deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-60675
Published: 2025-11-13
Description: A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /tmp/new_qos.rule configuration file. The vulnerability occurs because parsed fields from the configuration file are concatenated into command strings and executed via system() without any sanitization. An attacker with write access to /tmp/new_qos.rule can execute arbitrary commands on the device.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-77
References: http://d-link.com; https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-823G/CVE-2025-60675.md; https://www.dlink.com/en
CVE: CVE-2025-60676
Published: 2025-11-13
Description: An unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in the 'SetNetworkSettings' functionality of prog.cgi, where the 'IPAddress' and 'SubnetMask' parameters are directly concatenated into shell commands executed via system(). An attacker can exploit this vulnerability remotely without authentication by sending a specially crafted HTTP request, leading to arbitrary command execution on the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://d-link.com; https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-878/CVE-2025-60676.md; https://www.dlink.com/en
CVE: CVE-2025-63406
Published: 2025-11-13
Description: An issue in Intermesh BV GroupOffice vulnerable before v.25.0.47 and 6.8.136 allows a remote attacker to execute arbitrary code via the dbToApi() and eval() in the FunctionField.php
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/WinDyAlphA/CVE-2025-63406-PoC; https://noahheraud.com/posts/CVE-2025-63406/
CVE: CVE-2022-4984
Published: 2025-11-13
Description: ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTao Open Source Edition < 16.5.beta1 contain an SQL injection vulnerability in the login functionality. The application does not properly validate the account parameter on /zentao/user-login.html before using it in a database query. A remote unauthenticated attacker can exploit this issue to execute crafted SQL expressions and retrieve sensitive information from the backend database, including user and application data. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-07 UTC.
CWE: CWE-89
References: https://www.cnvd.org.cn/flaw/show/CNVD-2022-42853; https://www.vulncheck.com/advisories/zentao-biz-max-and-open-source-edition-sqli-via-user-login; https://www.zentao.pm/download/zentao-community-edition-release-165-1170.html
CVE: CVE-2025-46362
Published: 2025-11-13
Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE: CVE-2025-46367
Published: 2025-11-13
Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-390
References: https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE: CVE-2025-46368
Published: 2025-11-13
Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-377
References: https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE: CVE-2025-46369
Published: 2025-11-13
Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-377
References: https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE: CVE-2025-46370
Published: 2025-11-13
Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
CVSS Score: 3.3 (LOW)
CWE: CWE-114
References: https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE: CVE-2025-55810
Published: 2025-11-13
Description: A vulnerability was found in Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware version V03 and firmware version 1.4.2, which allows physical attackers to execute commands as root via script file with a specific name on a SD card.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434
References: https://www.alagaai.com/; https://www.mgm-sp.com/privilege-escalation-vulnerability-in-alaga-home-security-wifi-camera
CVE: CVE-2025-59840
Published: 2025-11-13
Description: Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They are vulnerable if they use `vega` in an application that attaches `vega` library and a `vega.View` instance similar to the Vega Editor to the global `window` and if they allow user-defined Vega `JSON` definitions (vs JSON that was is only provided through source code). Patches are available in the following Vega applications. If using the latest Vega line (6.x), upgrade to `vega` `6.2.0` / `vega-expression` `6.1.0` / `vega-interpreter`  `2.2.1` (if using AST evaluator mode). If using Vega in a non-ESM environment, upgrade to `vega-expression` `5.2.1` / `1.2.1` (if using AST evaluator mode). Some workarounds are available. Do not attach `vega` View instances to global variables, and do not attach `vega` to the global window. These practices of attaching the vega library and View instances may be convenient for debugging, but should not be used in production or in any situation where vega/vega-lite definitions could be provided by untrusted parties.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/vega/vega/security/advisories/GHSA-7f2v-3qq3-vvjf
CVE: CVE-2025-60679
Published: 2025-11-13
Description: A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/version content to potentially execute arbitrary code on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: http://d-link.com; https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-816/CVE-2025-60679.md; https://www.dlink.com/en
CVE: CVE-2025-60699
Published: 2025-11-13
Description: A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary. The `getSaveConfig` function retrieves the `http_host` parameter from user input via `websGetVar` and copies it into a fixed-size stack buffer (`v13`) using `strcpy()` without performing any length checks. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface, potentially leading to arbitrary code execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/2.md; https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/CVE-2025-60699.md; https://www.totolink.net/
CVE: CVE-2025-60702
Published: 2025-11-13
Description: A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/1.md; https://github.com/yifan20020708/SGTaint-0-day/blob/main/ToToLink/ToToLink-A950RG/CVE-2025-60702.md; https://www.totolink.net/
CVE: CVE-2025-64709
Published: 2025-11-13
Description: Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component) functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure. Version 3.13.1 fixes the issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-918
References: https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-8gq9-rw7v-3jpr
CVE: CVE-2025-64726
Published: 2025-11-13
Description: Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Firewall binary versions (separate from installers) prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project directories. The vulnerability allows an attacker to execute arbitrary code by placing a malicious `.sfw.config` file in a project directory. When a developer runs Socket Firewall commands (e.g., `sfw npm install`) in that directory, the tool loads the `.sfw.config` file and populates environment variables directly into the Node.js process. An attacker can exploit this by setting `NODE_OPTIONS` with a `--require` directive to execute malicious JavaScript code before Socket Firewall's security controls are initialized, effectively bypassing the tool's malicious package detection. The attack vector is indirect and requires a developer to install dependencies for an untrusted project and execute a command within the context of the untrusted project. The vulnerability has been patched in Socket Firewall version 0.15.5. Users should upgrade to version 0.15.5 or later. The fix isolates configuration file values from subprocess environments. Look at `sfw --version` for version information. If users rely on the recommended installation mechanism (e.g. global installation via `npm install -g sfw`) then no workaround is necessary. This wrapper package automatically ensures that users are running the latest version of Socket Firewall. Users who have manually installed the binary and cannot immediately upgrade should avoid running Socket Firewall in untrusted project directories. Before running Socket Firewall in any new project, inspect `.sfw.config` and `.env.local` files for suspicious `NODE_OPTIONS` or other environment variable definitions that reference local files.
CWE: CWE-15, CWE-427
References: https://bsky.app/profile/evilpacket.net/post/3m4iylwxtns2t; https://github.com/SocketDev/firewall-release/security/advisories/GHSA-6c5p-vqrh-h6fp
CVE: CVE-2025-47220
Published: 2025-11-13
Description: A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which exists in the PDFSigner and the PAdESSigner, can be set to any path without any restrictions by an admin user. In the case that the provided path points to an existing file, readable by the user running the application server, but is not a recognized image format, it will return this as an error to the clientside, confirming the existences of the file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://docs.keyfactor.com/signserver/latest/signserver-7-3-release-notes; https://support.keyfactor.com; https://support.keyfactor.com/hc/en-us/articles/[PII_REDACTED]1035-SignServer-CVE-2025-47220-Local-file-enumeration
CVE: CVE-2025-47221
Published: 2025-11-13
Description: An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCHIVETODISK_PATH_PATTERN can be set to any path, even ones that will point to files that already exist. This vulnerability gives a user with admin access the possibility to write files in arbitrary directories in the server file system and potentially overwrite files accessible by the local user JBoss.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://docs.keyfactor.com/signserver/latest/signserver-7-3-release-notes; https://support.keyfactor.com; https://support.keyfactor.com/hc/en-us/articles/[PII_REDACTED]1067-SignServer-CVE-2025-47221-Arbitrary-file-write
CVE: CVE-2025-47222
Published: 2025-11-13
Description: A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class path and the provided class is not expected to return different errors if the class exists in deployment or not. This returns information about the classes loaded in the application or not to the clientside.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://docs.keyfactor.com/signserver/latest/signserver-7-3-release-notes; https://support.keyfactor.com; https://support.keyfactor.com/hc/en-us/articles/[PII_REDACTED]4235-SignServer-CVE-2025-47222-Class-name-enumeration
CVE: CVE-2025-4619
Published: 2025-11-13
Description: A denial-of-service (DoS) vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to reboot a firewall by sending a specially crafted packet through the dataplane. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.

This issue is applicable to the PAN-OS software versions listed below on PA-Series firewalls, VM-Series firewalls, and Prisma® Access software. This issue does not affect Cloud NGFW.

​​We have successfully completed the Prisma Access upgrade for all customers, with the exception of those facing issues such as conflicting maintenance windows.  Remaining customers will be promptly scheduled for an upgrade through our standard upgrade process.
CWE: CWE-754
References: https://security.paloaltonetworks.com/CVE-2025-4619
CVE: CVE-2025-64744
Published: 2025-11-13
Description: OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name, the markup is rendered inside the invitation email. This indicates that user-controlled input is inserted into the email template without proper HTML escaping. As of time of publication, no patched versions are available.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/openobserve/openobserve/security/advisories/GHSA-3jpx-57gj-w458
CVE: CVE-2025-64745
Published: 2025-11-13
Description: Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it could be exploited to compromise developer environments through social engineering or malicious links. Version 5.15.6 fixes the issue.
CVSS Score: 2.7 (LOW)
CWE: CWE-79
References: https://github.com/withastro/astro/blob/5bc37fd5cade62f753aef66efdf40f982379029a/packages/astro/src/template/4xx.ts#L133-L149; https://github.com/withastro/astro/commit/790d9425f39bbbb462f1c27615781cd965009f91; https://github.com/withastro/astro/pull/12994
CVE: CVE-2025-64746
Published: 2025-11-13
Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean up field-level permissions when a field is deleted. When a field is removed from a collection, its reference in the permissions table remains intact. This stale reference creates a security gap: if another field is later created using the same name, it inherits the outdated permission entry. This behavior can unintentionally grant roles access to data they should not be able to read or modify. The issue is particularly risky in multi-tenant or production environments, where administrators may reuse field names, assuming old permissions have been fully cleared. Version 11.13.0 fixes the issue.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-284, CWE-863, CWE-863
References: https://github.com/directus/directus/commit/84d[PII_REDACTED]387164ce5d2fd15a65e11e2d0b8; https://github.com/directus/directus/security/advisories/GHSA-9x5g-62gj-wqf2
CVE: CVE-2025-13130
Published: 2025-11-13
Description: A vulnerability has been found in Radarr 5.28.0.10274. The affected element is an unknown function of the file C:\ProgramData\Radarr\bin\Radarr.Console.exe of the component Service. Such manipulation leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266, CWE-276
References: https://github.com/lakshayyverma/CVE-Discovery/blob/main/Radarr.md; https://vuldb.com/?ctiid.332361; https://vuldb.com/?id.332361
CVE: CVE-2025-13131
Published: 2025-11-13
Description: A vulnerability was found in Sonarr 4.0.15.2940. The impacted element is an unknown function of the file C:\ProgramData\Sonarr\bin\Sonarr.Console.exe of the component Service. Performing manipulation results in incorrect default permissions. The attack is only possible with local access. The vendor confirms this vulnerability but classifies it as a "low severity issue due to the default service user being used as it would either require someone to intentionally change the service to a highly privileged account or an attacker would need an admin level account". It is planned to fix this issue in the next major release v5.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266, CWE-276
References: https://github.com/lakshayyverma/CVE-Discovery/blob/main/Sonarr.md; https://vuldb.com/?ctiid.332362; https://vuldb.com/?id.332362
CVE: CVE-2025-36096
Published: 2025-11-13
Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-522
References: https://www.ibm.com/support/pages/node/7251173
CVE: CVE-2025-36236
Published: 2025-11-13
Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7251173
CVE: CVE-2025-36250
Published: 2025-11-13
Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls.  This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-114
References: https://www.ibm.com/support/pages/node/7251173
CVE: CVE-2025-36251
Published: 2025-11-13
Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-114
References: https://www.ibm.com/support/pages/node/7251173
CVE: CVE-2025-47913
Published: 2025-11-13
Description: SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/advisories/GHSA-56w8-48fp-6mgv; https://go.dev/cl/700295; https://go.dev/issue/75178
CVE: CVE-2025-64747
Published: 2025-11-13
Description: Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 11.13.0 that allows users with `upload files` and `edit item` permissions to inject malicious JavaScript through the Block Editor interface. Attackers can bypass Content Security Policy (CSP) restrictions by combining file uploads with iframe srcdoc attributes, resulting in persistent XSS execution. Version 11.13.0 fixes the issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://github.com/directus/directus/commit/d23525317f0780f04aa1fe7a99171a358e43cb2e; https://github.com/directus/directus/security/advisories/GHSA-vv2v-pw69-8crf
CVE: CVE-2025-64748
Published: 2025-11-13
Description: Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Version 11.13.0 fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://github.com/directus/directus/commit/7737d56e096f95edfbdf861a3c08999ad31ce204; https://github.com/directus/directus/security/advisories/GHSA-8jpw-gpr4-8cmh
CVE: CVE-2025-64749
Published: 2025-11-13
Description: Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API returns different error messages for two cases: when a user tries to access an existing collection which they are not authorized to access, and when user tries to access a non-existing collection. The two differing error messages leak the existence of collections to users which are not authorized to access these collections. Version 11.13.0 fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203, CWE-209
References: https://github.com/directus/directus/commit/f99c9b89071f9d136cc9b0d0c182f2d24542bc31; https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr
CVE: CVE-2025-64752
Published: 2025-11-13
Description: grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. This issue is fixed in version 1.7.7. The mitigation was to use the proxy for untrusted fetches intended for such purposes. As a workaround, avoid making http/https endpoints available to an instance running Grist that expose credentials or operate without credentials.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918
References: https://github.com/gristlabs/grist-core/releases/tag/v1.7.7; https://github.com/gristlabs/grist-core/security/advisories/GHSA-qh95-2qv8-pqx3