deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-47905
Published: 2025-05-13
Description: Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-444
References: https://varnish-cache.org/security/VSV00016.html; http://www.openwall.com/lists/oss-security/2025/05/15/2; https://lists.debian.org/debian-lts-announce/2025/05/msg00040.html
CVE: CVE-2025-4574
Published: 2025-05-13
Description: In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://access.redhat.com/security/cve/CVE-2025-4574; https://bugzilla.redhat.com/show_bug.cgi?id=2358890; https://github.com/advisories/GHSA-pg9f-39pc-qf8g
CVE: CVE-2025-3623
Published: 2025-05-14
Description: The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://automatorplugin.com/knowledge-base/uncanny-automator-changelog/#6-4-0-2-2025-04-18; https://plugins.trac.wordpress.org/browser/uncanny-automator/trunk/src/core/lib/helpers/class-automator-recipe-helpers.php#L540; https://plugins.trac.wordpress.org/changeset/3276577/uncanny-automator/trunk/src/core/lib/helpers/class-automator-recipe-helpers.php
CVE: CVE-2025-4520
Published: 2025-05-14
Description: The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.4.0.2/src/integrations/keap/helpers/keap-helpers.php#L99; https://www.wordfence.com/threat-intel/vulnerabilities/id/db5b5fa1-67b5-4103-93b0-682200199a71?source=cve
CVE: CVE-2024-52290
Published: 2025-05-14
Description: LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key `Name` (`confKey`) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/lf-edge/ekuiper/security/advisories/GHSA-9cwv-pxcr-hfjc; https://github.com/lf-edge/ekuiper/security/advisories/GHSA-9cwv-pxcr-hfjc
CVE: CVE-2025-0020
Published: 2025-05-14
Description: Rejected reason: “This CVE ID is Rejected and will not be used.  As the CNA of record ESRI has rejected this CVE as it is not a vulnerability”
CVE: CVE-2024-13940
Published: 2025-05-14
Description: The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://ninjaforms.com/extensions/webhooks/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf2af62-2b5a-4c0a-9e82-f80dde204a9d?source=cve
CVE: CVE-2024-8988
Published: 2025-05-14
Description: The PeepSo Core: File Uploads plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.6.0 via the file_download REST API endpoint due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to download files uploaded by others users and expose potentially sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://www.peepso.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d3184996-655c-41d5-a3c5-6b36fbff58dc?source=cve
CVE: CVE-2025-2875
Published: 2025-05-14
Description: CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could
cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to
access resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-610
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-133-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-133-01.pdf
CVE: CVE-2024-24780
Published: 2025-05-14
Description: Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.4.

Users are recommended to upgrade to version 1.3.4, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmj; http://www.openwall.com/lists/oss-security/2025/05/14/2
CVE: CVE-2025-26795
Published: 2025-05-14
Description: Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver.

This issue affects iotdb-jdbc: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2.

Users are recommended to upgrade to version 2.0.2 and 1.3.4, which fix the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-532, CWE-532
References: https://lists.apache.org/thread/bj0ytxr5wg0c4jw8xm7rhfd8ogho0r91; http://www.openwall.com/lists/oss-security/2025/05/14/3
CVE: CVE-2025-26864
Published: 2025-05-14
Description: Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB.

This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2.

Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-532
References: https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162; http://www.openwall.com/lists/oss-security/2025/05/14/4
CVE: CVE-2025-3833
Published: 2025-05-14
Description: Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com/products/self-service-password/advisory/CVE-2025-3833.html
CVE: CVE-2025-3834
Published: 2025-05-14
Description: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the OU History report.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2025-3834.html
CVE: CVE-2025-47292
Published: 2025-05-14
Description: Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the `DebateAlternateArgumentsResolver` deserializes a `Cursor`, allowing any classes and which can be controlled by unauthenticated user. Exploitation of this vulnerability can lead to Remote Code Execution. The vulnerability is fixed in commit 812f2a7d271b76deab1175bdaf2be0b8102dd198.
CWE: CWE-502
References: https://github.com/cap-collectif/cap-collectif/commit/812f2a7d271b76deab1175bdaf2be0b8102dd198; https://github.com/cap-collectif/cap-collectif/security/advisories/GHSA-hf7r-rjh4-5fc8
CVE: CVE-2025-4430
Published: 2025-05-14
Description: Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 (published on 22nd August 2024).
CWE: CWE-862
References: https://cert.pl/en/posts/2025/05/CVE-2025-4430/; https://www.gov.pl/web/ezd-rp
CVE: CVE-2025-3769
Published: 2025-05-14
Description: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php; https://plugins.trac.wordpress.org/changeset/3291162/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9acd26-c341-4ece-bcf1-102f953a4b4f?source=cve
CVE: CVE-2025-3931
Published: 2025-05-14
Description: A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages. 

This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-280
References: https://access.redhat.com/errata/RHSA-2025:7592; https://access.redhat.com/security/cve/CVE-2025-3931; https://bugzilla.redhat.com/show_bug.cgi?id=2362345
CVE: CVE-2025-47445
Published: 2025-05-14
Description: Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://patchstack.com/database/Wordpress/Plugin/wp-event-solution/vulnerability/wordpress-eventin-4-0-26-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2023-53146
Published: 2025-05-14
Description: In the Linux kernel, the following vulnerability has been resolved:

media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()

In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach dw2102_i2c_transfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 950e252cb469
("[media] dw2102: limit messages to buffer size")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/08dfcbd03b2b7f918c4f87c6ff637054e510df74; https://git.kernel.org/stable/c/5ae544d94abc8ff77b1b9bf8774def3fa5689b5b; https://git.kernel.org/stable/c/77cbd42d29de9ffc93d5529bab8813cde53af14c
CVE: CVE-2024-54779
Published: 2025-05-14
Description: Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/; https://docs.netgate.com/downloads/pfSense-SA-25_01.webgui.asc; https://www.netgate.com/blog/important-security-updates-for-pfsense-plus-24.11-and-ce-2.7.2
CVE: CVE-2024-54780
Published: 2025-05-14
Description: Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/; https://www.netgate.com/blog/important-security-updates-for-pfsense-plus-24.11-and-ce-2.7.2
CVE: CVE-2024-57273
Published: 2025-05-14
Description: Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized "reason" field and a derivable device key generated from the public SSH key.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://netgate.com; https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/; https://docs.netgate.com/downloads/pfSense-SA-25_03.webgui.asc
CVE: CVE-2025-22756
Published: 2025-05-14
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-3600
Published: 2025-05-14
Description: In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-470
References: https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-unsafe-reflection-cve-2025-3600
CVE: CVE-2025-47436
Published: 2025-05-14
Description: Heap-based Buffer Overflow vulnerability in Apache ORC.

A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption.

This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1.

Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://lists.apache.org/thread/kd6tlv8fs5jybmsgxr4vrkdxyc866wrn; https://orc.apache.org/security/CVE-2025-47436/; http://www.openwall.com/lists/oss-security/2025/05/13/4
CVE: CVE-2024-10864
Published: 2025-05-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenText Advanced Authentication. This issue affects Advanced Authentication versions before 6.5
CWE: CWE-89
References: https://www.netiq.com/documentation/advanced-authentication-65/advanced-authentication-releasenotes-6.5/data/advanced-authentication-releasenotes-6.5.html
CVE: CVE-2024-10865
Published: 2025-05-14
Description: Improper Input validation leads to XSS or Cross-site Scripting vulnerability in OpenText Advanced Authentication. This issue affects Advanced Authentication versions before 6.5.
CWE: CWE-79
References: https://www.netiq.com/documentation/advanced-authentication-65/advanced-authentication-releasenotes-6.5/data/advanced-authentication-releasenotes-6.5.html
CVE: CVE-2024-52601
Published: 2025-05-14
Description: iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/Combodo/iTop/security/advisories/GHSA-cph2-466c-3f87
CVE: CVE-2024-56157
Published: 2025-05-14
Description: iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before importing it.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-6p48-74j9-977j
CVE: CVE-2025-24021
Published: 2025-05-14
Description: iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862
References: https://github.com/Combodo/iTop/commit/44290db312901fc5918cc537c74561487fb3713b; https://github.com/Combodo/iTop/security/advisories/GHSA-c8hm-h9gv-8jpj
CVE: CVE-2025-24022
Published: 2025-05-14
Description: iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: https://github.com/Combodo/iTop/commit/082d865efaf8a349b60fe3875e9c726c24f8a8bd; https://github.com/Combodo/iTop/commit/37fc1a572380f2faa67fddea5b1a3a4ba72ed54e; https://github.com/Combodo/iTop/commit/5780f26817c2303c5bdd0ad16e21d4d959780b0b
CVE: CVE-2025-24026
Published: 2025-05-14
Description: iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop app_root_url is defined in the configuration file, then there is no possible way to exploit this ReDoS.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/Combodo/iTop/security/advisories/GHSA-9g7f-jmc3-rrmf
CVE: CVE-2025-24785
Published: 2025-05-14
Description: iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to load this dashboard would encounter a crashed start page. Version 3.2.1 fixes the issue by checking the provided layout_class before saving the dashboard.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/Combodo/iTop/security/advisories/GHSA-49rq-cgv9-7hv4
CVE: CVE-2025-24969
Published: 2025-05-14
Description: iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the picture ID in the URL. Version 3.2.1 contains a patch for the issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-639
References: https://github.com/Combodo/iTop/security/advisories/GHSA-52p7-7f8f-j7pc
CVE: CVE-2025-47775
Published: 2025-05-14
Description: Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-201
References: https://github.com/bullfrogsec/bullfrog/commit/ae7744ae4b3a6f8ffc2e49f501e30bf1a43d4671; https://github.com/bullfrogsec/bullfrog/releases/tag/v0.8.4; https://github.com/bullfrogsec/bullfrog/security/advisories/GHSA-m32f-fjw2-37v3
CVE: CVE-2025-47777
Published: 2025-05-14
Description: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-site scripting in chatbot responses due to insufficient sanitization. This, in turn, can lead to Remote Code Execution (RCE) via unsafe Electron protocol handling and exposed Electron APIs. All users of 5ire client versions prior to patched releases, particularly those interacting with untrusted chatbots or pasting external content, are affected. Version 0.11.1 contains a patch for the issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20, CWE-79
References: https://github.com/nanbingxyz/5ire/commit/56601e012095194a4be0d4cb6da6b5b3cb53dea8; https://github.com/nanbingxyz/5ire/security/advisories/GHSA-mr8w-mmvv-6hq8; https://positive.security/blog/url-open-rce
CVE: CVE-2025-47778
Published: 2025-05-14
Description: Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually.
CWE: CWE-611
References: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php; https://github.com/sulu/sulu/commit/02f52fca04eb9495b9b4a0c5cc64cf23bc27f544; https://github.com/sulu/sulu/security/advisories/GHSA-f6rx-hf55-4255
CVE: CVE-2025-47781
Published: 2025-05-14
Description: Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the authentication. A token that consists of 6 digits only presents weak entropy however and when coupled with no token brute force protection, makes it possible for an unauthenticated attacker with knowledge of a valid email address to successfully brute force the token within 15 minutes (token expiration time) and take over the account associated with the targeted email address. All users on the Rallly applications are impacted. As long as an attacker knows the user's email address they used to register on the app, they can systematically take over any user account. For the authentication mechanism to be safe, the token would need to be assigned a complex high entropy value that cannot be bruteforced within reasonable time, and ideally rate limiting the /api/auth/callback/email endpoint to further make brute force attempts unreasonable within the 15 minutes time. As of time of publication, no patched versions are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-331, CWE-331
References: https://github.com/lukevella/rallly/security/advisories/GHSA-gm8g-3r3j-48hv; https://github.com/lukevella/rallly/security/advisories/GHSA-gm8g-3r3j-48hv
CVE: CVE-2025-47782
Published: 2025-05-14
Description: motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.
CWE: CWE-78
References: https://github.com/motioneye-project/motioneye/issues/3142; https://github.com/motioneye-project/motioneye/pull/3143; https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588
CVE: CVE-2025-26784
Published: 2025-05-14
Description: An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds writes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26784/