deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13783
Published: 2025-02-18
Description: The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin data which may contain sensitive information from form submissions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://codecanyon.net/item/formcraft-premium-wordpress-form-builder/5335056; https://formcraft-wp.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f7b45b1d-7ed6-4382-b69c-45ea45e4d0db?source=cve
CVE: CVE-2024-13797
Published: 2025-02-18
Description: The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://themeforest.net/item/pressmart-modern-elementor-woocommerce-wordpress-theme/39241221; https://www.wordfence.com/threat-intel/vulnerabilities/id/24aa6c0b-88bc-4c3e-ada7-2e89d84bdfc3?source=cve
CVE: CVE-2025-0521
Published: 2025-02-18
Description: The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3237626%40post-smtp%2Ftrunk&old=3229076%40post-smtp%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/366dfbf1-870c-4ce3-abc4-a2b2f4e72175?source=cve
CVE: CVE-2025-0817
Published: 2025-02-18
Description: The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://codecanyon.net/item/formcraft-premium-wordpress-form-builder/5335056; https://formcraft-wp.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae0710a-8c9b-41b0-860f-ae79b7ed1ee4?source=cve
CVE: CVE-2025-1035
Published: 2025-02-18
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.This issue affects KLog Server: before 3.1.1.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22
References: https://www.klogserver.com/surum-notlari/3-1-1/; https://www.usom.gov.tr/bildirim/tr-25-0037
CVE: CVE-2025-1269
Published: 2025-02-18
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing.This issue affects Liman MYS: before 2.1.1 - 1010.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-601
References: https://github.com/limanmys/core/releases/tag/release.master.1010; https://www.usom.gov.tr/bildirim/tr-25-0038
CVE: CVE-2025-1414
Published: 2025-02-18
Description: Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1943179; https://www.mozilla.org/security/advisories/mfsa2025-12/
CVE: CVE-2024-13689
Published: 2025-02-18
Description: The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://support.undsgn.com/hc/en-us/articles/213454129-Change-Log; https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a61e11-1137-4da0-8580-0a44300b1542?source=cve
CVE: CVE-2024-57045
Published: 2025-02-18
Description: A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/Shuanunio/CVE_Requests/blob/main/D-Link/DIR-859/ACL%20bypass%20Vulnerability%20in%20D-Link%20DIR-859.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-57046
Published: 2025-02-18
Description: A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding "?x=1.gif" to the the requested url, it will be recognized as passing the authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/DGN2200/ACL%20bypass%20Vulnerability%20in%20Netgear%20DGN2200.md; https://www.netgear.com/about/security/
CVE: CVE-2024-57049
Published: 2025-02-18
Description: A vulnerability in the TP-Link Archer c20 router with firmware version V6.6_230412 and earlier permits unauthorized individuals to bypass the authentication of some interfaces under the /cgi directory. When adding Referer: http://tplinkwifi.net to the the request, it will be recognized as passing the authentication. NOTE: this is disputed by the Supplier because the response to the API call is only "non-sensitive UI initialization variables."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/Shuanunio/CVE_Requests/blob/main/TP-Link/archer%20c20/ACL%20bypass%20Vulnerability%20in%20TP-Link%20archer%20c20.md
CVE: CVE-2024-57050
Published: 2025-02-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-11714. Reason: This candidate is a reservation duplicate of CVE-2018-11714. Notes: All CVE users should reference CVE-2018-11714 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-21702
Published: 2025-02-18
Description: In the Linux kernel, the following vulnerability has been resolved:

pfifo_tail_enqueue: Drop new packet when sch->limit == 0

Expected behaviour:
In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a
packet in scheduler's queue and decrease scheduler's qlen by one.
Then, pfifo_tail_enqueue() enqueue new packet and increase
scheduler's qlen by one. Finally, pfifo_tail_enqueue() return
`NET_XMIT_CN` status code.

Weird behaviour:
In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a
scheduler that has no packet, the 'drop a packet' step will do nothing.
This means the scheduler's qlen still has value equal 0.
Then, we continue to enqueue new packet and increase scheduler's qlen by
one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by
one and return `NET_XMIT_CN` status code.

The problem is:
Let's say we have two qdiscs: Qdisc_A and Qdisc_B.
 - Qdisc_A's type must have '->graft()' function to create parent/child relationship.
   Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`.
 - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`.
 - Qdisc_B is configured to have `sch->limit == 0`.
 - Qdisc_A is configured to route the enqueued's packet to Qdisc_B.

Enqueue packet through Qdisc_A will lead to:
 - hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B)
 - Qdisc_B->q.qlen += 1
 - pfifo_tail_enqueue() return `NET_XMIT_CN`
 - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A.

The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1.
Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem.
This violate the design where parent's qlen should equal to the sum of its childrens'qlen.

Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/020ecb76812a0526f4130ab5aeb6dc7c773e7ab9; https://git.kernel.org/stable/c/647cef20e649c576dff271e018d5d15d998b629d; https://git.kernel.org/stable/c/78285b53266d6d51fa4ff504a23df03852eba84e
CVE: CVE-2025-21703
Published: 2025-02-18
Description: In the Linux kernel, the following vulnerability has been resolved:

netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()

qdisc_tree_reduce_backlog() notifies parent qdisc only if child
qdisc becomes empty, therefore we need to reduce the backlog of the
child qdisc before calling it. Otherwise it would miss the opportunity
to call cops->qlen_notify(), in the case of DRR, it resulted in UAF
since DRR uses ->qlen_notify() to maintain its active list.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1f8e3f4a4b8b90ad274dfbc66fc7d55cb582f4d5; https://git.kernel.org/stable/c/[PII_REDACTED]082d6d8cc5321ff725df05482d8b83; https://git.kernel.org/stable/c/638ba[PII_REDACTED]c2ee49af10427459c2de35f71
CVE: CVE-2025-22207
Published: 2025-02-18
Description: Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.
CWE: CWE-89
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-sql-injection-vulnerability-in-scheduled-tasks-component.html
CVE: CVE-2024-39327
Published: 2025-02-18
Description: Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-284
References: https://eviden.com/solutions/digital-security/digital-identity/; https://support.bull.com/ols/product/security/psirt/security-bulletins/potential-privilege-escalation-in-idpki-psirt-1335-tlp-clear-version-2-10-cve-2024-39327-cve-2024-39328-cve-2024-51505/view
CVE: CVE-2024-55460
Published: 2025-02-18
Description: A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to execute arbitrary code via a crafted input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Ap0k4L1p5/CVE-research/tree/master/CVE-2024-55460; https://sgsrs.boardroomlimited.com/taxelection/login.aspx
CVE: CVE-2022-41545
Published: 2025-02-18
Description: The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via basic authentication, with an HTTP header containing a base64 value of the plaintext username and password. Because the web server also does not utilize transport security by default, this renders the administrative credentials vulnerable to eavesdropping by an adversary during every authenticated request made by a client to the router over a WLAN, or a LAN, should the adversary be able to perform a man-in-the-middle attack.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-319
References: https://seclists.org/fulldisclosure/2025/Feb/12; https://www.netgear.com/about/security/; https://www.netgear.com/images/datasheet/networking/cablemodems/C7800.pdf
CVE: CVE-2024-39328
Published: 2025-02-18
Description: Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. A highly trusted role (Config Admin) could exceed their configuration privileges in a multi-partition environment and access some confidential data. Data integrity and availability is not at risk.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: https://eviden.com/solutions/digital-security/digital-identity/; https://support.bull.com/ols/product/security/psirt/security-bulletins/potential-privilege-escalation-in-idpki-psirt-1335-tlp-clear-version-2-10-cve-2024-39327-cve-2024-39328-cve-2024-51505/view
CVE: CVE-2024-49589
Published: 2025-02-18
Description: Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based on an user supplied argument (size).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://palantir.safebase.us/?tcuUid=ad6b08b1-2f79-4e32-b125-406dd2b9b1c3
CVE: CVE-2024-4028
Published: 2025-02-18
Description: A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.
CVSS Score: 3.8 (LOW)
CWE: CWE-20
References: https://access.redhat.com/security/cve/CVE-2024-4028; https://bugzilla.redhat.com/show_bug.cgi?id=2276418
CVE: CVE-2024-50608
Published: 2025-02-18
Description: An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://fluentbit.io/announcements/; https://github.com/fluent/fluent-bit/releases; https://www.ebryx.com/blogs/exploring-cve-2024-50608-and-cve-2024-50609
CVE: CVE-2024-50609
Published: 2025-02-18
Description: An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_traces_proto_ng() at opentelemetry_prot.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://fluentbit.io/announcements/; https://github.com/fluent/fluent-bit/releases; https://www.ebryx.com/blogs/exploring-cve-2024-50608-and-cve-2024-50609
CVE: CVE-2024-51505
Published: 2025-02-18
Description: An issue was discovered in Atos Eviden IDRA before 2.7.1. A highly trusted role (Config Admin) could leverage a race condition to escalate privileges.
CVSS Score: 8.0 (HIGH)
CWE: CWE-362
References: https://eviden.com; https://support.bull.com/ols/product/security/psirt/security-bulletins/potential-privilege-escalation-in-idpki-psirt-1335-tlp-clear-version-2-10-cve-2024-39327-cve-2024-39328-cve-2024-51505/view
CVE: CVE-2024-56882
Published: 2025-02-18
Description: Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with the modified data elements.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cves.at/posts/cve-cve-2024-56882/writeup/
CVE: CVE-2024-56883
Published: 2025-02-18
Description: Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on the server side. Low-privileged Sage users with employee role privileges can create external courses for other employees, even though they do not have the option to do so in the user interface. To do this, a valid request to create a course simply needs to be modified, so that the current user ID in the "id" parameter is replaced with the ID of another user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://cves.at/posts/cve-cve-2024-56883/writeup/
CVE: CVE-2025-25300
Published: 2025-02-18
Description: smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile third parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner. `rel="noopener"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure `View` link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If `View` link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel="noopener"` is imposed on all `target="_blank"` links. Version 1.14.1 of smartbanner.js contains a fix for the issue.
CWE: CWE-79, CWE-601
References: https://github.com/ain/smartbanner.js/commit/fce8c31dfe04033d9d005a89694d3e7a60784f89; https://github.com/ain/smartbanner.js/security/advisories/GHSA-9mrq-cjgh-32g2; https://github.com/ain/smartbanner.js/security/advisories/GHSA-9mrq-cjgh-32g2
CVE: CVE-2025-26058
Published: 2025-02-18
Description: Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-598
References: https://github.com/mano257200/QloApps-VUL
CVE: CVE-2025-26620
Published: 2025-02-18
Description: Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protocol parameters can return access tokens obtained with the wrong scope, resource indicator, or other protocol parameters. Such usage is somewhat atypical, and only a small percentage of users are likely to be affected. Duende.AccessTokenManagement can request access tokens using the client credentials flow in several ways. In basic usage, the client credentials flow is configured once and the parameters do not vary. In more advanced situations, requests with varying protocol parameters may be made by calling specific overloads of these methods: `HttpContext.GetClientAccessTokenAsync()` and `IClientCredentialsTokenManagementService.GetAccessTokenAsync()`. There are overloads of both of these methods that accept a `TokenRequestParameters` object that customizes token request parameters. However, concurrent requests with varying `TokenRequestParameters` will result in the same token for all concurrent calls. Most users can simply update the NuGet package to the latest version. Customizations of the `IClientCredentialsTokenCache` that derive from the default implementation (`DistributedClientCredentialsTokenCache`) will require a small code change, as its constructor was changed to add a dependency on the `ITokenRequestSynchronization` service. The synchronization service will need to be injected into the derived class and passed to the base constructor. The impact of this vulnerability depends on how Duende.AccessTokenManagement is used and on the security architecture of the solution. Most users will not be vulnerable to this issue. More advanced users may run into this issue by calling the methods specified above with customized token request parameters. The impact of obtaining an access token with different than intended protocol parameters will vary depending on application logic, security architecture, and the authorization policy of the resource servers.
CWE: CWE-367
References: https://github.com/DuendeSoftware/foss/commit/a33332ddec0ebf3c048ba85427e3c77d47c68dac; https://github.com/DuendeSoftware/foss/security/advisories/GHSA-qxj7-2x7w-3mpp
CVE: CVE-2024-45774
Published: 2025-02-18
Description: A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its internal buffers, resulting in an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is not discarded.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2025:6990; https://access.redhat.com/security/cve/CVE-2024-45774; https://bugzilla.redhat.com/show_bug.cgi?id=2337461
CVE: CVE-2024-57055
Published: 2025-02-18
Description: Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain services without the necessary access level. This issue is limited to services used by the client (not the general-use JSON services) and requires reverse engineering of the proprietary serialization protocol, making it difficult to exploit.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-306
References: https://www.wombatdialer.com/blog/blog/2025/02/18/CVE/
CVE: CVE-2024-57056
Published: 2025-02-18
Description: Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could be used by a malicious attacker to impersonate an existing user session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-613
References: https://www.wombatdialer.com/blog/blog/2025/02/18/CVE/
CVE: CVE-2025-21608
Published: 2025-02-18
Description: Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able to appear as a DM in client to a node even though they were not decoded with PKC. This issue has been addressed in version 2.5.19 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://github.com/meshtastic/firmware/security/advisories/GHSA-c967-qc39-3hf5
CVE: CVE-2025-24894
Published: 2025-02-18
Description: SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in essence, is responsible for the management of the credentials and identity of users; Service Provider (SP): the system that provides a service to the user and relies on the Identity Provider to authenticate the user, receives SAML assertions from the IdP to grant access to resources. The validation logic of the signature is central as it ensures that you cannot create a SAML response with arbitrary assertions and then impersonate other users. There is no guarantee that the first signature refers to the root object, it follows that if an attacker injects an item signed as the first element, all other signatures will not be verified. The only requirement is to have an XML element legitimately signed by the IdP, a condition that is easily met using the IdP's public metadata. An attacker could create an arbitrary SAML response that would be accepted by SPs using vulnerable SDKs, allowing him to impersonate any Spid and/or CIE user. This vulnerability has been addressed in version 3.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/italia/spid-aspnetcore/security/advisories/GHSA-36h8-r92j-w9vw