deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-23130
Published: 2025-04-16
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid panic once fallocation fails for pinfile

syzbot reports a f2fs bug as below:

------------[ cut here ]------------
kernel BUG at fs/f2fs/segment.c:2746!
CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted 6.13.0-rc2-syzkaller-00018-g7cb1b4663150 #0
RIP: 0010:get_new_segment fs/f2fs/segment.c:2746 [inline]
RIP: 0010:new_curseg+0x1f52/0x1f70 fs/f2fs/segment.c:2876
Call Trace:
 <TASK>
 __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3210
 f2fs_allocate_new_section fs/f2fs/segment.c:3224 [inline]
 f2fs_allocate_pinning_section+0xfa/0x4e0 fs/f2fs/segment.c:3238
 f2fs_expand_inode_data+0x696/0xca0 fs/f2fs/file.c:1830
 f2fs_fallocate+0x537/0xa10 fs/f2fs/file.c:1940
 vfs_fallocate+0x569/0x6e0 fs/open.c:327
 do_vfs_ioctl+0x258c/0x2e40 fs/ioctl.c:885
 __do_sys_ioctl fs/ioctl.c:904 [inline]
 __se_sys_ioctl+0x80/0x170 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Concurrent pinfile allocation may run out of free section, result in
panic in get_new_segment(), let's expand pin_sem lock coverage to
include f2fs_gc(), so that we can make sure to reclaim enough free
space for following allocation.

In addition, do below changes to enhance error path handling:
- call f2fs_bug_on() only in non-pinfile allocation path in
get_new_segment().
- call reset_curseg_fields() to reset all fields of curseg in
new_curseg()
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2dda0930fb79b847b4bfceb737577d0f6bc24d7d; https://git.kernel.org/stable/c/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef; https://git.kernel.org/stable/c/[PII_REDACTED]d081a8346a3b841f862d732fce954b
CVE: CVE-2025-23131
Published: 2025-04-16
Description: In the Linux kernel, the following vulnerability has been resolved:

dlm: prevent NPD when writing a positive value to event_done

do_uevent returns the value written to event_done. In case it is a
positive value, new_lockspace would undo all the work, and lockspace
would not be set. __dlm_new_lockspace, however, would treat that
positive value as a success due to commit 8511a2728ab8 ("dlm: fix use
count with multiple joins").

Down the line, device_create_lockspace would pass that NULL lockspace to
dlm_find_lockspace_local, leading to a NULL pointer dereference.

Treating such positive values as successes prevents the problem. Given
this has been broken for so long, this is unlikely to break userspace
expectations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/8e2bad543eca5c25cd02cbc63d72557934d45f13; https://git.kernel.org/stable/c/b73c4ad4d387fe5bc988145bd9f1bc0de76afd5c
CVE: CVE-2025-23132
Published: 2025-04-16
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: quota: fix to avoid warning in dquot_writeback_dquots()

F2FS-fs (dm-59): checkpoint=enable has some unwritten data.

------------[ cut here ]------------
WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308
pc : dquot_writeback_dquots+0x2fc/0x308
lr : f2fs_quota_sync+0xcc/0x1c4
Call trace:
dquot_writeback_dquots+0x2fc/0x308
f2fs_quota_sync+0xcc/0x1c4
f2fs_write_checkpoint+0x3d4/0x9b0
f2fs_issue_checkpoint+0x1bc/0x2c0
f2fs_sync_fs+0x54/0x150
f2fs_do_sync_file+0x2f8/0x814
__f2fs_ioctl+0x1960/0x3244
f2fs_ioctl+0x54/0xe0
__arm64_sys_ioctl+0xa8/0xe4
invoke_syscall+0x58/0x114

checkpoint and f2fs_remount may race as below, resulting triggering warning
in dquot_writeback_dquots().

atomic write                                    remount
                                                - do_remount
                                                 - down_write(&sb->s_umount);
                                                  - f2fs_remount
- ioctl
 - f2fs_do_sync_file
  - f2fs_sync_fs
   - f2fs_write_checkpoint
    - block_operations
     - locked = down_read_trylock(&sbi->sb->s_umount)
       : fail to lock due to the write lock was held by remount
                                                 - up_write(&sb->s_umount);
     - f2fs_quota_sync
      - dquot_writeback_dquots
       - WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount))
       : trigger warning because s_umount lock was unlocked by remount

If checkpoint comes from mount/umount/remount/freeze/quotactl, caller of
checkpoint has already held s_umount lock, calling dquot_writeback_dquots()
in the context should be safe.

So let's record task to sbi->umount_lock_holder, so that checkpoint can
know whether the lock has held in the context or not by checking current
w/ it.

In addition, in order to not misrepresent caller of checkpoint, we should
not allow to trigger async checkpoint for those callers: mount/umount/remount/
freeze/quotactl.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/d7acf0a6c87aa282c86a36dbaa2f92fda88c5884; https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9
CVE: CVE-2025-23133
Published: 2025-04-16
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: update channel list in reg notifier instead reg worker

Currently when ath11k gets a new channel list, it will be processed
according to the following steps:
1. update new channel list to cfg80211 and queue reg_work.
2. cfg80211 handles new channel list during reg_work.
3. update cfg80211's handled channel list to firmware by
ath11k_reg_update_chan_list().

But ath11k will immediately execute step 3 after reg_work is just
queued. Since step 2 is asynchronous, cfg80211 may not have completed
handling the new channel list, which may leading to an out-of-bounds
write error:
BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list
Call Trace:
    ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k]
    kfree+0x109/0x3a0
    ath11k_regd_update+0x1cf/0x350 [ath11k]
    ath11k_regd_update_work+0x14/0x20 [ath11k]
    process_one_work+0xe35/0x14c0

Should ensure step 2 is completely done before executing step 3. Thus
Wen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set,
cfg80211 will notify ath11k after step 2 is done.

So enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will
notify ath11k after step 2 is done. At this time, there will be no
KASAN bug during the execution of the step 3.

[1] https://patchwork.kernel.org/project/linux-wireless/patch/[PII_REDACTED]5313.27203-1-quic_wgong@quicinc.com/

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/26618c039b78a76c373d4e02c5fbd52e3a73aead; https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2; https://git.kernel.org/stable/c/f952fb83c9c6f908d27500764c4aee1df04b9d3f
CVE: CVE-2025-23134
Published: 2025-04-16
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Don't take register_mutex with copy_from/to_user()

The infamous mmap_lock taken in copy_from/to_user() can be often
problematic when it's called inside another mutex, as they might lead
to deadlocks.

In the case of ALSA timer code, the bad pattern is with
guard(mutex)(&register_mutex) that covers copy_from/to_user() -- which
was mistakenly introduced at converting to guard(), and it had been
carefully worked around in the past.

This patch fixes those pieces simply by moving copy_from/to_user() out
of the register mutex lock again.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/15291b561d8cc835a2eea76b394070cf8e072771; https://git.kernel.org/stable/c/296f7a9e15aab276db11206cbc1e2ae1215d7862; https://git.kernel.org/stable/c/3424c8f53bc63c87712a7fc22dc13d0cc85fb0d6
CVE: CVE-2025-23135
Published: 2025-04-16
Description: In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Teardown riscv specific bits after kvm_exit

During a module removal, kvm_exit invokes arch specific disable
call which disables AIA. However, we invoke aia_exit before kvm_exit
resulting in the following warning. KVM kernel module can't be inserted
afterwards due to inconsistent state of IRQ.

[25469.031389] percpu IRQ 31 still enabled on CPU0!
[25469.031732] WARNING: CPU: 3 PID: 943 at kernel/irq/manage.c:2476 __free_percpu_irq+0xa2/0x150
[25469.031804] Modules linked in: kvm(-)
[25469.031848] CPU: 3 UID: 0 PID: 943 Comm: rmmod Not tainted 6.14.0-rc5-06947-g91c763118f47-dirty #2
[25469.031905] Hardware name: riscv-virtio,qemu (DT)
[25469.031928] epc : __free_percpu_irq+0xa2/0x150
[25469.031976]  ra : __free_percpu_irq+0xa2/0x150
[25469.032197] epc : ffffffff8007db1e ra : ffffffff8007db1e sp : ff[PII_REDACTED]bd50
[25469.032241]  gp : ffffffff8131cef8 tp : ff60000080b96400 t0 : ff[PII_REDACTED]baf8
[25469.032285]  t1 : fffffffffffffffc t2 : [PII_REDACTED] s0 : ff[PII_REDACTED]bd90
[25469.032329]  s1 : ff60000098b21080 a0 : 037d527a15eb4f00 a1 : 037d527a15eb4f00
[25469.032372]  a2 : [PII_REDACTED] a3 : [PII_REDACTED] a4 : ffffffff8122dbf8
[25469.032410]  a5 :[PII_REDACTED]000fff a6 : [PII_REDACTED] a7 : ffffffff8122dc10
[25469.032448]  s2 : ff60000080c22eb0 s3 : [PII_REDACTED] s4 :[PII_REDACTED]00001f
[25469.032488]  s5 : ff60000080c22e00 s6 : ffffffff80c351c0 s7 : [PII_REDACTED]
[25469.032582]  s8 : [PII_REDACTED] s9 : 000055556b7fb490 s10: 00007ffff0e12fa0
[25469.032621]  s11: 00007ffff0e13e9a t3 : ffffffff81354ac7 t4 : ffffffff81354ac7
[25469.032664]  t5 : ffffffff81354ac8 t6 : ffffffff81354ac7
[25469.032698] status: [PII_REDACTED] badaddr: ffffffff8007db1e cause: [PII_REDACTED]
[25469.032738] [<ffffffff8007db1e>] __free_percpu_irq+0xa2/0x150
[25469.032797] [<ffffffff8007dbfc>] free_percpu_irq+0x30/0x5e
[25469.032856] [<ffffffff013a57dc>] kvm_riscv_aia_exit+0x40/0x42 [kvm]
[25469.033947] [<ffffffff013b4e82>] cleanup_module+0x10/0x32 [kvm]
[25469.035300] [<ffffffff8009b150>] __riscv_sys_delete_module+0x18e/0x1fc
[25469.035374] [<ffffffff8000c1ca>] syscall_handler+0x3a/0x46
[25469.035456] [<ffffffff809ec9a4>] do_trap_ecall_u+0x72/0x134
[25469.035536] [<ffffffff809f5e18>] handle_exception+0x148/0x156

Invoke aia_exit and other arch specific cleanup functions after kvm_exit
so that disable gets a chance to be called first before exit.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1521cc04f0b6e737ff30105aa57fa9dde8493231; https://git.kernel.org/stable/c/1edb2de48616b11ee05e9a65d74c70abcb6d9939; https://git.kernel.org/stable/c/2d117e67f318303f6ab699a5511d1fac3f170545
CVE: CVE-2025-23136
Published: 2025-04-16
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal: int340x: Add NULL check for adev

Not all devices have an ACPI companion fwnode, so adev might be NULL.
This is similar to the commit cd2fd6eab480
("platform/x86: int3472: Check for adev == NULL").

Add a check for adev not being set and return -ENODEV in that case to
avoid a possible NULL pointer deref in int3402_thermal_probe().

Note, under the same directory, int3400_thermal_probe() has such a
check.

[ rjw: Subject edit, added Fixes: ]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/0c49f12c77b77a706fd41370c11910635e491845; https://git.kernel.org/stable/c/2542a3f70e563a9e70e7ded314286535a3321bdb; https://git.kernel.org/stable/c/3155d5261b518776d1b807d9d922669991bbee56
CVE: CVE-2025-23137
Published: 2025-04-16
Description: In the Linux kernel, the following vulnerability has been resolved:

cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update

Check if policy is NULL before dereferencing it in amd_pstate_update.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/426db24d4db2e4f0d6720aeb7795eafcb9e82640; https://git.kernel.org/stable/c/82b6dfff0d6000b14b271f74e43d672d81fb390e; https://git.kernel.org/stable/c/b99c1c63d88c75a4dc5487c3696cda38697b8d35
CVE: CVE-2025-23138
Published: 2025-04-16
Description: In the Linux kernel, the following vulnerability has been resolved:

watch_queue: fix pipe accounting mismatch

Currently, watch_queue_set_size() modifies the pipe buffers charged to
user->pipe_bufs without updating the pipe->nr_accounted on the pipe
itself, due to the if (!pipe_has_watch_queue()) test in
pipe_resize_ring(). This means that when the pipe is ultimately freed,
we decrement user->pipe_bufs by something other than what than we had
charged to it, potentially leading to an underflow. This in turn can
cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.

To remedy this, explicitly account for the pipe usage in
watch_queue_set_size() to match the number set via account_pipe_buffers()

(It's unclear why watch_queue_set_size() does not update nr_accounted;
it may be due to intentional overprovisioning in watch_queue_set_size()?)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/205028ebba838938d3b264dda1d0708fa7fe1ade; https://git.kernel.org/stable/c/2d680b988656bb556c863d8b46d9b9096842bf3d; https://git.kernel.org/stable/c/471c89b7d4f58bd6082f7c1fe14d4ca15c7f1284
CVE: CVE-2025-3694
Published: 2025-04-16
Description: A vulnerability classified as critical has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part of the component Login Handler. The manipulation of the argument login_email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/sql_inject_in_session_email.md; https://vuldb.com/?ctiid.304983; https://vuldb.com/?id.304983
CVE: CVE-2025-3696
Published: 2025-04-16
Description: A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affects unknown code of the file /search/search_stock. php. The manipulation of the argument Name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/sql_inject_in_search.md; https://vuldb.com/?ctiid.304984; https://vuldb.com/?id.304984
CVE: CVE-2025-3697
Published: 2025-04-16
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file /edit-product.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/sql_inject_in_edit.md; https://vuldb.com/?ctiid.304985; https://vuldb.com/?id.304985
CVE: CVE-2024-56736
Published: 2025-04-16
Description: Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat.

This issue affects Apache HertzBeat (incubating): before 1.7.0.

Users are recommended to upgrade to version 1.7.0, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://lists.apache.org/thread/kdzg36h9yxp0q0n4lhcfppxntjy8rj1x; https://lists.apache.org/thread/lwfhsllos1rx9v8k0yhl252cbpqpn0sv; http://www.openwall.com/lists/oss-security/2025/04/16/1
CVE: CVE-2024-58249
Published: 2025-04-16
Description: In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL.
CVSS Score: 3.7 (LOW)
CWE: CWE-826
References: https://github.com/wxWidgets/wxWidgets/commit/f2918a9ac823074901ce27de939baa57788beb3d; https://github.com/wxWidgets/wxWidgets/compare/v3.2.6...v3.2.7; https://github.com/wxWidgets/wxWidgets/issues/24885
CVE: CVE-2025-20150
Published: 2025-04-16
Description: A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts.

This vulnerability is due to the improper handling of LDAP authentication requests. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow an attacker to determine which usernames are valid LDAP user accounts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nd-unenum-2xFFh472
CVE: CVE-2025-20178
Published: 2025-04-16
Description: A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system.


This vulnerability is due to insufficient integrity checks within device backup files. An attacker with valid administrative credentials could exploit this vulnerability by crafting a malicious backup file and restoring it to an affected device. A successful exploit could allow the attacker to obtain shell access on the underlying operating system with the privileges of root.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-347
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-prvesc-4BQmK33Z
CVE: CVE-2024-22314
Published: 2025-04-16
Description: IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.12 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.ibm.com/support/pages/node/7229903
CVE: CVE-2024-40068
Published: 2025-04-16
Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=templates/manage_template&id=1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug5-SQL-Injection-id2.md
CVE: CVE-2024-40069
Published: 2025-04-16
Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/Users.php?f=save, and the point of vulnerability is in the POST parameter 'firstname' and 'lastname'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug7-XSS-firstname-lastname.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug7-XSS-firstname-lastname.md
CVE: CVE-2024-40070
Published: 2025-04-16
Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug6-File-upload-img2.md
CVE: CVE-2024-40071
Published: 2025-04-16
Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/SystemSettings.php?f=update_settings. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug2-File-upload-img.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug2-File-upload-img.md
CVE: CVE-2024-40072
Published: 2025-04-16
Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=generate/index&id=1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug3-SQL-Injection-id1.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug3-SQL-Injection-id1.md
CVE: CVE-2024-40073
Published: 2025-04-16
Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the template parameter at id_generator/admin/?page=generate&template=4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug4-SQL-Injection-template.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug4-SQL-Injection-template.md
CVE: CVE-2024-40074
Published: 2025-04-16
Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/SystemSettings.php?f=update_settings, and the point of vulnerability is in the POST parameter 'short_name'.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug1-XSS-short_name.md; https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug1-XSS-short_name.md
CVE: CVE-2025-20236
Published: 2025-04-16
Description: A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user.

This vulnerability is due to insufficient input validation when Cisco Webex App processes a meeting invite link. An attacker could exploit this vulnerability by persuading a user to click a crafted meeting invite link and download arbitrary files. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-client-rce-ufyMMYLC
CVE: CVE-2025-2564
Published: 2025-04-16
Description: Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-3733
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting (XSS).This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-034
CVE: CVE-2025-3734
Published: 2025-04-16
Description: Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770
References: https://www.drupal.org/sa-contrib-2025-035
CVE: CVE-2025-3735
Published: 2025-04-16
Description: Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*.
CVSS Score: 5.9 (MEDIUM)
References: https://www.drupal.org/sa-contrib-2025-036
CVE: CVE-2025-3736
Published: 2025-04-16
Description: Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*.
CVSS Score: 5.9 (MEDIUM)
References: https://www.drupal.org/sa-contrib-2025-037
CVE: CVE-2025-3737
Published: 2025-04-16
Description: Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*.
CVSS Score: 5.9 (MEDIUM)
References: https://www.drupal.org/sa-contrib-2025-038
CVE: CVE-2025-3738
Published: 2025-04-16
Description: Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*.
CVSS Score: 5.9 (MEDIUM)
References: https://www.drupal.org/sa-contrib-2025-039