deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3739
Published: 2025-04-16
Description: Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*.
CVSS Score: 5.9 (MEDIUM)
References: https://www.drupal.org/sa-contrib-2025-040
CVE: CVE-2024-53303
Published: 2025-04-16
Description: A remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated attackers to execute arbitrary code via a crafted POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://gist.github.com/fern89/3464e8428d7675e4f0f390a6b2b2842e
CVE: CVE-2024-53304
Published: 2025-04-16
Description: An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary commands via posing as an infected machine.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://gist.github.com/fern89/3464e8428d7675e4f0f390a6b2b2842e
CVE: CVE-2024-53305
Published: 2025-04-16
Description: An issue in the component /models/config.py of Whoogle search v0.9.0 allows attackers to execute arbitrary code via supplying a crafted search query.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://gist.github.com/fern89/ca5fe76ad81b4bc363e7341e523a1651; https://github.com/benbusby/whoogle-search/commit/223f00c3c[PII_REDACTED]f99b30c561278bc0b42ba
CVE: CVE-2025-22872
Published: 2025-04-16
Description: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
CVSS Score: 6.5 (MEDIUM)
References: https://go.dev/cl/662715; https://go.dev/issue/73070; https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
CVE: CVE-2025-27495
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateTrace' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25911)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-27539
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'VerifyUser' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.  (ZDI-CAN-25914)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-27540
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'Authenticate' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25913)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-29905
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'RestoreFromBackup' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25923)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-2291
Published: 2025-04-16
Description: Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
CVSS Score: 8.1 (HIGH)
CWE: CWE-324
References: https://www.pgbouncer.org/changelog.html#pgbouncer-124x; https://lists.debian.org/debian-lts-announce/2025/05/msg00032.html
CVE: CVE-2025-30002
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateConnectionVariables' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25909)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-30003
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProjectConnections' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25910)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-30030
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ImportDatabase' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25924)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-30031
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateUsers' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25922)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-30032
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateDatabaseSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25921)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-31343
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateTcmSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25920)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-31349
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateSmtpSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25919)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-31350
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateBufferingSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25918)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-31351
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25917)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-31352
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateGateways' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25915)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-31353
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateOpcSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25916)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32475
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25912)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32822
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'DeleteProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32823
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32824
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32825
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetProjects' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32826
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetActiveProjects' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32827
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ActivateProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32828
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProjectCrossCommunications' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32829
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockProjectCrossCommunications' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32830
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32831
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProjectUserRights' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32832
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockProjectUserRights' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32833
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockProjectUserRights' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE: CVE-2025-32834
Published: 2025-04-16
Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateConnectionVariablesWithImport' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-443402.html