deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54808
Published: 2025-10-23
Description: Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory (/tmp) on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the token is leaked (e.g., via malware infection or other local exploit), and remote access is enabled, it can be used to establish unauthorized remote connections to the sequencer. Remote access must be enabled for remote exploitation to succeed. This may occur either because the user has enabled remote access for legitimate operational reasons or because malware with elevated privileges (e.g., sudo access) enables it without user consent. This vulnerability can be chained with remote access capabilities to generate a developer token from a remote device. Developer tokens can be created with arbitrary expiration dates, enabling persistent access to the sequencer and bypassing standard authentication mechanisms.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsma-25-294-01.json; https://nanoporetech.com/about/contact; https://nanoporetech.com/software/
CVE: CVE-2025-60837
Published: 2025-10-23
Description: A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://mcms.com; https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a; https://gitee.com/mingSoft/MCMS
CVE: CVE-2025-60859
Published: 2025-10-23
Description: Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameter in bbs/view_comment.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://creeperkirby.notion.site/Gnboard5-5-6-15-reflected-XSS-25c4fe7db8cf80efa20fc2ebefcfe61e?source=copy_link; https://github.com/gnuboard/gnuboard5/commit/002e43e5fb84b465357b445772c881e196e100d3
CVE: CVE-2025-62255
Published: 2025-10-23
Description: Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions  allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62255
CVE: CVE-2025-6978
Published: 2025-10-23
Description: Diagnostics command injection vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123
CVE: CVE-2025-6979
Published: 2025-10-23
Description: Captive Portal can allow authentication bypass
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123
CVE: CVE-2025-6980
Published: 2025-10-23
Description: Captive Portal can expose sensitive information
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123
CVE: CVE-2025-12044
Published: 2025-10-23
Description: Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393]  which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710
CVE: CVE-2025-54963
Published: 2025-10-23
Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may submit a crafted job request that grants read access to files on the filesystem with the permissions of the GXP Job Service process. The path to a file is not sanitized for directory traversal, potentially allowing an attacker to read sensitive files in some configurations.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.baesystems.com/en-us/product/geospatial-exploitation-products; https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54963
CVE: CVE-2025-54964
Published: 2025-10-23
Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If the Job Service is configured for local-only access, this may allow for privilege escalation in certain situations. If the Job Service is network accessible, this may allow remote command execution.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://www.baesystems.com/en-us/product/geospatial-exploitation-products; https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54964
CVE: CVE-2025-54966
Published: 2025-10-23
Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return sensitive information in certain situations, including local file paths and SOCET GXP version information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.baesystems.com/en-us/product/geospatial-exploitation-products; https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54966
CVE: CVE-2025-55067
Published: 2025-10-23
Description: The TLS4B ATG system is vulnerable to improper handling of Unix time values that exceed the 2038 epoch rollover. When the system clock reaches January 19, 2038, it resets to December 13, 1901, causing authentication failures and disrupting core system functionalities such as login access, history visibility, and leak detection termination. This vulnerability could allow an attacker to manipulate the system time to trigger a denial of service (DoS) condition, leading to administrative lockout, operational timer failures, and corrupted log entries.
CVSS Score: 7.1 (HIGH)
CWE: CWE-190
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-03.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-03; https://www.veeder.com/us/network-security-reminder
CVE: CVE-2025-57848
Published: 2025-10-23
Description: A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-276
References: https://access.redhat.com/security/cve/CVE-2025-57848; https://bugzilla.redhat.com/show_bug.cgi?id=2391099
CVE: CVE-2025-58428
Published: 2025-10-23
Description: The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote command execution, full shell access, and potential lateral movement within the network.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-03.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-03; https://www.veeder.com/us/network-security-reminder
CVE: CVE-2025-62236
Published: 2025-10-23
Description: The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unauthenticated, remote attacker could determine valid email addresses, possibly aiding in further attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-296-01.json; https://www.cve.org/CVERecord?id=CVE-2025-62236
CVE: CVE-2025-62517
Published: 2025-10-23
Description: Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1321
References: https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e[PII_REDACTED]08a54bcb8cb8bb; https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343; https://github.com/rollbar/rollbar.js/pull/1390
CVE: CVE-2025-12100
Published: 2025-10-23
Description: Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/mongodb/mongo-bi-connector-odbc-driver/releases/tag/v1.4.7
CVE: CVE-2025-58078
Published: 2025-10-23
Description: A relative path traversal vulnerability was discovered in Productivity Suite software version 

4.4.1.19.


 The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and write files with arbitrary data on the target machine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json; https://support.automationdirect.com/docs/securityconsiderations.pdf; https://www.automationdirect.com/support/software-downloads
CVE: CVE-2025-58456
Published: 2025-10-23
Description: A relative path traversal vulnerability was discovered in Productivity Suite software version 

4.4.1.19.

 The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read arbitrary files on the target machine.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-23
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json; https://support.automationdirect.com/docs/securityconsiderations.pdf; https://www.automationdirect.com/support/software-downloads
CVE: CVE-2025-59273
Published: 2025-10-23
Description: Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59273
CVE: CVE-2025-59500
Published: 2025-10-23
Description: Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59500
CVE: CVE-2025-59503
Published: 2025-10-23
Description: Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59503
CVE: CVE-2025-61934
Published: 2025-10-23
Description: A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on the target machine
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1327
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json; https://support.automationdirect.com/docs/securityconsiderations.pdf; https://www.automationdirect.com/support/software-downloads
CVE: CVE-2025-61977
Published: 2025-10-23
Description: A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an attacker to decrypt an encrypted project by answering just one recovery question.
CVSS Score: 7.0 (HIGH)
CWE: CWE-640
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json; https://support.automationdirect.com/docs/securityconsiderations.pdf; https://www.automationdirect.com/support/software-downloads
CVE: CVE-2025-62498
Published: 2025-10-23
Description: A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version 

4.4.1.19. The vulnerability allows an attacker who can tamper with a productivity project to execute arbitrary code on the machine where the project is opened.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json; https://www.automationdirect.com/support/software-downloads; https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01
CVE: CVE-2025-62688
Published: 2025-10-23
Description: An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker with low-privileged credentials to change their role, gaining full control access to the project.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json; https://support.automationdirect.com/docs/securityconsiderations.pdf; https://www.automationdirect.com/support/software-downloads
CVE: CVE-2025-58429
Published: 2025-10-23
Description: A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary files on the target machine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json; https://support.automationdirect.com/docs/securityconsiderations.pdf; https://www.automationdirect.com/support/software-downloads
CVE: CVE-2025-59776
Published: 2025-10-23
Description: A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and create arbitrary directories on the target machine.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-23
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json; https://support.automationdirect.com/docs/securityconsiderations.pdf; https://www.automationdirect.com/support/software-downloads
CVE: CVE-2025-60023
Published: 2025-10-23
Description: A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary directories on the target machine.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-23
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json; https://support.automationdirect.com/docs/securityconsiderations.pdf; https://www.automationdirect.com/support/software-downloads
CVE: CVE-2025-62254
Published: 2025-10-23
Description: The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions  does not limit the number or size of the files it will combine, which allows remote attackers to create very large responses that lead to a denial of service attack via the URL query string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62254
CVE: CVE-2025-7730
Published: 2025-10-23
Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘percentage’ parameter in all versions up to, and including, 5.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bold-page-builder/tags/5.4.2/content_elements/bt_bb_progress_bar/bt_bb_progress_bar.php#L90; https://wordpress.org/plugins/bold-page-builder/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd5d1c7-4be2-457b-bd28-0cb76e9800e5?source=cve
CVE: CVE-2025-10723
Published: 2025-10-24
Description: The PixelYourSite  WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks
CVSS Score: 2.7 (LOW)
CWE: CWE-22
References: https://wpscan.com/vulnerability/88a99f9d-dc7f-4c04-8734-77295c8656bf/
CVE: CVE-2025-10874
Published: 2025-10-24
Description: The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://wpscan.com/vulnerability/171ba43f-55b6-471d-af0a-be553baf639a/
CVE: CVE-2025-58070
Published: 2025-10-24
Description: Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN20611740/; https://pleasanter.org/archives/vulnerability-update-20251024
CVE: CVE-2025-61931
Published: 2025-10-24
Description: Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN20611740/; https://pleasanter.org/archives/vulnerability-update-20251024
CVE: CVE-2025-9158
Published: 2025-10-24
Description: The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. 

This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.
CWE: CWE-79
References: https://cert.pl/en/posts/2025/10/CVE-2025-9158/; https://requesttracker.com/request-tracker/
CVE: CVE-2025-9978
Published: 2025-10-24
Description: The Jeg Kit for Elementor  WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cef78a77-c66d-4d62-8d49-140ca2d04d5b/
CVE: CVE-2025-62868
Published: 2025-10-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through 1.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/plugin/edge-cpt/security-policy/vdp/vulnerability/wordpress-edge-cpt-plugin-1-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-6440
Published: 2025-10-24
Description: The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://codecanyon.net/item/woocommerce-designer-pro-cmyk-card-flyer/22027731; https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2f8da1-7503-45e3-8a7d-0031ce264edf?source=cve
CVE: CVE-2025-10701
Published: 2025-10-24
Description: The Time Clock – A WordPress Employee & Volunteer Time Clock Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with Time Clock user credentials to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/time-clock/tags/1.3/includes/actions.php#L387; https://plugins.trac.wordpress.org/browser/time-clock/tags/1.3/includes/admin/activity.php#L149; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3382912%40time-clock&new=3382912%40time-clock&sfp_email=&sfph_mail=
CVE: CVE-2025-10740
Published: 2025-10-24
Description: The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capability check on the verifyRequest function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify links.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Http/Routes/api.php; https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Models/LinkAnalytics.php?rev=3210852; https://www.wordfence.com/threat-intel/vulnerabilities/id/29cc5016-005e-48e8-b[PII_REDACTED]f24da?source=cve
CVE: CVE-2025-10748
Published: 2025-10-24
Description: The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/rapidresult/tags/1.2/rapidresult.php#L112; https://plugins.trac.wordpress.org/changeset/3383652/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4e5d7d04-f73a-48ea-81e3-36a514c76cc6?source=cve