deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-40078
Published: 2025-10-28
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Explicitly check accesses to bpf_sock_addr

Syzkaller found a kernel warning on the following sock_addr program:

    0: r0 = 0
    1: r2 = *(u32 *)(r1 +60)
    2: exit

which triggers:

    verifier bug: error during ctx access conversion (0)

This is happening because offset 60 in bpf_sock_addr corresponds to an
implicit padding of 4 bytes, right after msg_src_ip4. Access to this
padding isn't rejected in sock_addr_is_valid_access and it thus later
fails to convert the access.

This patch fixes it by explicitly checking the various fields of
bpf_sock_addr in sock_addr_is_valid_access.

I checked the other ctx structures and is_valid_access functions and
didn't find any other similar cases. Other cases of (properly handled)
padding are covered in new tests in a subsequent patch.
References: https://git.kernel.org/stable/c/4f00858cd9bbbdf67159e28b85a8ca9e77c83622; https://git.kernel.org/stable/c/6d8b1a21fd5c34622b0c3893c61e4a38d8ba53ec; https://git.kernel.org/stable/c/6fabca2fc94d33cdf7ec102058983b086293395f
CVE: CVE-2025-40080
Published: 2025-10-28
Description: In the Linux kernel, the following vulnerability has been resolved:

nbd: restrict sockets to TCP and UDP

Recently, syzbot started to abuse NBD with all kinds of sockets.

Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
made sure the socket supported a shutdown() method.

Explicitely accept TCP and UNIX stream sockets.
References: https://git.kernel.org/stable/c/37ad11f20e164c23ce827dd455b42c0fdd29685c; https://git.kernel.org/stable/c/4f9e6ff6319dbcebea64b50af0304cf0ad7e97e7; https://git.kernel.org/stable/c/808e2335bc1cf2293b9e36ccc94c267c81509c71
CVE: CVE-2025-40081
Published: 2025-10-28
Description: In the Linux kernel, the following vulnerability has been resolved:

perf: arm_spe: Prevent overflow in PERF_IDX2OFF()

Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).
References: https://git.kernel.org/stable/c/1a19ba8e1f4ff24ece8ca69b79df8442c431db90; https://git.kernel.org/stable/c/379cae2cb982f571cda9493ac573ab71125fd299; https://git.kernel.org/stable/c/5d01f2b[PII_REDACTED]3d22f1e13a363f829de6343
CVE: CVE-2025-9313
Published: 2025-10-28
Description: An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data.

This issue affects Asseco mMedica in versions before 11.9.5.
CWE: CWE-288
References: https://cert.pl/en/posts/2025/10/CVE-2025-9313/; https://mmedica.asseco.pl/
CVE: CVE-2025-1036
Published: 2025-10-28
Description: Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device.
CWE: CWE-78
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-1037
Published: 2025-10-28
Description: By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted root shell. This is possible through abuse of a particular set of scripts and executables that allow for certain commands to be run as root from an unprivileged context.
CWE: CWE-269
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-1038
Published: 2025-10-28
Description: The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected commands can be exploited to execute several set-uid (SUID) applications to ultimately gain root access to the TropOS device.
CWE: CWE-78
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-12103
Published: 2025-10-28
Description: A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to  get, list, watch any pod in any namespace on the cluster.

TrustyAI is creating a role `trustyai-service-operator-lmeval-user-role` and a CRB `trustyai-service-operator-default-lmeval-user-rolebinding` which is being applied to `system:authenticated` making it so that every single user or service account can get a list of pods running in any namespace on the cluster 

Additionally users can access all `persistentvolumeclaims` and `lmevaljobs`
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-266
References: https://access.redhat.com/errata/RHSA-2025:21117; https://access.redhat.com/errata/RHSA-2026:10184; https://access.redhat.com/security/cve/CVE-2025-12103
CVE: CVE-2025-12380
Published: 2025-10-28
Description: Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1993113; https://www.mozilla.org/security/advisories/mfsa2025-86/
CVE: CVE-2025-12390
Published: 2025-10-28
Description: A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-384
References: https://access.redhat.com/errata/RHSA-2025:21370; https://access.redhat.com/errata/RHSA-2025:21371; https://access.redhat.com/errata/RHSA-2025:22088
CVE: CVE-2025-53814
Published: 2025-10-28
Description: A use-after-free vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .xml file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2252; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2252
CVE: CVE-2025-53855
Published: 2025-10-28
Description: An out-of-bounds write vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .fadein file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2250; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2250
CVE: CVE-2025-34301
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code into the COUNTRY_CODE parameter when creating a location group. When a user adds a new location group, the application issues an HTTP POST request with the ACTION parameter set to savelocationgrp, and the value of the COUNTRY_CODE parameter determines the flag displayed for that group. The value of this parameter is stored and later rendered in the web interface without proper sanitization or encoding, allowing malicious scripts to be executed in the context of other users viewing the affected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13876; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-location-group-creation
CVE: CVE-2025-34302
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When a user adds a service, the application issues an HTTP POST request with the ACTION parameter set to saveservice, and the protocol type is specified in the PROT parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitization or encoding, allowing injected scripts to execute in the context of other users viewing the affected service entry.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13877; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-service-creation
CVE: CVE-2025-34303
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the IGNORE_ENTRY_REMARK parameter when adding a whitelisted host. When a whitelisted host is added, an HTTP POST request is sent to the Request-URI /cgi-bin/ids.cgi and the remark for the entry is provided in the IGNORE_ENTRY_REMARK parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitization or encoding, allowing injected scripts to execute in the context of other users who view the affected whitelist entry.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13878; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-whitelisted-host-creation
CVE: CVE-2025-34304
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker to manipulate the SQL query used when viewing OpenVPN connection logs via the CONNECTION_NAME parameter. When viewing a range of OpenVPN connection logs, the application issues an HTTP POST request to the Request-URI /cgi-bin/logs.cgi/ovpnclients.dat and inserts the value of the CONNECTION_NAME parameter directly into the WHERE clause without proper sanitization or parameterization. The unsanitized value can alter the executed query and be used to disclose sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13879; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-sqli-via-openvpn-connection-logs
CVE: CVE-2025-34305
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function (/var/ipfire/header.pl) that fails to apply HTML-entity encoding to user input. When an authenticated user submits data to affected endpoints - for example, POST /cgi-bin/wakeonlan.cgi (CLIENT_COMMENT), /cgi-bin/dhcp.cgi (ADVOPT_DATA, FIX_REMARK, FIX_FILENAME, FIX_ROOTPATH), /cgi-bin/connscheduler.cgi (ACTION_COMMENT), /cgi-bin/dnsforward.cgi (REMARK), /cgi-bin/vpnmain.cgi (REMARK), or /cgi-bin/dns.cgi (REMARK) - the application calls escape() and HTML::Entities::encode_entities() but never assigns the sanitized result back to the output variable. The original unsanitized value is therefore stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected entries.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13880; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-multiple-methods-in-cleanhtml
CVE: CVE-2025-34306
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the default firewall IP search values. When a user updates these defaults, the application issues an HTTP POST request to /cgi-bin/logs.cgi/firewalllogip.dat with the default number of IPs in the pienumber parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13881; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-default-ip-search-value
CVE: CVE-2025-34307
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the firewall country search defaults. When a user updates the default values for the firewall country search, the application issues an HTTP POST request to /cgi-bin/logs.cgi/firewalllogcountry.dat and the default number of countries to display is provided in the pienumber parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected firewall country search settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13882; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-default-country-search
CVE: CVE-2025-34308
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the UPDATE_VALUE parameter when updating the default time synchronization settings. When the default values displayed on the Time Server page are updated, the application issues an HTTP POST request to /cgi-bin/time.cgi, and the synchronization value is provided in the UPDATE_VALUE parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected Time Server configuration page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13883; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-default-time-sync
CVE: CVE-2025-34309
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SERVICE, LOGIN, and PASSWORD parameters when creating or editing a Dynamic DNS host. When a new Dynamic DNS host is added, the application issues an HTTP POST request to /cgi-bin/ddns.cgi and saves the values of the LOGIN, PASSWORD, and SERVICE parameters. The SERVICE value is displayed after the host entry is created, and the LOGIN and PASSWORD values are displayed when that host entry is edited. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view or edit the affected Dynamic DNS entries.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13884; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-dynamic-dns-host
CVE: CVE-2025-34310
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the INC_SPD, OUT_SPD, DEFCLASS_INC, and DEFCLASS_OUT parameters when updating Quality of Service (QoS) settings. When a user updates speeds or classes, the application issues an HTTP POST request to /cgi-bin/qos.cgi and the values for incoming/outgoing speeds and default classes are provided in the INC_SPD, OUT_SPD, DEFCLASS_INC, and DEFCLASS_OUT parameters. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected QoS entries.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13883; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-quality-of-service-settings
CVE: CVE-2025-34311
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP POST to /cgi-bin/logs.cgi/calamaris.dat and reads the values of DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, which are interpolated directly into the shell invocation of the mkreport helper. Because these parameters are never sanitized for improper characters or constructs, a crafted POST can inject shell metacharacters into one or more fields, causing arbitrary commands to run with the privileges of the 'nobody' user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13886; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-command-injection-via-proxy-report-creation
CVE: CVE-2025-34312
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the 'nobody' user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13887; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-command-injection-via-url-filter-blacklist
CVE: CVE-2025-34313
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the QUOTA_USERS parameter when creating a user quota rule. When a user adds a new user quota rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set to USERQUOTA and the assigned user(s) provided in the QUOTA_USERS parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected quota entry.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13888; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-user-quota-rule-url-filter
CVE: CVE-2025-34314
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SRC, DST, and COMMENT parameters when creating a time constraint rule. When a user adds a time constraint rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set to TIMECONSTRAINT and the source hostnames/IPs, destination, and remark provided in the SRC, DST, and COMMENT parameters respectively. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected time constraint entry.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13889; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-time-constraint-rule-url-filter
CVE: CVE-2025-34315
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the REMOTELOG_ADDR parameter when updating the remote syslog server address. When a user updates the Remote logging Syslog server, the application issues an HTTP POST request to /cgi-bin/logs.cgi/config.dat and the server address is provided in the REMOTELOG_ADDR parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected configuration page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13890; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-remote-syslog-server-address
CVE: CVE-2025-34316
Published: 2025-10-28
Description: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the txt_mailuser and txt_mailpass parameters when updating the mail server settings. When a user updates the mail server, the application issues an HTTP POST request to /cgi-bin/mail.cgi and the username and password are provided in the txt_mailuser and txt_mailpass parameters. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected mail configuration.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.ipfire.org/show_bug.cgi?id=13891; https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released; https://www.vulncheck.com/advisories/ipfire-stored-xss-via-mail-server-settings