Reflected%20Cross-Site%20Scripting%20%28CVE-2025-25939%29; https://github.com/SamR2406/CVE-IDs/blob/main/Reprise%20License%20Manager%2014.2%20-%20Reflected%20Cross-Site%20Scripting%20%28CVE-2025-25939%29
CVE: CVE-2025-25967
Published: 2025-03-03
Description: Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/padayali-JD/CVE-2025-25967
CVE: CVE-2025-26206
Published: 2025-03-03
Description: Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-352
References: https://github.com/selldone/storefront/blob/main/index.html; https://github.com/xibhi/CVE-2025-26206
CVE: CVE-2025-27499
Published: 2025-03-03
Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the processa_edicao_socio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the socio_nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.10.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/1ac0d0701ad[PII_REDACTED]4e8092ad1a5ab15d3fc; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf
CVE: CVE-2025-27500
Published: 2025-03-03
Description: OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel can be accessed without any form of authentication. This endpoint accepts an HTTP POST to upload a file which is then stored on the node and is available via URL. This can lead to a stored cross site scripting attack if the file uploaded contains malicious code and is then accessed and executed within the context of the user's browser. This function is no longer necessary as the ziti-console moves from a node server application to a single page application, and has been disabled. The vulnerability is fixed in 3.7.1.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/openziti/ziti-console/security/advisories/GHSA-frxm-vm48-5qf2
CVE: CVE-2025-27501
Published: 2025-03-03
Description: OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form of authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller and performs a server-side request, resulting in a potential Server-Side Request Forgery (SSRF) vulnerability. The fixed version has moved the request to the external controller from the server side to the client side, thereby eliminating the identity of the node from being used to gain any additional permissions. This vulnerability is fixed in 3.7.1.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/openziti/ziti-console/security/advisories/GHSA-fqxh-vfv5-8qjp
CVE: CVE-2024-10904
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51942
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51944
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51945
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51946
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51947
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51948
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51949
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51950
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51951
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51952
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51953
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51954
Published: 2025-03-03
Description: There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker to access secure services published to a standalone (unfederated) ArcGIS Server instance. Successful exploitation results in unauthorized access to protected services outside the attacker’s originally assigned authorization boundary, constituting a scope change. If exploited, this issue would have a high impact on confidentiality, a low impact on integrity, and no impact on the availability of the software.
CVSS Score: 8.5 (HIGH)
CWE: CWE-284
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51956
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51957
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51958
Published: 2025-03-03
Description: There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below.  Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory.  There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51959
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51960
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51961
Published: 2025-03-03
Description: There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server.  Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73, CWE-610
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51962
Published: 2025-03-03
Description: A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user requiring elevated, non‑administrative privileges. Exploitation is restricted to users with advanced application‑specific permissions, indicating high privileges are required. Successful exploitation would have a high impact on integrity and confidentiality, with no impact on availability.
CVSS Score: 8.7 (HIGH)
CWE: CWE-89
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51963
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2024-51966
Published: 2025-03-03
Description: There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below.  Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory.  There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/