deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-29816
Published: 2025-04-08
Description: Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-349
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29816
CVE: CVE-2025-29819
Published: 2025-04-08
Description: External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29819
CVE: CVE-2025-29820
Published: 2025-04-08
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29820
CVE: CVE-2025-29821
Published: 2025-04-08
Description: Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29821
CVE: CVE-2025-29822
Published: 2025-04-08
Description: Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-184
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29822
CVE: CVE-2025-29823
Published: 2025-04-08
Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29823
CVE: CVE-2025-29824
Published: 2025-04-08
Description: Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824; https://www.vicarius.io/vsociety/posts/cve-2025-29824-windows-common-log-file-system-driver-elevation-of-privilege-vulnerability-detection-script; https://www.vicarius.io/vsociety/posts/cve-2025-29824-windows-common-log-file-system-driver-elevation-of-privilege-vulnerability-mitigation-script
CVE: CVE-2025-32035
Published: 2025-04-08
Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This means that it's possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security vulnerability. This vulnerability is fixed in 9.13.2.
CVSS Score: 2.6 (LOW)
CWE: CWE-351
References: https://github.com/dnnsoftware/Dnn.Platform/commit/a5c13c3836cfbde374dc19dac032cd51af41050a; https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-8q89-mqw7-9pp7
CVE: CVE-2025-32036
Published: 2025-04-08
Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. The algorithm used to generate the captcha image shows the least complexity of the desired image. For this reason, the created image can be easily read by OCR tools, and the intruder can send automatic requests by building a robot and using this tool. This vulnerability is fixed in 9.13.8.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-804
References: https://github.com/dnnsoftware/Dnn.Platform/commit/abda726e75f1938c8d89795b5dceb80dc4e2e6c5; https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-48q9-3p26-8595
CVE: CVE-2025-30295
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30296
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30297
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30298
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30299
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30300
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30301
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30302
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30303
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30304
Published: 2025-04-08
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/framemaker/apsb25-33.html
CVE: CVE-2025-30305
Published: 2025-04-08
Description: XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/xmpcore/apsb25-34.html
CVE: CVE-2025-30306
Published: 2025-04-08
Description: XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/xmpcore/apsb25-34.html
CVE: CVE-2025-30307
Published: 2025-04-08
Description: XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/xmpcore/apsb25-34.html
CVE: CVE-2025-30308
Published: 2025-04-08
Description: XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/xmpcore/apsb25-34.html
CVE: CVE-2025-30309
Published: 2025-04-08
Description: XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/xmpcore/apsb25-34.html
CVE: CVE-2025-3416
Published: 2025-04-08
Description: A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.
CVSS Score: 3.7 (LOW)
CWE: CWE-416
References: https://access.redhat.com/security/cve/CVE-2025-3416; https://bugzilla.redhat.com/show_bug.cgi?id=2357560; https://github.com/sfackler/rust-openssl
CVE: CVE-2024-12556
Published: 2025-04-08
Description: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
CVSS Score: 8.7 (HIGH)
CWE: CWE-1321
References: https://discuss.elastic.co/t/kibana-8-16-4-and-8-17-2-security-update-esa-2025-02/376918
CVE: CVE-2025-22871
Published: 2025-04-08
Description: The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
CVSS Score: 9.1 (CRITICAL)
References: https://go.dev/cl/652998; https://go.dev/issue/71988; https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk
CVE: CVE-2025-24446
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution. Exploitation of this issue does not require user interaction, but admin panel privileges are required, and scope is changed.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-24447
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30281
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction, and scope is changed.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30282
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass authentication mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30284
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.
CVSS Score: 8.4 (HIGH)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30285
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.
CVSS Score: 8.4 (HIGH)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30286
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30287
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A low privileged attacker with local access could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction in that a victim must be coerced into performing actions within the application and scope is changed.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30288
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low privileged attacker with local access could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction in that a victim must be coerced into performing actions within the application and scope is changed.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30289
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. A low privileged attacker with local access could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction in that a victim must be coerced into performing actions within the application. Scope is changed.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30290
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to bypass security protections and gain unauthorized write and delete access. Exploitation of this issue does not require user interaction and scope is changed.
CVSS Score: 8.7 (HIGH)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30291
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. A low privileged attacker with local access could leverage this vulnerability to gain access to sensitive information which could be used to further compromise the system or bypass security mechanisms. Exploitation of this issue does not require user interaction.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30292
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30293
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized write access. Exploitation of this issue does not require user interaction and scope is changed.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-30294
Published: 2025-04-08
Description: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized read access. Exploitation of this issue does not require user interaction and scope is changed.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-15.html
CVE: CVE-2025-27188
Published: 2025-04-08
Description: Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb25-26.html
CVE: CVE-2025-27189
Published: 2025-04-08
Description: Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition. An attacker could trick a logged-in user into submitting a forged request to the vulnerable application, which may disrupt service availability. Exploitation of this issue requires user interaction, typically in the form of clicking a malicious link or visiting an attacker-controlled website.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://helpx.adobe.com/security/products/magento/apsb25-26.html
CVE: CVE-2025-27190
Published: 2025-04-08
Description: Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb25-26.html
CVE: CVE-2025-27191
Published: 2025-04-08
Description: Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb25-26.html
CVE: CVE-2025-27192
Published: 2025-04-08
Description: Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to gain unauthorized access to protected resources by obtaining sensitive credential information. Exploitation of this issue does not require user interaction.
CVSS Score: 2.7 (LOW)
CWE: CWE-522
References: https://helpx.adobe.com/security/products/magento/apsb25-26.html
CVE: CVE-2024-55354
Published: 2025-04-08
Description: Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expected to be blocked and access resources that would be expected to be protected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-807
References: https://dev.lucee.org/t/lucee-cve-2024-55354-security-advisory-april-2025/14963