deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-24494
Published: 2025-03-05
Description: Path traversal may allow remote code execution using privileged account 
(requires device admin account, cannot be performed by a regular user). 
In combination with the 'Upload' functionality this could be used to 
execute an arbitrary script or possibly an uploaded binary. Remediation 
in Version 6.7.0, release date: 20-Oct-24.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://support.ixiacom.com/; https://support.ixiacom.com/support-overview/product-support/downloads-updates; https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02
CVE: CVE-2025-24521
Published: 2025-03-05
Description: External XML entity injection allows arbitrary download of files. The 
score without least privilege principle violation is as calculated 
below. In combination with other issues it may facilitate further 
compromise of the device. Remediation in Version 6.8.0, release date: 
01-Mar-25.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611
References: https://support.ixiacom.com/; https://support.ixiacom.com/support-overview/product-support/downloads-updates; https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02
CVE: CVE-2025-27411
Published: 2025-03-05
Description: REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://github.com/redaxo/redaxo/commit/3b2159bb45da0ab6cfaef5c8cf8b602ee5e2fb37; https://github.com/redaxo/redaxo/security/advisories/GHSA-wppf-gqj5-fc4f
CVE: CVE-2025-27412
Published: 2025-03-05
Description: REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting (XSS) on the page of AddOns. This vulnerability is fixed in 5.18.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/redaxo/redaxo/security/advisories/GHSA-8366-xmgf-334f
CVE: CVE-2025-27497
Published: 2025-03-05
Description: OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3.
CWE: CWE-835
References: https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf; https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593
CVE: CVE-2024-11035
Published: 2025-03-05
Description: Carbon Black Cloud Windows Sensor, prior to 4.0.3, may be susceptible to an Information Leak vulnerability, which s a type of issue whereby sensitive information may b exposed due to a vulnerability in software.
CVSS Score: 2.5 (LOW)
CWE: CWE-497
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25472
CVE: CVE-2025-20206
Published: 2025-03-05
Description: A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client.

This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system.
CVSS Score: 7.1 (HIGH)
CWE: CWE-347
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-dll-injection-AOyzEqSg
CVE: CVE-2025-20208
Published: 2025-03-05
Description: A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.  
 This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-xss-vuln-WbTcYwxG
CVE: CVE-2024-53458
Published: 2025-03-05
Description: Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://packetstormsecurity.com/files/182468/Sysax-Multi-Server-6.99-SSH-Denial-Of-Service.html; https://packetstorm.news/files/id/182468
CVE: CVE-2024-31525
Published: 2025-03-05
Description: Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result, for example, in creating a new admin user in the system which enables persistent access for the attacker as an administrator.
CVSS Score: 7.2 (HIGH)
CWE: CWE-306
References: https://cwe.mitre.org/data/definitions/285.html; https://github.com/Peppermint-Lab/peppermint/issues/258; https://github.com/Peppermint-Lab/peppermint/issues/258
CVE: CVE-2024-48246
Published: 2025-03-05
Description: Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/booking.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ShadowByte1/CVE-2024-48246
CVE: CVE-2025-27513
Published: 2025-03-05
Description: OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime. This vulnerability is fixed in 1.11.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/open-telemetry/opentelemetry-dotnet/commit/1b555c1201413f2f55f2cd3c4ba03ef4b615b6b5; https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-8785-wc3w-h8q6
CVE: CVE-2025-27515
Published: 2025-03-05
Description: Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-155
References: https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5; https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4
CVE: CVE-2025-2003
Published: 2025-03-05
Description: Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.
CVSS Score: 7.1 (HIGH)
CWE: CWE-863, CWE-863
References: https://devolutions.net/security/advisories/DEVO-2025-0003/
CVE: CVE-2024-51144
Published: 2025-03-05
Description: Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user&action=flip_follow endpoints in Ampache <= 6.6.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/ampache/ampache; https://nitipoom-jar.github.io/CVE-2024-51144/; https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-51144
CVE: CVE-2025-27517
Published: 2025-03-05
Description: Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0.
CWE: CWE-20
References: https://github.com/livewire/volt/security/advisories/GHSA-v69f-5jxm-hwvv
CVE: CVE-2024-57174
Published: 2025-03-05
Description: A misconfiguration in Alphion ASEE-1443 Firmware v0.4.H.00.02.15 defines a previously unregistered domain name as the default DNS suffix. This allows attackers to register the unclaimed domain and point its wildcard DNS entry to an attacker-controlled IP address, making it possible to access sensitive information.
CVSS Score: 8.1 (HIGH)
References: https://chenzw.medium.com/internal-domain-names-f1cd2886c654; https://github.com/geo-chen/BSides-SG-2022---Internal-Domain-Names?tab=readme-ov-file#finding-1---cve-2024-57174-alphion-routers
CVE: CVE-2025-25362
Published: 2025-03-05
Description: A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted payload into the template field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/explosion/spacy-llm/issues/492; https://www.hacktivesecurity.com/blog/2025/04/01/cve-2025-25362-old-vulnerabilities-new-victims-breaking-llm-prompts-with-ssti/
CVE: CVE-2025-25632
Published: 2025-03-05
Description: Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/Pr0b1em/IoT/blob/master/TendaAC15v15.03.05.19telnet.md
CVE: CVE-2025-25634
Published: 2025-03-05
Description: A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src leads to stack-based buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/Pr0b1em/IoT/blob/master/TendaAC15v15.03.05.19GetParentControlInfo.md
CVE: CVE-2025-27516
Published: 2025-03-05
Description: Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1336
References: https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403; https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7; https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html
CVE: CVE-2025-27508
Published: 2025-03-05
Description: Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases (e.g., SHA-1, CRC32, and SSDEEP). These algorithms, while possibly valid for certain non-security-critical tasks, can expose users to security risks if used in scenarios where strong cryptographic guarantees are required. This issue is fixed in 8.24.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://github.com/NationalSecurityAgency/emissary/commit/da3a81a[PII_REDACTED]ff2a944820a5ae4e9762368; https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-hw43-fcmm-3m5g; https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-hw43-fcmm-3m5g
CVE: CVE-2025-27622
Published: 2025-03-05
Description: Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3495
CVE: CVE-2025-27623
Published: 2025-03-05
Description: Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3496
CVE: CVE-2025-27624
Published: 2025-03-05
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3498
CVE: CVE-2025-27625
Published: 2025-03-05
Description: In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3501
CVE: CVE-2025-22447
Published: 2025-03-06
Description: Incorrect access permission of a specific service issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. If this vulnerability is exploited, a non-administrative user on the remote PC may execute an arbitrary OS command with LocalSystem privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://help.rview.com/hc/ja/articles/[PII_REDACTED]7843-%E7%B7%8A%E6%80%A5%E3%83%91%E3%83%83%E3%83%81%E4%BD%9C%E6%A5%AD%E3%81%AE%E3%81%94%E6%A1%88%E5%86%85-2025-02-13-%E5%AE%8C%E4%BA%86; https://jvn.jp/en/jp/JVN24992507/
CVE: CVE-2025-24864
Published: 2025-03-06
Description: Incorrect access permission of a specific folder issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. If this vulnerability is exploited, a non-administrative user on the remote PC may execute an arbitrary OS command with LocalSystem privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://help.rview.com/hc/ja/articles/[PII_REDACTED]7843-%E7%B7%8A%E6%80%A5%E3%83%91%E3%83%83%E3%83%81%E4%BD%9C%E6%A5%AD%E3%81%AE%E3%81%94%E6%A1%88%E5%86%85-2025-02-13-%E5%AE%8C%E4%BA%86; https://jvn.jp/en/jp/JVN24992507/
CVE: CVE-2025-1979
Published: 2025-03-06
Description: Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password.This is only exploitable if:1) Logging is enabled;2) Redis is using password authentication;3) Those logs are accessible to an attacker, who can reach that redis instance.**Note:**It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d; https://github.com/ray-project/ray/issues/50266; https://github.com/ray-project/ray/pull/50409
CVE: CVE-2025-20903
Published: 2025-03-06
Description: Improper access control in SecSettingsIntelligence prior to SMR Mar-2025 Release 1 allows local attackers to launch privileged activities. User interaction is required for triggering this vulnerability.
CVSS Score: 7.3 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03
CVE: CVE-2025-20908
Published: 2025-03-06
Description: Use of insufficiently random values in Auracast prior to SMR Mar-2025 Release 1 allows adjacent attackers to access Auracast broadcasting.
CVSS Score: 6.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03
CVE: CVE-2025-20909
Published: 2025-03-06
Description: Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03
CVE: CVE-2025-20910
Published: 2025-03-06
Description: Incorrect default permission in Galaxy Watch Gallery prior to SMR Mar-2025 Release 1 allows local attackers to access data in Galaxy Watch Gallery.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-276
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03
CVE: CVE-2025-20911
Published: 2025-03-06
Description: Improper access control in sem_wifi service prior to SMR Mar-2025 Release 1 allows privileged local attackers to update MAC address of Galaxy Watch.
CVSS Score: 4.4 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03
CVE: CVE-2025-20912
Published: 2025-03-06
Description: Incorrect default permission in DiagMonAgent prior to SMR Mar-2025 Release 1 allows local attackers to access data within Galaxy Watch.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-922
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=03
CVE: CVE-2025-20913
Published: 2025-03-06
Description: Out-of-bounds read in applying binary of drawing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20914
Published: 2025-03-06
Description: Out-of-bounds read in applying binary of hand writing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20915
Published: 2025-03-06
Description: Out-of-bounds read in applying binary of voice content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20916
Published: 2025-03-06
Description: Out-of-bounds read in reading string of SPen in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20917
Published: 2025-03-06
Description: Out-of-bounds read in applying binary of pdf content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20918
Published: 2025-03-06
Description: Out-of-bounds read in applying extra data of base content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20919
Published: 2025-03-06
Description: Out-of-bounds read in applying binary of video content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20920
Published: 2025-03-06
Description: Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20921
Published: 2025-03-06
Description: Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20922
Published: 2025-03-06
Description: Out-of-bounds read in appending text paragraph in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20923
Published: 2025-03-06
Description: Improper access control in Galaxy Wearable prior to version 2.2.61.24112961 allows local attackers to launch arbitrary activity with Galaxy Wearable privilege.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20924
Published: 2025-03-06
Description: Improper access control in Samsung Notes prior to version 4.4.26.71 allows physical attackers to access data across multiple user profiles.
CVSS Score: 4.6 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20925
Published: 2025-03-06
Description: Out-of-bounds read in applying binary of text data in Samsung Notes prior to version 4.4.26.71 allows local attackers to potentially read memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20926
Published: 2025-03-06
Description: Improper export of Android application components in My Files prior to version 15.0.07.5 in Android 14 allows local attackers to access files with My Files' privilege.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20927
Published: 2025-03-06
Description: Out-of-bounds read in parsing image data in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20928
Published: 2025-03-06
Description: Out-of-bounds read in parsing wbmp image in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20929
Published: 2025-03-06
Description: Out-of-bounds write in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to execute arbitrary code.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03
CVE: CVE-2025-20930
Published: 2025-03-06
Description: Out-of-bounds read in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=03