deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-48045
Published: 2025-05-29
Description: An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.
CWE: CWE-201
References: https://www.rapid7.com/blog/post/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed/
CVE: CVE-2025-48046
Published: 2025-05-29
Description: An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.
CWE: CWE-256
References: https://www.rapid7.com/blog/post/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed/
CVE: CVE-2025-48047
Published: 2025-05-29
Description: An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.
CWE: CWE-78
References: https://www.rapid7.com/blog/post/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed/
CVE: CVE-2025-33043
Published: 2025-05-29
Description: APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vulnerability can potentially impact of integrity.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025005.pdf; https://www.kb.cert.org/vuls/id/209095
CVE: CVE-2025-37993
Published: 2025-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe

The spin lock tx_handling_spinlock in struct m_can_classdev is not
being initialized. This leads the following spinlock bad magic
complaint from the kernel, eg. when trying to send CAN frames with
cansend from can-utils:

| BUG: spinlock bad magic on CPU#0, cansend/95
|  lock: 0xff60000002ec1010, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
| CPU: 0 UID: 0 PID: 95 Comm: cansend Not tainted 6.15.0-rc3-00032-ga79be02bba5c #5 NONE
| Hardware name: MachineWare SIM-V (DT)
| Call Trace:
| [<ffffffff800133e0>] dump_backtrace+0x1c/0x24
| [<ffffffff800022f2>] show_stack+0x28/0x34
| [<ffffffff8000de3e>] dump_stack_lvl+0x4a/0x68
| [<ffffffff8000de70>] dump_stack+0x14/0x1c
| [<ffffffff80003134>] spin_dump+0x62/0x6e
| [<ffffffff800883ba>] do_raw_spin_lock+0xd0/0x142
| [<ffffffff807a6fcc>] _raw_spin_lock_irqsave+0x20/0x2c
| [<ffffffff80536dba>] m_can_start_xmit+0x90/0x34a
| [<ffffffff806148b0>] dev_hard_start_xmit+0xa6/0xee
| [<ffffffff8065b730>] sch_direct_xmit+0x114/0x292
| [<ffffffff80614e2a>] __dev_queue_xmit+0x3b0/0xaa8
| [<ffffffff8073b8fa>] can_send+0xc6/0x242
| [<ffffffff8073d1c0>] raw_sendmsg+0x1a8/0x36c
| [<ffffffff805ebf06>] sock_write_iter+0x9a/0xee
| [<ffffffff801d06ea>] vfs_write+0x184/0x3a6
| [<ffffffff801d0a88>] ksys_write+0xa0/0xc0
| [<ffffffff801d0abc>] __riscv_sys_write+0x14/0x1c
| [<ffffffff8079ebf8>] do_trap_ecall_u+0x168/0x212
| [<ffffffff807a830a>] handle_exception+0x146/0x152

Initializing the spin lock in m_can_class_allocate_dev solves that
problem.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2ecce25ea296f328d79070ee36229a15aeeb7aca; https://git.kernel.org/stable/c/7d5379cfecfdd665e4206bc4f[PII_REDACTED]779f; https://git.kernel.org/stable/c/dcaeeb8ae84c5506ebc[PII_REDACTED]64f3887738c
CVE: CVE-2025-37994
Published: 2025-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: displayport: Fix NULL pointer access

This patch ensures that the UCSI driver waits for all pending tasks in the
ucsi_displayport_work workqueue to finish executing before proceeding with
the partner removal.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/076ab0631ed[PII_REDACTED]f1701e25f1e722bc086; https://git.kernel.org/stable/c/14f298c52188c34acde9760bf5abc669c5c36fdb; https://git.kernel.org/stable/c/312d79669e71283d05c05cc49a1a31e59e3d9e0e
CVE: CVE-2025-37995
Published: 2025-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

module: ensure that kobject_put() is safe for module type kobjects

In 'lookup_or_create_module_kobject()', an internal kobject is created
using 'module_ktype'. So call to 'kobject_put()' on error handling
path causes an attempt to use an uninitialized completion pointer in
'module_kobject_release()'. In this scenario, we just want to release
kobject without an extra synchronization required for a regular module
unloading process, so adding an extra check whether 'complete()' is
actually required makes 'kobject_put()' safe.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824
References: https://git.kernel.org/stable/c/31d8df3f303c3ae[PII_REDACTED]977ef8c35c88808; https://git.kernel.org/stable/c/93799fb988757cdacf19acba57807746c00378e6; https://git.kernel.org/stable/c/9e7b49ce4f9d0cb5b6e87db9e07a2fb9e754b0dd
CVE: CVE-2025-37996
Published: 2025-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()

Commit fce886a60207 ("KVM: arm64: Plumb the pKVM MMU in KVM") made the
initialization of the local memcache variable in user_mem_abort()
conditional, leaving a codepath where it is used uninitialized via
kvm_pgtable_stage2_map().

This can fail on any path that requires a stage-2 allocation
without transition via a permission fault or dirty logging.

Fix this by making sure that memcache is always valid.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/157dbc4a321f5bb6f8b6c724d12ba720a90f1a7c; https://git.kernel.org/stable/c/a26d50f8a4a5049e956984797b5d0dedea4bbb18
CVE: CVE-2025-37997
Published: 2025-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix region locking in hash types

Region locking introduced in v5.6-rc4 contained three macros to handle
the region locks: ahash_bucket_start(), ahash_bucket_end() which gave
back the start and end hash bucket values belonging to a given region
lock and ahash_region() which should give back the region lock belonging
to a given hash bucket. The latter was incorrect which can lead to a
race condition between the garbage collector and adding new elements
when a hash type of set is defined with timeouts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/00cfc5fad[PII_REDACTED]a948808afb968a0a3f35b; https://git.kernel.org/stable/c/226ce0ec38316d9e3739e73a64b6b8304646c658; https://git.kernel.org/stable/c/6e002ecc1c8cfdfc866b9104ab7888da54613e59
CVE: CVE-2025-37998
Published: 2025-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

openvswitch: Fix unsafe attribute parsing in output_userspace()

This patch replaces the manual Netlink attribute iteration in
output_userspace() with nla_for_each_nested(), which ensures that only
well-formed attributes are processed.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0236742bd959332181c1fcc41a05b7b709180501; https://git.kernel.org/stable/c/06b4f110c79716c181a8c5da007c[PII_REDACTED]32; https://git.kernel.org/stable/c/47f7f00cf2fa3137d5c0416ef1a71bdf77901395
CVE: CVE-2025-37999
Published: 2025-05-29
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()

If bio_add_folio() fails (because it is full),
erofs_fileio_scan_folio() needs to submit the I/O request via
erofs_fileio_rq_submit() and allocate a new I/O request with an empty
`struct bio`.  Then it retries the bio_add_folio() call.

However, at this point, erofs_onlinefolio_split() has already been
called which increments `folio->private`; the retry will call
erofs_onlinefolio_split() again, but there will never be a matching
erofs_onlinefolio_end() call.  This leaves the folio locked forever
and all waiters will be stuck in folio_wait_bit_common().

This bug has been added by commit ce63cb62d794 ("erofs: support
unencoded inodes for fileio"), but was practically unreachable because
there was room for 256 folios in the `struct bio` - until commit
9f74ae8c9ac9 ("erofs: shorten bvecs[] for file-backed mounts") which
reduced the array capacity to 16 folios.

It was now trivial to trigger the bug by manually invoking readahead
from userspace, e.g.:

 posix_fadvise(fd, 0, st.st_size, POSIX_FADV_WILLNEED);

This should be fixed by invoking erofs_onlinefolio_split() only after
bio_add_folio() has succeeded.  This is safe: asynchronous completions
invoking erofs_onlinefolio_end() will not unlock the folio because
erofs_fileio_scan_folio() is still holding a reference to be released
by erofs_onlinefolio_end() at the end.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/61e0fc[PII_REDACTED]e5a3495329dad0286d2a5703; https://git.kernel.org/stable/c/bbfe756dc3062c1e934f06e5ba39c239aa953b92; https://git.kernel.org/stable/c/c26076197df348c84cc23e5962d61902e072a0f5
CVE: CVE-2025-46078
Published: 2025-05-29
Description: HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/yggcwhat/CVE-2025-46078/; https://github.com/yggcwhat/test/blob/main/README.md
CVE: CVE-2025-46080
Published: 2025-05-29
Description: HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/yggcwhat/CVE-2025-46080/; https://github.com/yggcwhat/test2/blob/main/README.md
CVE: CVE-2025-5320
Published: 2025-05-29
Description: A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to erweiterte Rechte. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-345, CWE-346
References: https://gist.github.com/superboy-zjc/aa3dfa161d7b19d8a53ab4605792f2fe; https://gist.github.com/superboy-zjc/aa3dfa161d7b19d8a53ab4605792f2fe#proof-of-concept-poc; https://vuldb.com/?ctiid.310491
CVE: CVE-2024-22653
Published: 2025-05-29
Description: yasm commit 9defefae was discovered to contain a NULL pointer dereference via the yasm_section_bcs_append function at section.c.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/TimChan2001/03e5792b15d0a34bfaad970e37c17660; https://github.com/yasm/yasm/issues/247
CVE: CVE-2024-22654
Published: 2025-05-29
Description: tcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://gist.github.com/TimChan2001/4f25915b9952e8e3453db5cf72185b88; https://github.com/appneta/tcpreplay/issues/827; https://github.com/appneta/tcpreplay/issues/827
CVE: CVE-2025-48748
Published: 2025-05-29
Description: Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-798
References: https://community.netwrix.com/t/adv-2025-013-hard-coded-password-in-netwrix-directory-manager-formerly-imanami-groupid-v10-and-earlier/13945
CVE: CVE-2025-4081
Published: 2025-05-29
Description: Use of entitlement "com.apple.security.cs.disable-library-validation" and lack of launch and library load constraints allows to substitute a legitimate dylib with malicious one. A local attacker with unprivileged access can execute the application with altered dynamic library successfully bypassing Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.

This issue affects DaVinci Resolve on macOS in all versions.
Last tested version: 19.1.3
CWE: CWE-276
References: https://cert.pl/en/posts/2025/05/tcc-bypass/; https://www.blackmagicdesign.com/products/davinciresolve
CVE: CVE-2025-5321
Published: 2025-05-29
Description: A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264, CWE-265
References: https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c; https://vuldb.com/?ctiid.310492; https://vuldb.com/?id.310492
CVE: CVE-2025-5334
Published: 2025-05-29
Description: Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager
allows an authenticated user to gain unauthorized access to private personal information. 



Under specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users.




This issue affects the following versions :

  *  Remote Desktop Manager Windows 2025.1.34.0 and earlier
  *  
Remote Desktop Manager macOS 2025.1.16.3 and earlier



  *  
Remote Desktop Manager Android 2025.1.3.3 and earlier
  *  
Remote Desktop Manager iOS 2025.1.6.0 and earlier
CVSS Score: 7.5 (HIGH)
CWE: CWE-359, CWE-200
References: https://devolutions.net/security/advisories/DEVO-2025-0009
CVE: CVE-2025-3913
Published: 2025-05-29
Description: Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-45474
Published: 2025-05-29
Description: maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918
References: https://www.yuque.com/morysummer/vx41bz/ptnnp4eema601rvz
CVE: CVE-2025-48389
Published: 2025-05-29
Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the get method, deserialization will occur, which will allow arbitrary code execution This issue has been patched in version 1.8.178.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://github.com/freescout-help-desk/freescout/commit/f7548a7076a0b6e109001069d6be223fbd96c61e; https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jmpv-8q3h-2m8v
CVE: CVE-2025-48390
Published: 2025-05-29
Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to insufficient validation of user input in the php_path parameter. The backticks characters are not removed, as well as tabulation is not removed. When checking user input, the file_exists function is also called to check for the presence of such a file (folder) in the file system. A user with the administrator role can create a translation for the language, which will create a folder in the file system. Further in tools.php, the user can specify the path to this folder as php_path, which will lead to the execution of code in backticks. This issue has been patched in version 1.8.178.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/freescout-help-desk/freescout/commit/fb33d672a2d67f5a2b3cf69c80945267f17908b2; https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5324-cw55-gwj5
CVE: CVE-2025-48471
Published: 2025-05-29
Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insufficient checking of files uploaded to the application. This allows files to be uploaded with the phtml and phar extensions, which can lead to remote code execution if the Apache web server is used. This issue has been patched in version 1.8.179.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/freescout-help-desk/freescout/commit/e136660e8dbc220454b8d3f646dd1b144e49e9ed; https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-h2f3-932h-v38j; https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-h2f3-932h-v38j
CVE: CVE-2025-48472
Published: 2025-05-29
Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications for the mailbox to which they already have access. Moreover, the code explicitly implements functionality that if the user does not have access to the mailbox, then after disabling (enabling) notifications for this mailbox, the user will gain access to it. This issue has been patched in version 1.8.179.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://github.com/freescout-help-desk/freescout/commit/01c91d2086ddd56778698e557138a178b2f59916; https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-f62r-8354-8pqg; https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-f62r-8354-8pqg
CVE: CVE-2025-48473
Published: 2025-05-29
Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, there is no check to ensure that the user has the ability to view this message. Thus, the user can view arbitrary messages from other mailboxes or from other conversations to which they do not have access (access restriction to conversations is implemented by the show_only_assigned_conversations setting, which is also not checked). This issue has been patched in version 1.8.179.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/freescout-help-desk/freescout/commit/2552a2b84248824b73c35b2699aa86da644eea1a; https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-3x75-7856-r794
CVE: CVE-2025-48474
Published: 2025-05-29
Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations. Users with show_only_assigned_conversations enabled can assign themselves to an arbitrary conversation from the mailbox to which they have access, thereby bypassing the restriction on viewing conversations. This issue has been patched in version 1.8.180.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://github.com/freescout-help-desk/freescout/commit/87cdb65d6b632b5292bcac2d7a209f6e36ae51d7; https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9wc4-vchw-mr3m
CVE: CVE-2024-51392
Published: 2025-05-29
Description: An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-269
References: https://github.com/OpenKnowledgeMaps/Headstart; https://github.com/manisashank/CVE-Publish/blob/main/CVE-2024-51392.md
CVE: CVE-2025-46570
Published: 2025-05-29
Description: vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time to First Token). These timing differences caused by matching chunks are significant enough to be recognized and exploited. This issue has been patched in version 0.9.0.
CVSS Score: 2.6 (LOW)
CWE: CWE-208, CWE-203
References: https://github.com/vllm-project/vllm/commit/77073c77bc2006eb80ea6d5128f076f5e6c6f54f; https://github.com/vllm-project/vllm/pull/17045; https://github.com/vllm-project/vllm/security/advisories/GHSA-4qjh-9fv9-r85r
CVE: CVE-2025-46722
Published: 2025-05-29
Description: vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image objects using only obj.tobytes(), which returns only the raw pixel data, without including metadata such as the image’s shape (width, height, mode). As a result, two images of different sizes (e.g., 30x100 and 100x30) with the same pixel byte sequence could generate the same hash value. This may lead to hash collisions, incorrect cache hits, and even data leakage or security risks. This issue has been patched in version 0.9.0.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-1023, CWE-1288
References: https://github.com/vllm-project/vllm/commit/99404f53c72965b41558aceb1bc2380875f5d848; https://github.com/vllm-project/vllm/pull/17378; https://github.com/vllm-project/vllm/security/advisories/GHSA-c65p-x677-fgj6
CVE: CVE-2025-48475
Published: 2025-05-29
Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a check on which "clients" of the System an authorized user can view and edit, and which ones they cannot. As a result, an authorized user who does not have access to any of the existing mailboxes, as well as to any of the existing conversations, has the ability to view and edit the System's clients. The limitation of client visibility can be implemented by the limit_user_customer_visibility setting, however, in the specified scenarios, there is no check for the presence of this setting. This issue has been patched in version 1.8.180.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://github.com/freescout-help-desk/freescout/commit/1f154ce039618ed5abd960c97619c23534c0717a; https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-xvch-f75c-8w8q
CVE: CVE-2023-41591
Published: 2025-05-29
Description: An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communications between fake and real hosts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://gist.github.com/kjw6855/9764e3f51b89119473e4d2c4f64dca27; https://wiki.onosproject.org/pages/viewpage.action?pageId=16122675
CVE: CVE-2024-53423
Published: 2025-05-29
Description: An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted packets.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-400
References: https://gist.github.com/kjw6855/abeecc798d138b49537393e1fd3a5e96; https://wiki.onosproject.org/pages/viewpage.action?pageId=16122675
CVE: CVE-2025-29632
Published: 2025-05-29
Description: Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-120
References: https://github.com/OHnogood/CVE-2025-29632/; https://github.com/free5gc/free5gc/issues/657