deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2600
Published: 2025-03-26
Description: Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the "Allow password in variable policy". 





This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-285
References: https://devolutions.net/security/advisories/DEVO-2025-0005/
CVE: CVE-2025-30351
Published: 2025-03-26
Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in `verifySessionJWT` to verify that a user is actually still active and allowed to access the API. One can extract the session token obtained by, e.g. login in to the app while still active and then, after the user has been suspended continue to use that token until it expires. Version 11.5.0 patches the issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-672
References: https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d[PII_REDACTED]; https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g; https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g
CVE: CVE-2025-30352
Published: 2025-03-26
Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the enumeration of unknown field contents. The searchable columns (numbers & strings) are not checked against permissions when injecting the `where` clauses for applying the search query. This leads to the possibility of enumerating those un-permitted fields. Version 11.5.0 fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/directus/directus/commit/ac5a9964d9926f20dc063a74cb417dc7bbad676d; https://github.com/directus/directus/security/advisories/GHSA-7wq3-jr35-275c; https://github.com/directus/directus/security/advisories/GHSA-7wq3-jr35-275c
CVE: CVE-2025-30353
Published: 2025-03-26
Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the "Webhook" trigger and the "Data of Last Operation" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200
References: https://github.com/directus/directus/security/advisories/GHSA-fm3h-p9wm-h74h; https://github.com/directus/directus/security/advisories/GHSA-fm3h-p9wm-h74h
CVE: CVE-2025-25535
Published: 2025-03-26
Description: HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://github.com/simalamuel/Research/tree/main/CVE-2025-25535; https://www.besafebrasil.com.br/script-case-cve-2025-xx-xxxx/
CVE: CVE-2025-26001
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/Fan-24/Digging/blob/main/1/1.md; https://github.com/Fan-24/Digging/tree/main/1
CVE: CVE-2025-26002
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Fan-24/Digging/blob/main/3/1.md; https://github.com/Fan-24/Digging/tree/main/2
CVE: CVE-2025-26003
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/Fan-24/Digging/blob/main/5/1.md
CVE: CVE-2025-26004
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack buffer overflow vulnerability when requesting admin.cgi parameter with setDdns.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Fan-24/Digging/blob/main/6/1.md
CVE: CVE-2025-29322
Published: 2025-03-26
Description: A cross-site scripting (XSS) vulnerability in ScriptCase before v1.0.003 - Build 3 allows attackers to execute arbitrary code via a crafted payload to the "Connection Name" in the New Connection and Rename Connection pages.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/simalamuel/Research/tree/main/CVE-2025-29322; https://www.scriptcase.com.br/
CVE: CVE-2024-55963
Published: 2025-03-26
Description: An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/appsmithorg/appsmith/security/advisories/GHSA-6mc8-hw5c-7qqr
CVE: CVE-2024-55964
Published: 2025-03-26
Description: An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that datasource, and execute that query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m95x-4w54-gc83
CVE: CVE-2025-26005
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 is vulnerable to unauthorized stack overflow vulnerability when requesting admin.cgi parameter with setNtp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Fan-24/Digging/blob/main/7/1.md
CVE: CVE-2025-26006
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setAutorest.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Fan-24/Digging/blob/main/4/1.md
CVE: CVE-2025-26007
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability in the login interface when requesting systemtil.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Fan-24/Digging/blob/main/10/1.md
CVE: CVE-2025-26008
Published: 2025-03-26
Description: In Telesquare TLR-2005KSH 1.1.4, an unauthorized stack overflow vulnerability exists when requesting admin.cgi parameter with setSyncTimeHost.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Fan-24/Digging/blob/main/2/1.md
CVE: CVE-2025-26009
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 has an Information Disclosure vulnerability when requesting systemutilit.cgi.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/Fan-24/Digging/blob/main/11/1.md
CVE: CVE-2025-26010
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/Fan-24/Digging/blob/main/9/1.md
CVE: CVE-2025-26011
Published: 2025-03-26
Description: Telesquare TLR-2005KSH 1.1.4 has an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setUsernamePassword.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Fan-24/Digging/blob/main/8/1.md
CVE: CVE-2025-28361
Published: 2025-03-26
Description: Unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH v.1.1.4 allows a remote attacker to obtain sensitive information via the systemutil.cgi component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/wyq-zzu/excavate/blob/main/2/1.md
CVE: CVE-2025-30073
Published: 2025-03-26
Description: An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first or all transactions with the same reference are completed, depending on timing. This can be used to transfer more money onto employee cards than is paid.
CVSS Score: 7.5 (HIGH)
CWE: CWE-488
References: https://www.syss.de/pentest-blog/businesslogik-fehler-bei-aufwertung-von-geldkarten-in-opcr-webapp-aufwertung-syss-2024-089
CVE: CVE-2024-55965
Published: 2025-03-26
Description: An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically, a list of datasources in a workspace they're a member of). This information disclosure does not expose sensitive data in the datasources, such as database passwords and API Keys.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6
CVE: CVE-2025-2787
Published: 2025-03-26
Description: KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i.e. requires an authenticated user, the severity in the context of KNIME Business Hub is slightly lower.



Besides applying the publicly known workarounds, we strongly recommend updating to one of the following versions of KNIME Business Hub: 



  *  1.13.3 or above 






  *  1.12.4 or above 






  *  1.11.4 or above 






  *  1.10.4 or above








  *
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.knime.com/security-advisory-cve-2025-2787
CVE: CVE-2025-31160
Published: 2025-03-26
Description: atop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecified other impact by running certain types of unprivileged processes while a different user runs atop.
CVSS Score: 2.9 (LOW)
CWE: CWE-617
References: https://blog.bismuth.sh/blog/bismuth-found-the-atop-bug; https://github.com/Atoptool/atop; https://news.ycombinator.com/item?id=43477057
CVE: CVE-2025-20226
Published: 2025-03-26
Description: In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on the "/services/streams/search" endpoint through its "q" parameter. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://advisory.splunk.com/advisories/SVD-2025-0305
CVE: CVE-2025-20227
Published: 2025-03-26
Description: In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://advisory.splunk.com/advisories/SVD-2025-0306
CVE: CVE-2025-20228
Published: 2025-03-26
Description: In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://advisory.splunk.com/advisories/SVD-2025-0303
CVE: CVE-2025-20229
Published: 2025-03-26
Description: In Splunk Enterprise versions below 9.3.3, 9.2.5,  and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) through a file upload to the "$SPLUNK_HOME/var/run/splunk/apptemp" directory due to missing authorization checks.
CVSS Score: 8.0 (HIGH)
CWE: CWE-284
References: https://advisory.splunk.com/advisories/SVD-2025-0301
CVE: CVE-2025-20231
Published: 2025-03-26
Description: In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search using the permissions of a higher-privileged user that could lead to disclosure of sensitive information.<br><br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated low-privileged user should not be able to exploit the vulnerability at will.
CVSS Score: 7.1 (HIGH)
CWE: CWE-532
References: https://advisory.splunk.com/advisories/SVD-2025-0302
CVE: CVE-2025-20232
Published: 2025-03-26
Description: In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on the “/app/search/search“ endpoint through its “s“ parameter. <br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://advisory.splunk.com/advisories/SVD-2025-0304
CVE: CVE-2025-20233
Published: 2025-03-26
Description: In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the `chmod` and `makedirs` Python functions in a way that resulted in overly broad read and execute permissions. This could lead to improper access control for a low-privileged user.
CVSS Score: 2.5 (LOW)
CWE: CWE-732
References: https://advisory.splunk.com/advisories/SVD-2025-0310
CVE: CVE-2025-2837
Published: 2025-03-26
Description: Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of HTTP requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23245.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://community.silabs.com/a45Vm0000000Atp; https://www.zerodayinitiative.com/advisories/ZDI-24-871/
CVE: CVE-2025-2838
Published: 2025-03-26
Description: Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://community.silabs.com/a45Vm0000000Atp; https://www.zerodayinitiative.com/advisories/ZDI-24-872/
CVE: CVE-2025-30407
Published: 2025-03-26
Description: Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39713.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-426
References: https://security-advisory.acronis.com/advisories/SEC-8414
CVE: CVE-2025-20230
Published: 2025-03-26
Description: In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and delete other user data in App Key Value Store (KVStore) collections that the Splunk Secure Gateway app created. This is due to missing access control and incorrect ownership of the data in those KVStore collections.<br><br>In the affected versions, the `nobody` user owned the data in the KVStore collections. This meant that there was no specific owner assigned to the data in those collections.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://advisory.splunk.com/advisories/SVD-2025-0307
CVE: CVE-2025-2496
Published: 2025-03-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-30355
Published: 2025-03-27
Description: Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://github.com/element-hq/synapse/commit/2277df2a1eb685f85040ef98fa21d41aa4cdd389; https://github.com/element-hq/synapse/releases/tag/v1.127.1; https://github.com/element-hq/synapse/security/advisories/GHSA-v56r-hwv5-mxg6
CVE: CVE-2024-45352
Published: 2025-03-27
Description: An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=550
CVE: CVE-2025-2481
Published: 2025-03-27
Description: The MediaView plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id' parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/mediaview/tags/1.1.2/inc/forms/addMedia.inc.php#L48; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3296857%40mediaview&new=3296857%40mediaview&sfp_email=&sfph_mail=; https://wordpress.org/plugins/mediaview/#developers
CVE: CVE-2025-2831
Published: 2025-03-27
Description: A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vulnerability affects the function getBookList of the file /admin/bookList?page=1&limit=10. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/mingyuefusu/tushuguanlixitong/issues/IBTSJL; https://vuldb.com/?ctiid.301468; https://vuldb.com/?id.301468
CVE: CVE-2025-2832
Published: 2025-03-27
Description: A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://gitee.com/mingyuefusu/tushuguanlixitong/issues/IBTSPH; https://vuldb.com/?ctiid.301469; https://vuldb.com/?id.301469
CVE: CVE-2025-2833
Published: 2025-03-27
Description: A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://github.com/zhangyd-c/OneBlog/issues/35; https://github.com/zhangyd-c/OneBlog/issues/35#issue[PII_REDACTED]; https://vuldb.com/?ctiid.301470
CVE: CVE-2025-2835
Published: 2025-03-27
Description: A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/zhangyd-c/OneBlog/issues/36; https://github.com/zhangyd-c/OneBlog/issues/36#issue[PII_REDACTED]; https://vuldb.com/?ctiid.301471
CVE: CVE-2025-31165
Published: 2025-03-27
Description: Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.
CWE: CWE-79
References: https://bug.report.night-wolf.io/changelogs
CVE: CVE-2025-0273
Published: 2025-03-27
Description: HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120138