deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2240
Published: 2025-03-12
Description: A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1325
References: https://access.redhat.com/errata/RHSA-2025:3376; https://access.redhat.com/errata/RHSA-2025:3541; https://access.redhat.com/errata/RHSA-2025:3543
CVE: CVE-2025-0813
Published: 2025-03-12
Description: CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an
unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to
reboot the workstation and interrupt the normal boot process.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-070-02.pdf
CVE: CVE-2025-0883
Published: 2025-03-12
Description: Improper Neutralization of Script in an Error Message Web Page vulnerability in OpenText™ Service Manager. 

The vulnerability could reveal sensitive information retained by the browser.

This issue affects Service Manager: 9.70, 9.71, 9.72, 9.80.
CWE: CWE-81
References: https://portal.microfocus.com/s/article/KM000037099?language=en_US
CVE: CVE-2025-0884
Published: 2025-03-12
Description: Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. 

The vulnerability could allow a user to gain SYSTEM privileges through Privilege Escalation.

This issue affects Service Manager: 9.70, 9.71, 9.72.
CWE: CWE-428
References: https://portal.microfocus.com/s/article/KM000036731?language=en_US
CVE: CVE-2025-1683
Published: 2025-03-12
Description: Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged access on a Windows system to delete arbitrary files on the device by exploiting symbolic links.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://capec.mitre.org/data/definitions/27.html; https://cwe.mitre.org/data/definitions/59.html; https://nvd.nist.gov/vuln/detail/CVE-2025-1683
CVE: CVE-2025-1960
Published: 2025-03-12
Description: CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an
attacker to execute unauthorized commands when a system’s default password credentials have not been
changed on first use. The default username is not displayed correctly in the WebHMI interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-070-03.pdf
CVE: CVE-2025-1984
Published: 2025-03-12
Description: Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-428
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/03/Xerox-Security-Bulletin-XRX25-006-for-Xerox-Desktop-Print-Experience.pdf
CVE: CVE-2025-20115
Published: 2025-03-12
Description: A vulnerability in confederation implementation for the Border Gateway Protocol (BGP)&nbsp;in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

This vulnerability is due to a memory corruption that occurs when a BGP update is created with an AS_CONFED_SEQUENCE attribute that has 255 autonomous system numbers (AS numbers). An attacker could exploit this vulnerability by sending a crafted BGP update message, or the network could be designed in such a manner that the AS_CONFED_SEQUENCE attribute grows to 255 AS numbers or more. A successful exploit could allow the attacker to cause memory corruption, which may cause the BGP process to restart, resulting in a DoS condition. To exploit this vulnerability, an attacker must control a BGP confederation speaker within the same autonomous system as the victim, or the network must be designed in such a manner that the AS_CONFED_SEQUENCE attribute grows to 255 AS numbers or more.
CVSS Score: 8.6 (HIGH)
CWE: CWE-120
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bgp-dos-O7stePhX
CVE: CVE-2025-20138
Published: 2025-03-12
Description: A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device.

This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-GFQjxvOF
CVE: CVE-2025-20141
Published: 2025-03-12
Description: A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an unauthenticated, adjacent attacker to cause control plane traffic to stop working on multiple Cisco IOS XR platforms.&nbsp;

This vulnerability is due to incorrect handling of packets that are punted to the route processor. An attacker could exploit this vulnerability by sending traffic, which must be handled by the Linux stack on the route processor, to an affected device. A successful exploit could allow the attacker to cause control plane traffic to stop working, resulting in a denial of service (DoS) condition.
CVSS Score: 7.4 (HIGH)
CWE: CWE-770
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr792-bWfVDPY
CVE: CVE-2025-20142
Published: 2025-03-12
Description: A vulnerability in the IPv4 access control list (ACL) feature and quality of service (QoS) policy feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause a line card to reset, resulting in a denial of service (DoS) condition.

This vulnerability is due to the incorrect handling of malformed IPv4 packets that are received on line cards where the interface has either an IPv4 ACL or QoS policy applied. An attacker could exploit this vulnerability by sending crafted IPv4 packets through an affected device. A successful exploit could allow the attacker to cause network processor errors, resulting in a reset or shutdown of the network process. Traffic over that line card would be lost while the line card reloads.
Note: This vulnerability has predominantly been observed in Layer 2 VPN (L2VPN) environments where an IPv4 ACL or QoS policy has been applied to the bridge virtual interface. Layer 3 configurations where the interface has either an IPv4 ACL or QoS policy applied are also affected, though the vulnerability has not been observed.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv4uni-LfM3cfBu
CVE: CVE-2025-20143
Published: 2025-03-12
Description: A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Secure Boot functionality and load unverified software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges on the affected device.

This vulnerability is due to insufficient verification of modules in the software load process. An attacker could exploit this vulnerability by manipulating the loaded binaries to bypass some of the integrity checks that are performed during the booting process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass the requirement to run Cisco-signed images or alter the security properties of the running system.
Note: This vulnerability affects Cisco IOS XR Software, not the Secure Boot feature.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-lkm-zNErZjbZ
CVE: CVE-2025-20144
Published: 2025-03-12
Description: A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.

This vulnerability is due to incorrect handling of packets when a specific configuration of the hybrid ACL exists. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass a configured ACL on the affected device.
For more information, see the  section of this advisory.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs-hybridacl-crMZFfKQ
CVE: CVE-2025-20145
Published: 2025-03-12
Description: A vulnerability in the access control list (ACL) processing in the egress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.

This vulnerability exists because certain packets are handled incorrectly when they are received on an ingress interface on one line card and destined out of an egress interface on another line card where the egress ACL is configured. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an egress ACL on the affected device.
For more information about this vulnerability, see the  section of this advisory.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-modular-ACL-u5MEPXMm
CVE: CVE-2025-20146
Published: 2025-03-12
Description: A vulnerability in the Layer 3 multicast feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause a line card to reset, resulting in a denial of service (DoS) condition.

This vulnerability is due to the incorrect handling of malformed IPv4 multicast packets that are received on line cards where the interface has either an IPv4 access control list (ACL) or a QoS policy applied. An attacker could exploit this vulnerability by sending crafted IPv4 multicast packets through an affected device. A successful exploit could allow the attacker to cause line card exceptions or a hard reset. Traffic over that line card would be lost while the line card reloads.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multicast-ERMrSvq7
CVE: CVE-2025-20177
Published: 2025-03-12
Description: A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR image signature verification and load unverified software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges on the affected device.

This vulnerability is due to incomplete validation of files in the boot verification process. An attacker could exploit this vulnerability by manipulating the system configuration options to bypass some of the integrity checks that are performed during the boot process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass the requirement to run Cisco-signed images or alter the security properties of the running system.
Note: Because exploitation of this vulnerability could result in the attacker bypassing Cisco image verification, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-274
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xr-verii-bypass-HhPwQRvx
CVE: CVE-2025-20209
Published: 2025-03-12
Description: A vulnerability in the Internet Key Exchange version 2 (IKEv2) function of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent an affected device from processing any control plane UDP packets.&nbsp;

This vulnerability is due to improper handling of malformed IKEv2 packets. An attacker could exploit this vulnerability by sending malformed IKEv2 packets to an affected device. A successful exploit could allow the attacker to prevent the affected device from processing any control plane UDP packets, resulting in a denial of service (DoS) condition.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://blog.apnic.net/2024/09/02/crafting-endless-as-paths-in-bgp/; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrike-9wYGpRGq
CVE: CVE-2025-25565
Published: 2025-03-12
Description: SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions. NOTE: the Supplier disputes this because the behavior only allows a user to attack himself by typing a long string on a command line.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25565.pdf; https://lzydry.github.io/CVE-2025-25565/; https://lzydry.github.io/CVE-2025-25565/
CVE: CVE-2025-25566
Published: 2025-03-12
Description: Memory Leak vulnerability in SoftEtherVPN 5.02.5187 allows an attacker to cause a denial of service via the UnixMemoryAlloc function. NOTE: the Supplier disputes this because the behavior is limited to a single allocation of a few hundred bytes with a command-line tool.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-401
References: https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25566.pdf; https://lzydry.github.io/CVE-2025-25566/
CVE: CVE-2025-25567
Published: 2025-03-12
Description: SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function. NOTE: the Supplier disputes this because the behavior only enables a local user to attack himself through the UI,
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25567.pdf; https://lzydry.github.io/CVE-2025-25567/; https://lzydry.github.io/CVE-2025-25567/
CVE: CVE-2025-25568
Published: 2025-03-12
Description: SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function. NOTE: the Supplier disputes this because the use-after-free is not in the VPN software, but is instead in a separate tool that has no untrusted input and runs under the user's own privileges (it is a stress-testing tool for a networking stack).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25568.pdf; https://lzydry.github.io/CVE-2025-25568/; https://lzydry.github.io/CVE-2025-25568/
CVE: CVE-2025-25711
Published: 2025-03-12
Description: An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the [/tnexus/rest/admin/updateUser] API endpoint
CVSS Score: 8.8 (HIGH)
CWE: CWE-281
References: https://github.com/z5jt/vulnerability-research/tree/main/CVE-2025-25710
CVE: CVE-2025-26260
Published: 2025-03-12
Description: Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://ahmetakan.com/2025/02/14/cve-2025-26260/; https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260; https://github.com/plentico/plenti/releases/tag/v0.7.17
CVE: CVE-2025-27867
Published: 2025-03-12
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin.

This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0.

Users are recommended to upgrade to version 1.2.2, which fixes the issue.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/y83f2rvm8bccr5ctgv7mzxd69p6f77dp; http://www.openwall.com/lists/oss-security/2025/03/12/3
CVE: CVE-2025-2002
Published: 2025-03-12
Description: CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure
of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an
administrative user and the debug files are exported from the device.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-532
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-070-01.pdf
CVE: CVE-2024-34398
Published: 2025-03-12
Description: An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-80
References: https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2025-25683
Published: 2025-03-12
Description: AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-284
References: https://aleksis.org/news/2025/01/security-advisory-cve-2025-25683-pdf-files-accessible-without-authentication/; https://edugit.org/AlekSIS/official/AlekSIS-Core/-/issues/1180
CVE: CVE-2025-25774
Published: 2025-03-12
Description: An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal state machine, leading to an AMF crash and resulting in a Denial of Service (DoS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-691
References: https://github.com/guoweifk/BugReport/blob/main/Open5GS%20AMF%20Denial%20of%20Service%20via%20GMM%20State%20Handling%20in%20Handover; https://github.com/open5gs/open5gs/commit/2e68706f1eea029d5172ccad946e78b352c031d0; https://github.com/open5gs/open5gs/issues/3671
CVE: CVE-2025-27017
Published: 2025-03-12
Description: Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-538
References: https://lists.apache.org/thread/d4n5474jkhp82dvnht13pjtlfx7bhn5q; http://www.openwall.com/lists/oss-security/2025/03/11/1
CVE: CVE-2025-0114
Published: 2025-03-12
Description: A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a period of time. This issue affects both the GlobalProtect portal and the GlobalProtect gateway.

This issue does not apply to Cloud NGFWs or Prisma Access software.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://security.paloaltonetworks.com/CVE-2025-0114
CVE: CVE-2025-0115
Published: 2025-03-12
Description: A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files.

The attacker must have network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. You can greatly reduce the risk of this issue by restricting access to the management interface to only trusted users and internal IP addresses according to our recommended  critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue does not affect Cloud NGFW or Prisma Access.
CWE: CWE-41
References: https://security.paloaltonetworks.com/CVE-2025-0115
CVE: CVE-2025-0116
Published: 2025-03-12
Description: A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a specially crafted LLDP frame sent by an unauthenticated adjacent attacker. Repeated attempts to initiate this condition causes the firewall to enter maintenance mode.

This issue does not apply to Cloud NGFWs or Prisma Access software.
CWE: CWE-754
References: https://security.paloaltonetworks.com/CVE-2025-0116
CVE: CVE-2025-0117
Published: 2025-03-12
Description: A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.

GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected.
CWE: CWE-807
References: https://security.paloaltonetworks.com/CVE-2025-0117
CVE: CVE-2025-0118
Published: 2025-03-12
Description: A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device.

This issue does not apply to the GlobalProtect app on other (non-Windows) platforms.
CVSS Score: 8.0 (HIGH)
CWE: CWE-618
References: https://security.paloaltonetworks.com/CVE-2025-0118
CVE: CVE-2025-22870
Published: 2025-03-12
Description: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-115
References: https://go.dev/cl/654697; https://go.dev/issue/71984; https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ