deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-21304
Published: 2025-01-14
Description: Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21304
CVE: CVE-2025-21305
Published: 2025-01-14
Description: Windows Telephony Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21305
CVE: CVE-2025-21306
Published: 2025-01-14
Description: Windows Telephony Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21306
CVE: CVE-2025-21307
Published: 2025-01-14
Description: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21307
CVE: CVE-2025-21308
Published: 2025-01-14
Description: Windows Themes Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21308
CVE: CVE-2025-21309
Published: 2025-01-14
Description: Windows Remote Desktop Services Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-591
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21309
CVE: CVE-2025-21310
Published: 2025-01-14
Description: Windows Digital Media Elevation of Privilege Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21310
CVE: CVE-2025-21311
Published: 2025-01-14
Description: Windows NTLM V1 Elevation of Privilege Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-303
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21311
CVE: CVE-2025-21312
Published: 2025-01-14
Description: Windows Smart Card Reader Information Disclosure Vulnerability
CVSS Score: 2.4 (LOW)
CWE: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21312
CVE: CVE-2025-21313
Published: 2025-01-14
Description: Windows Security Account Manager (SAM) Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-833
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21313
CVE: CVE-2025-21314
Published: 2025-01-14
Description: Windows SmartScreen Spoofing Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21314
CVE: CVE-2025-21315
Published: 2025-01-14
Description: Microsoft Brokering File System Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21315
CVE: CVE-2025-21316
Published: 2025-01-14
Description: Windows Kernel Memory Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21316
CVE: CVE-2025-21317
Published: 2025-01-14
Description: Windows Kernel Memory Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21317
CVE: CVE-2025-21318
Published: 2025-01-14
Description: Windows Kernel Memory Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21318
CVE: CVE-2025-21319
Published: 2025-01-14
Description: Windows Kernel Memory Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21319
CVE: CVE-2025-21320
Published: 2025-01-14
Description: Windows Kernel Memory Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21320
CVE: CVE-2025-21321
Published: 2025-01-14
Description: Windows Kernel Memory Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21321
CVE: CVE-2025-21323
Published: 2025-01-14
Description: Windows Kernel Memory Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21323
CVE: CVE-2025-21324
Published: 2025-01-14
Description: Windows Digital Media Elevation of Privilege Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21324
CVE: CVE-2025-21326
Published: 2025-01-14
Description: Internet Explorer Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21326
CVE: CVE-2025-21327
Published: 2025-01-14
Description: Windows Digital Media Elevation of Privilege Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21327
CVE: CVE-2025-21328
Published: 2025-01-14
Description: MapUrlToZone Security Feature Bypass Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-41
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21328
CVE: CVE-2025-21329
Published: 2025-01-14
Description: MapUrlToZone Security Feature Bypass Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-41
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21329
CVE: CVE-2025-21330
Published: 2025-01-14
Description: Windows Remote Desktop Services Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21330
CVE: CVE-2025-21331
Published: 2025-01-14
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21331
CVE: CVE-2025-21332
Published: 2025-01-14
Description: MapUrlToZone Security Feature Bypass Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-41
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21332
CVE: CVE-2025-21333
Published: 2025-01-14
Description: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21333; https://www.exploit-db.com/exploits/52436; https://www.vicarius.io/vsociety/posts/cve-2025-21333-elevated-privilege-exposure-in-windows-hyper-v-by-microsoft-detection-script
CVE: CVE-2025-21334
Published: 2025-01-14
Description: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21334; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21334
CVE: CVE-2025-21335
Published: 2025-01-14
Description: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21335; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21335
CVE: CVE-2025-21336
Published: 2025-01-14
Description: Windows Cryptographic Information Disclosure Vulnerability
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-203
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21336
CVE: CVE-2025-21338
Published: 2025-01-14
Description: GDI+ Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21338
CVE: CVE-2025-21339
Published: 2025-01-14
Description: Windows Telephony Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21339
CVE: CVE-2025-21340
Published: 2025-01-14
Description: Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21340
CVE: CVE-2025-21341
Published: 2025-01-14
Description: Windows Digital Media Elevation of Privilege Vulnerability
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21341
CVE: CVE-2025-21343
Published: 2025-01-14
Description: Windows Web Threat Defense User Service Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21343
CVE: CVE-2025-21344
Published: 2025-01-14
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21344
CVE: CVE-2025-21345
Published: 2025-01-14
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21345
CVE: CVE-2025-21346
Published: 2025-01-14
Description: Microsoft Office Security Feature Bypass Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21346
CVE: CVE-2025-21348
Published: 2025-01-14
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21348
CVE: CVE-2025-21354
Published: 2025-01-14
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 8.4 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21354
CVE: CVE-2025-21356
Published: 2025-01-14
Description: Microsoft Office Visio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21356
CVE: CVE-2025-21357
Published: 2025-01-14
Description: Microsoft Outlook Remote Code Execution Vulnerability
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21357
CVE: CVE-2025-21360
Published: 2025-01-14
Description: Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21360
CVE: CVE-2025-21361
Published: 2025-01-14
Description: Microsoft Outlook Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-641
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21361
CVE: CVE-2025-21362
Published: 2025-01-14
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21362
CVE: CVE-2025-21363
Published: 2025-01-14
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21363
CVE: CVE-2025-21364
Published: 2025-01-14
Description: Microsoft Excel Security Feature Bypass Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21364
CVE: CVE-2025-21365
Published: 2025-01-14
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21365
CVE: CVE-2025-21366
Published: 2025-01-14
Description: Microsoft Access Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21366
CVE: CVE-2025-21370
Published: 2025-01-14
Description: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21370
CVE: CVE-2025-21372
Published: 2025-01-14
Description: Microsoft Brokering File System Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21372
CVE: CVE-2025-21374
Published: 2025-01-14
Description: Windows CSC Service Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21374
CVE: CVE-2025-21378
Published: 2025-01-14
Description: Windows CSC Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21378
CVE: CVE-2025-21382
Published: 2025-01-14
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21382
CVE: CVE-2025-21389
Published: 2025-01-14
Description: Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21389
CVE: CVE-2025-21393
Published: 2025-01-14
Description: Microsoft SharePoint Server Spoofing Vulnerability
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21393
CVE: CVE-2025-21395
Published: 2025-01-14
Description: Microsoft Access Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21395
CVE: CVE-2025-21402
Published: 2025-01-14
Description: Microsoft Office OneNote Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-641
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21402
CVE: CVE-2025-21403
Published: 2025-01-14
Description: On-Premises Data Gateway Information Disclosure Vulnerability
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-863
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21403
CVE: CVE-2025-21405
Published: 2025-01-14
Description: Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21405
CVE: CVE-2025-21409
Published: 2025-01-14
Description: Windows Telephony Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21409
CVE: CVE-2025-21411
Published: 2025-01-14
Description: Windows Telephony Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21411
CVE: CVE-2025-21413
Published: 2025-01-14
Description: Windows Telephony Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21413
CVE: CVE-2025-21417
Published: 2025-01-14
Description: Windows Telephony Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21417
CVE: CVE-2025-21607
Published: 2025-01-14
Description: Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. None the less an advisory has been made out of an abundance of caution. This issue is fixed in 0.4.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-670
References: https://github.com/vyperlang/vyper/commit/7136eab0a254aa2ff7ddca41cc05f2ee1fa99caf; https://github.com/vyperlang/vyper/pull/4451; https://github.com/vyperlang/vyper/security/advisories/GHSA-vgf2-gvx8-xwc3
CVE: CVE-2025-23025
Published: 2025-01-14
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. NOTE: The Realtime WYSIWYG Editor extension was **experimental**, and thus **not recommended**, in the versions affected by this vulnerability. It has become enabled by default, and thus recommended, starting with XWiki 16.9.0. A user with only **edit right** can join a realtime editing session where others, that where already there or that may join later, have **script** or **programming** access rights. This user can then insert **script rendering macros** that are executed for those users in the realtime session that have script or programming rights. The inserted scripts can be used to gain more access rights. This vulnerability has been patched in XWiki 15.10.2, 16.4.1 and 16.6.0-rc-1. Users are advised to upgrade. Users unable to upgrade may either disable the realtime WYSIWYG editing by disabling the ``xwiki-realtime`` CKEditor plugin from the WYSIWYG editor administration section or uninstall the Realtime WYSIWYG Editorextension (org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui).
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-862
References: https://extensions.xwiki.org/xwiki/bin/view/Extension/CKEditor+Integration#HAdministrationSection; https://extensions.xwiki.org/xwiki/bin/view/Extension/Realtime%20WYSIWYG%20Editor; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rmm7-r7wr-xpfg
CVE: CVE-2025-23051
Published: 2025-01-14
Description: An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated user to leverage parameter injection to overwrite arbitrary system files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us&docLocale=en_US
CVE: CVE-2025-23052
Published: 2025-01-14
Description: Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us&docLocale=en_US
CVE: CVE-2025-23366
Published: 2025-01-14
Description: A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHSA-2025:10924; https://access.redhat.com/errata/RHSA-2025:10925; https://access.redhat.com/errata/RHSA-2025:10926
CVE: CVE-2024-48854
Published: 2025-01-14
Description: Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the context of the process using the image codec.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-193, CWE-193
References: https://support.blackberry.com/pkb/s/article/140334
CVE: CVE-2024-48855
Published: 2025-01-14
Description: Out-of-bounds read in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the context of the process using the image codec.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.blackberry.com/pkb/s/article/140334
CVE: CVE-2024-48856
Published: 2025-01-14
Description: Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition or execute code in the context of the process using the image codec.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://support.blackberry.com/pkb/s/article/140334
CVE: CVE-2024-48857
Published: 2025-01-14
Description: NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition in the context of the process using the image codec.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://support.blackberry.com/pkb/s/article/140334
CVE: CVE-2024-49375
Published: 2025-01-14
Description: Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution. The prerequisites for this are: 1. The HTTP API must be enabled on the Rasa instance eg with `--enable-api`. This is not the default configuration. 2. For unauthenticated RCE to be exploitable, the user must not have configured any authentication or other security controls recommended in our documentation. 3. For authenticated RCE, the attacker must posses a valid authentication token or JWT to interact with the Rasa API. This issue has been addressed in rasa version 3.6.21 and all users are advised to upgrade. Users unable to upgrade should ensure that they require authentication and that only trusted users are given access.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-94, CWE-502
References: https://github.com/RasaHQ/rasa-pro-security-advisories/security/advisories/GHSA-cpv4-ggrr-7j9v