deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13402
Published: 2025-02-27
Description: The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.buddyboss.com/resources/buddyboss-platform-releases/2-8-00/; https://www.wordfence.com/threat-intel/vulnerabilities/id/42743c2f-053b-4f14-bf11-865f978ec017?source=cve
CVE: CVE-2025-1691
Published: 2025-02-27
Description: The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. 


The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.
CVSS Score: 7.6 (HIGH)
CWE: CWE-74
References: https://jira.mongodb.org/browse/MONGOSH-2024
CVE: CVE-2025-1692
Published: 2025-02-27
Description: The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-150
References: https://jira.mongodb.org/browse/MONGOSH-2025
CVE: CVE-2025-1693
Published: 2025-02-27
Description: The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions.


The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.


This issue affects mongosh versions prior to 2.3.9
CVSS Score: 3.9 (LOW)
CWE: CWE-150
References: https://jira.mongodb.org/browse/MONGOSH-2026
CVE: CVE-2025-1738
Published: 2025-02-27
Description: A Password Transmitted over Query String vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity, exposing this sensitive information to a third party.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-598
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-trivision-camera-nc227wf
CVE: CVE-2025-1739
Published: 2025-02-27
Description: An Authentication Bypass vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity. This vulnerability allows an attacker to retrieve administrator's credentials in cleartext by sending a request against the server using curl with random credentials to "/en/player/activex_pal.asp" and successfully authenticating the application.
CVSS Score: 7.1 (HIGH)
CWE: CWE-288
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-trivision-camera-nc227wf
CVE: CVE-2024-9334
Published: 2025-02-27
Description: Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authentication Bypass.This issue affects Pallium Vehicle Tracking: before 17.10.2024.
CVSS Score: 8.2 (HIGH)
CWE: CWE-798, CWE-921
References: https://www.usom.gov.tr/bildirim/tr-25-0044
CVE: CVE-2025-22280
Published: 2025-02-27
Description: Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through <= 1.1.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/defend-wp-firewall/vulnerability/wordpress-defendwp-firewall-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-27154
Published: 2025-02-27
Description: Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py#L93-L98; https://github.com/spotipy-dev/spotipy/commit/1ca453f6ef87a2a9e9876f52b6cb38d13532ccf2; https://github.com/spotipy-dev/spotipy/releases/tag/2.25.1
CVE: CVE-2024-13148
Published: 2025-02-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yukseloglu Filter B2B Login Platform allows SQL Injection.This issue affects B2B Login Platform: before 16.01.2025.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0045
CVE: CVE-2024-54169
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2024-54170
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow a local user to cause a denial of service due to use of a regular expression with an inefficient complexity that consumes excessive CPU cycles.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1333
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2024-56493
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
CVSS Score: 3.3 (LOW)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2024-56494
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
CVSS Score: 3.3 (LOW)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2024-56495
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
CVSS Score: 3.3 (LOW)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2024-56496
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
CVSS Score: 3.3 (LOW)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2024-56810
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
CVSS Score: 3.3 (LOW)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2024-56811
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
CVSS Score: 3.3 (LOW)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2024-56812
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.  This information could be used in further attacks against the system.
CVSS Score: 3.3 (LOW)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2025-0759
Published: 2025-02-27
Description: IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization.
CVSS Score: 3.3 (LOW)
CWE: CWE-367
References: https://www.ibm.com/support/pages/node/7184194
CVE: CVE-2025-25759
Published: 2025-02-27
Description: An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-552
References: https://github.com/147536951/Qianyi-learn/blob/main/SUCMS.pdf
CVE: CVE-2025-25760
Published: 2025-02-27
Description: A Server-Side Request Forgery (SSRF) in the component admin_webgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/147536951/Qianyi-learn/blob/main/SUCMS2.pdf
CVE: CVE-2025-25761
Published: 2025-02-27
Description: HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-73
References: https://github.com/147536951/Qianyi-learn/blob/main/Hkcms.pdf; https://github.com/147536951/Qianyi-learn/blob/main/Hkcms.pdf
CVE: CVE-2025-0914
Published: 2025-02-27
Description: An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deployments where this was explicitly forbidden by configuring the prevent_execve flag in the configuration file. This setting is not usually recommended and is uncommonly used, so this issue will only affect users who do set it. This issue is fixed in release 0.73.4.
CVSS Score: 3.8 (LOW)
CWE: CWE-281
References: https://docs.velociraptor.app/announcements/advisories/cve-2025-0914/
CVE: CVE-2025-1741
Published: 2025-02-27
Description: A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1. Affected by this vulnerability is an unknown functionality of the file src/admin/users.php of the component Admin Page. The manipulation of the argument query/q leads to deserialization. The attack can be launched remotely. Upgrading to version 7.4.1-pl2 is able to address this issue. The identifier of the patch is 4816c8b748f6a5b965c8994e2cf10861bf6e68aa. It is recommended to upgrade the affected component. The vendor acted highly professional and even fixed this issue in the discontinued commercial edition as b1gMail 7.4.0-pl3.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://gist.github.com/mcdruid/cb0b848c12fd6a6bc0c1b3357b983d30; https://github.com/b1gMail-OSS/b1gMail/commit/4816c8b748f6a5b965c8994e2cf10861bf6e68aa; https://github.com/b1gMail-OSS/b1gMail/releases/tag/7.4.1-pl2
CVE: CVE-2025-1755
Published: 2025-02-27
Description: MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1
CVSS Score: 7.5 (HIGH)
CWE: CWE-426, CWE-426
References: https://jira.mongodb.org/browse/COMPASS-9058; https://access.redhat.com/errata/RHSA-2025:1755.html
CVE: CVE-2025-1756
Published: 2025-02-27
Description: mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
CVSS Score: 7.5 (HIGH)
CWE: CWE-426, CWE-426
References: https://jira.mongodb.org/browse/MONGOSH-2028; https://access.redhat.com/errata/RHSA-2025:1756
CVE: CVE-2025-25323
Published: 2025-02-27
Description: An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-84
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250111-51Job/250111-51Job.pdf; https://github.com/ZhouZiyi1/Vuls/blob/main/250111-51Job/250111-51Job.pdf
CVE: CVE-2025-25324
Published: 2025-02-27
Description: An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-84
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250111-AiShanDong/250111-AiShanDong.pdf; https://github.com/ZhouZiyi1/Vuls/blob/main/250111-AiShanDong/250111-AiShanDong.pdf
CVE: CVE-2025-25325
Published: 2025-02-27
Description: An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-84
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250112-YuPaoDirectHire/250112-YuPaoDirectHire.pdf; https://github.com/ZhouZiyi1/Vuls/blob/main/250112-YuPaoDirectHire/250112-YuPaoDirectHire.pdf
CVE: CVE-2025-25326
Published: 2025-02-27
Description: An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-84
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250115-MerchantsUnionFinance/250115-MerchantsUnionFinance.pdf; https://github.com/ZhouZiyi1/Vuls/blob/main/250115-MerchantsUnionFinance/250115-MerchantsUnionFinance.pdf
CVE: CVE-2025-25330
Published: 2025-02-27
Description: An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-84
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250116-BooheeHealth/250116-BooheeHealth.pdf; https://github.com/ZhouZiyi1/Vuls/blob/main/250116-BooheeHealth/250116-BooheeHealth.pdf
CVE: CVE-2025-25331
Published: 2025-02-27
Description: An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-84
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250116-LianJia/250116-LianJia.pdf; https://github.com/ZhouZiyi1/Vuls/blob/main/250116-LianJia/250116-LianJia.pdf
CVE: CVE-2025-25333
Published: 2025-02-27
Description: An issue in IKEA CN iOS 4.13.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250116-IKEACN/250116-IKEACN.pdf
CVE: CVE-2025-25334
Published: 2025-02-27
Description: An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-84
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250116-SuningEMall/250116-SuningEMall.pdf; https://github.com/ZhouZiyi1/Vuls/blob/main/250116-SuningEMall/250116-SuningEMall.pdf
CVE: CVE-2024-9285
Published: 2025-02-27
Description: A vulnerability was found in Tu Yafeng Via Browser up to 5.9.0 on Android. It has been rated as problematic. This issue affects some unknown processing of the component Javascript Bridge. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://modzero.com/en/advisories/mz-25-01-via-browser/; https://modzero.com/static/MZ-25-01_modzero_uXSS-in-Via-Browser.pdf; https://vuldb.com/?ctiid.297863
CVE: CVE-2025-1742
Published: 2025-02-27
Description: A vulnerability, which was classified as problematic, has been found in pihome-shc PiHome 2.0. Affected by this issue is some unknown functionality of the file /home.php. The manipulation of the argument page_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/janssensjelle/published-pocs/blob/main/pihomehvac_xss_home.md; https://vuldb.com/?ctiid.297830; https://vuldb.com/?id.297830
CVE: CVE-2025-23687
Published: 2025-02-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simonhunter Woo Store Mode woo-store-mode allows Reflected XSS.This issue affects Woo Store Mode: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-store-mode/vulnerability/wordpress-woo-store-mode-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25329
Published: 2025-02-27
Description: An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-84
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250116-TencentMicroVision/250116-TencentMicroVision.pdf; https://github.com/ZhouZiyi1/Vuls/blob/main/250116-TencentMicroVision/250116-TencentMicroVision.pdf
CVE: CVE-2025-27157
Published: 2025-02-27
Description: Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/mastodon/mastodon/commit/06f879ce9bea195344ac9f71e6799eea500628ec; https://github.com/mastodon/mastodon/security/advisories/GHSA-v39f-c9jj-8w7h
CVE: CVE-2025-1743
Published: 2025-02-27
Description: A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/sheratan4/cve/issues/4; https://vuldb.com/?ctiid.297831; https://vuldb.com/?id.297831
CVE: CVE-2025-1745
Published: 2025-02-27
Description: A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. This vulnerability affects unknown code of the component Logout. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://gitee.com/LinZhaoguan/pb-cms/issues/IBMM8V; https://vuldb.com/?ctiid.297832; https://vuldb.com/?id.297832
CVE: CVE-2025-27399
Published: 2025-02-27
Description: Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-285
References: https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L33-L35; https://github.com/mastodon/mastodon/blob/93f0427b8a84faf68d5d02cdf9a26f98fae16f2b/app/controllers/api/v1/instances/domain_blocks_controller.rb#L49-L51; https://github.com/mastodon/mastodon/commit/6b519cfefa93a923b19d0f20c292c7185f8fd5f5
CVE: CVE-2025-0767
Published: 2025-02-27
Description: WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://co.wordpress.org/plugins/wp-security-audit-log/; https://fluidattacks.com/advisories/skims-9/
CVE: CVE-2025-22624
Published: 2025-02-27
Description: FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/extensions/albums/admin/class-meta boxes.php.
CWE: CWE-79
References: https://fluidattacks.com/advisories/skims-10/; https://wordpress.org/plugins/foogallery/
CVE: CVE-2024-53408
Published: 2025-02-27
Description: AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cosmosofcyberspace.github.io/ave-system-cve.html; https://cosmosofcyberspace.github.io/ave-system-cve.html
CVE: CVE-2024-53944
Published: 2025-02-27
Description: An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M7628xUSAxUIv2_v1.0.1481.15.02_P0. A unauthenticated remote attacker with network access can exploit a command injection vulnerability. The /goform/formJsonAjaxReq endpoint fails to sanitize shell metacharacters sent via JSON parameters, thus allowing attackers to execute arbitrary OS commands with root privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.tuoshi.net/productview.asp?id=218; http://www.tuoshi.net/productview.asp?id=226; https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2024-53944-Whitepaper.pdf
CVE: CVE-2024-54957
Published: 2025-02-27
Description: Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an attacker to craft a malicious link that redirects users to an arbitrary external URL without their consent.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-54957; https://www.nagios.com/products/security/
CVE: CVE-2024-58022
Published: 2025-02-27
Description: In the Linux kernel, the following vulnerability has been resolved:

mailbox: th1520: Fix a NULL vs IS_ERR() bug

The devm_ioremap() function doesn't return error pointers, it returns
NULL.  Update the error checking to match.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/d0f98e14c010bcf27898b635a54c1994ac4110a8; https://git.kernel.org/stable/c/ecbde88e544ff016fa08bbf2156dc431bb123e9b