deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-30125
Published: 2025-07-28
Description: An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. All dashcams were shipped with the same default credentials of 12345678, which creates an insecure-by-default condition. For users who change their passwords, it's limited to 8 characters. These short passwords can be cracked in 8 hours via low-end commercial cloud resources.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://geochen.medium.com/marbella-dashcam-ab40ca41ade; https://github.com/geo-chen/Marbella/; https://github.com/geo-chen/Marbella/blob/main/README.md#finding-1---cve-2025-30125-same-default-credentials-and-limited-password-combinations
CVE: CVE-2025-53696
Published: 2025-07-28
Description: iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.
CWE: CWE-494
References: https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-03.txt
CVE: CVE-2025-54418
Published: 2025-07-28
Description: CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing (`imagick` as the image library) and either allow file uploads with user-controlled filenames and process uploaded images using the `resize()` method or use the `text()` method with user-controlled text content or options. An attacker can upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed or provide malicious text content or options that get executed when adding text to images Users should upgrade to v4.6.2 or later to receive a patch. As a workaround, switch to the GD image handler (`gd`, the default handler), which is not affected by either vulnerability. For file upload scenarios, instead of using user-provided filenames, generate random names to eliminate the attack vector with `getRandomName()` when using the `move()` method, or use the `store()` method, which automatically generates safe filenames. For text operations, if one must use ImageMagick with user-controlled text, sanitize the input to only allow safe characters and validate/restrict text options.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://cwe.mitre.org/data/definitions/78.html; https://github.com/codeigniter4/CodeIgniter4/commit/e18120bff1da691e1d15ffc1bf553ae7411762c0; https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-9952-gv64-x94c
CVE: CVE-2024-49342
Published: 2025-07-28
Description: IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://www.ibm.com/support/pages/node/7240777
CVE: CVE-2024-49343
Published: 2025-07-28
Description: IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://www.ibm.com/support/pages/node/7240777
CVE: CVE-2025-2297
Published: 2025-07-28
Description: Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.
CVSS Score: 7.8 (HIGH)
CWE: CWE-268
References: https://www.beyondtrust.com/trust-center/security-advisories/bt25-05
CVE: CVE-2025-6250
Published: 2025-07-28
Description: Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-424
References: https://www.beyondtrust.com/trust-center/security-advisories/bt25-06
CVE: CVE-2025-50490
Published: 2025-07-28
Description: Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a session hijacking attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://employee.com; http://phpgurukul.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50490
CVE: CVE-2025-50493
Published: 2025-07-28
Description: Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://doctor.com; http://phpgurukul.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50493
CVE: CVE-2025-50494
Published: 2025-07-28
Description: Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System v1.0 allows attackers to execute a session hijacking attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://car.com; http://phpgurukul.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50494
CVE: CVE-2025-54527
Published: 2025-07-28
Description: In JetBrains YouTrack before 2025.2.86935, 
2025.2.87167, 
2025.3.87341, 
2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54528
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54529
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
CVSS Score: 3.7 (LOW)
CWE: CWE-352
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54530
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54531
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows
CVSS Score: 7.7 (HIGH)
CWE: CWE-23
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54532
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54533
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54534
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54535
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-328
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54536
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54537
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-54538
Published: 2025-07-28
Description: In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-7676
Published: 2025-07-28
Description: DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be loaded from the application directory. Fixed in release 24H2, but present in all earlier versions of Windows 11 for ARM CPUs.
CWE: CWE-427
References: https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-04.txt
CVE: CVE-2025-43023
Published: 2025-07-28
Description: A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-347
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]4228-16/hpsbpi04033; http://www.openwall.com/lists/oss-security/2025/08/22/4
CVE: CVE-2025-50488
Published: 2025-07-28
Description: Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management System v3.0 allows attackers to execute a session hijacking attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: http://online.com; http://phpgurukul.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50488
CVE: CVE-2025-50489
Published: 2025-07-28
Description: Improper session invalidation in the component /srms/change-password.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a session hijacking attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://phpgurukul.com; http://student.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50489
CVE: CVE-2025-50491
Published: 2025-07-28
Description: Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers to execute a session hijacking attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: http://bank.com; http://phpgurukul.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50491
CVE: CVE-2025-50492
Published: 2025-07-28
Description: Improper session invalidation in the component /edms/change-password.php of PHPGurukul e-Diary Management System v1 allows attackers to execute a session hijacking attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://e-diary.com; http://phpgurukul.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50492
CVE: CVE-2025-54298
Published: 2025-07-28
Description: A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.
CWE: CWE-79
References: https://firecoders.com/
CVE: CVE-2025-54299
Published: 2025-07-28
Description: A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.
CWE: CWE-79
References: https://nobossextensions.com/
CVE: CVE-2025-50484
Published: 2025-07-28
Description: Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: http://phpgurukul.com; http://small.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50484
CVE: CVE-2025-50487
Published: 2025-07-28
Description: Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attackers to execute a session hijacking attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: http://blood.com; http://phpgurukul.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50487
CVE: CVE-2025-8194
Published: 2025-07-28
Description: There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. 

This vulnerability can be mitigated by including the following patch after importing the “tarfile” module:  https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1; https://github.com/python/cpython/commit/57f5981d6260ed21266e0c26951b8564cc252bc2; https://github.com/python/cpython/commit/7040aa54f[PII_REDACTED]e10c5f74ea93cd56aa38
CVE: CVE-2025-8283
Published: 2025-07-28
Description: A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.
CVSS Score: 3.7 (LOW)
CWE: CWE-15
References: https://access.redhat.com/security/cve/CVE-2025-8283; https://bugzilla.redhat.com/show_bug.cgi?id=2383941; https://github.com/advisories/GHSA-rpcf-rmh6-42xr
CVE: CVE-2025-29534
Published: 2025-07-28
Description: An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed to a system-level function call.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://wave.com; https://gist.github.com/EmptyButter/19b2c626f4589d1f9d[PII_REDACTED]a9eb
CVE: CVE-2025-50485
Published: 2025-07-28
Description: Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hijacking attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: http://online.com; http://phpgurukul.com; https://github.com/VasilVK/CVE/tree/main/CVE-2025-50485
CVE: CVE-2025-50486
Published: 2025-07-28
Description: Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execute a session hijacking attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: http://car.com; http://phpgurukul.com; https://github.com/sahel0708/CVE/tree/main/CVE-2025-50486
CVE: CVE-2025-54419
Published: 2025-07-28
Description: A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. To conduct the attack an attacker would need a validly signed document from the identity provider (IdP). This is fixed in version 5.1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287, CWE-347
References: https://github.com/node-saml/node-saml/commit/31ead9411ebc3e2385086fa9149b6c17732bca10; https://github.com/node-saml/node-saml/releases/tag/v5.1.0; https://github.com/node-saml/node-saml/security/advisories/GHSA-4mxg-3p6v-xgq3
CVE: CVE-2025-54423
Published: 2025-07-28
Description: copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/9001/copyparty/commit/895880aeb0be0813ddf[PII_REDACTED]33f8f9fc3a6; https://github.com/9001/copyparty/releases/tag/v1.18.5; https://github.com/9001/copyparty/security/advisories/GHSA-9q4r-x2hj-jmvr
CVE: CVE-2025-54426
Published: 2025-07-28
Description: Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returning an error, they silently treat invalid input bytes as the Ristretto identity element, leading to potentially incorrect cryptographic results. This is fixed in commit 36f70d1.
CWE: CWE-327
References: https://dotpal.io/assets/files/frontier-srlabs-2505-718c3bfa5df9fed1862fed05de506859.pdf; https://github.com/polkadot-evm/frontier/commit/36f70d1defcaeaed5a453015f6c98c21bb5b121b; https://github.com/polkadot-evm/frontier/pull/1720/commits/8ed6053fb868495477ba2409f7e64f439df76f96
CVE: CVE-2025-54427
Published: 2025-07-28
Description: Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The extrinsic note_min_gas_price_target is an inherent extrinsic, meaning only the block producer can call it. To ensure correctness, the ProvideInherent trait should be implemented for each inherent, which includes the check_inherent call. This allows other nodes to verify if the input (in this case, the target value) is correct. However, prior to commit a754b3d, the check_inherent function has not been implemented for note_min_gas_price_target. This lets the block producer set the target value without verification. The target is then used to set the MinGasPrice, which has an upper and lower bound defined in the on_initialize hook. The block producer can set the target to the upper bound. Which also increases the upper and lower bounds for the next block. Over time, this could result in continuously raising the gas price, making contract execution too expensive and ineffective for users. An attacker could use this flaw to manipulate the gas price, potentially leading to significantly inflated transaction fees. Such manipulation could render contract execution prohibitively expensive for users, effectively resulting in a denial-of-service condition for the network. This is fixed in version a754b3d.
CWE: CWE-682, CWE-754
References: https://dotpal.io/assets/files/frontier-srlabs-2505-718c3bfa5df9fed1862fed05de506859.pdf; https://github.com/polkadot-evm/frontier/commit/a754b3dc6e1b6da98f71aea7bb1fa08677b24186; https://github.com/polkadot-evm/frontier/security/advisories/GHSA-r6rj-gmqh-cv94
CVE: CVE-2025-54428
Published: 2025-07-28
Description: RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow unauthorized access to production or staging databases, potentially leading to data exfiltration, modification, or deletion. This is fixed in version 1.0.1. Workarounds include: immediately rotating credentials for the exposed database user, using a secret manager (like Vault, Doppler, AWS Secrets Manager, etc.) instead of storing secrets directly in code, or auditing recent access logs for suspicious activity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/musombi123/RevelaCode-Backend/commit/95005cf4bacf1b005aef9d4b8e85237c98492d83; https://github.com/musombi123/RevelaCode-Backend/security/advisories/GHSA-m253-qvcr-cr48
CVE: CVE-2025-54429
Published: 2025-07-28
Description: Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for safety. For precompiles to be callable by smart contracts they must be explicitly configured as CallableByContract. If this configuration is absent, then the precompile should be unreachable via smart contract accounts. In commits prior to 0822030, the underlying implementation of CallableByContract which returned the AddressType was incorrect. It considered the contract address running under CREATE or CREATE2 to be AddressType::EOA rather than correctly as AddressType::Contract. The issue only affects users who use custom precompile implementations that utilize AddressType::EOA and AddressType::Contract. It's not directly exploitable in any of the predefined precompiles in Frontier. This is fixed in version 0822030.
CWE: CWE-704
References: https://dotpal.io/assets/files/frontier-srlabs-2505-718c3bfa5df9fed1862fed05de506859.pdf; https://github.com/polkadot-evm/frontier/pull/1655; https://github.com/polkadot-evm/frontier/security/advisories/GHSA-fr62-ppwc-mc2h
CVE: CVE-2025-54765
Published: 2025-07-29
Description: An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-648
References: https://korelogic.com/Resources/Advisories/KL-001-2025-013.txt; https://xormon.com/note190.php; http://seclists.org/fulldisclosure/2025/Jul/16
CVE: CVE-2025-54766
Published: 2025-07-29
Description: An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-648
References: https://korelogic.com/Resources/Advisories/KL-001-2025-012.txt; https://xormon.com/note190.php; http://seclists.org/fulldisclosure/2025/Jul/15
CVE: CVE-2025-54767
Published: 2025-07-29
Description: An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-648
References: https://korelogic.com/Resources/Advisories/KL-001-2025-014.txt; https://lpar2rrd.com/note800.php; http://seclists.org/fulldisclosure/2025/Jul/17
CVE: CVE-2025-54768
Published: 2025-07-29
Description: An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-648
References: https://korelogic.com/Resources/Advisories/KL-001-2025-015.txt; https://lpar2rrd.com/note800.php; http://seclists.org/fulldisclosure/2025/Jul/18
CVE: CVE-2025-54769
Published: 2025-07-29
Description: An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing.  This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.
CVSS Score: 8.8 (HIGH)
CWE: CWE-24, CWE-434, CWE-648
References: https://korelogic.com/Resources/Advisories/KL-001-2025-016.txt; https://lpar2rrd.com/note800.php; http://seclists.org/fulldisclosure/2025/Jul/19