deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1177
Published: 2025-02-11
Description: A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Admin/Linkage.php. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/stevenchen0x01/CVE2/blob/main/cve2.md; https://vuldb.com/?ctiid.295080; https://vuldb.com/?id.295080
CVE: CVE-2025-0180
Published: 2025-02-11
Description: The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331; https://www.wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cve
CVE: CVE-2025-0181
Published: 2025-02-11
Description: The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authentication cookie. This makes it possible for unauthenticated attackers to gain access to a target user's (e.g. administrators) account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331; https://www.wordfence.com/threat-intel/vulnerabilities/id/d722ec8d-bfca-4da1-8eb0-8d33735c5e44?source=cve
CVE: CVE-2025-1178
Published: 2025-02-11
Description: A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de[PII_REDACTED]cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-119
References: https://sourceware.org/bugzilla/attachment.cgi?id=15914; https://sourceware.org/bugzilla/show_bug.cgi?id=32638; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de[PII_REDACTED]cc77f178e7949a4414ed0
CVE: CVE-2025-1179
Published: 2025-02-11
Description: A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. The manipulation leads to memory corruption. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer explains, that "[t]his bug has been fixed at some point between the 2.43 and 2.44 releases".
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: https://sourceware.org/bugzilla/attachment.cgi?id=15915; https://sourceware.org/bugzilla/show_bug.cgi?id=32640; https://sourceware.org/bugzilla/show_bug.cgi?id=32640#c1
CVE: CVE-2024-13643
Published: 2025-02-11
Description: The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks on the backup_options() and reset_options() functions in all versions up to and including 3.17.0. This vulnerability allows authenticated attackers with Subscriber-level access and above to update and delete arbitrary option values on the WordPress site. Attackers can exploit this issue to update the default user role for registration to Administrator and enable user registration, thereby gaining administrative access to the vulnerable site. Additionally, they could delete critical options, causing errors that may disrupt the site's functionality and deny service to legitimate users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://mvpthemes.com/zoxnews/; https://themeforest.net/item/zox-news-professional-wordpress-news-magazine-theme/20381541; https://www.wordfence.com/threat-intel/vulnerabilities/id/4adb7436-11e6-4512-b6c9-551402909bf0?source=cve
CVE: CVE-2024-28989
Published: 2025-02-11
Description: SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-5_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28989
CVE: CVE-2024-45718
Published: 2025-02-11
Description: Sensitive data could be exposed to non- privileged users in a configuration file.  Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-312
References: https://documentation.solarwinds.com/en/success_center/kss/content/release_notes/kssng_1-3-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45718
CVE: CVE-2024-52606
Published: 2025-02-11
Description: SolarWinds Platform is affected by server-side request forgery vulnerability. Proper input sanitation was not applied allowing for the possibility of a malicious web request.
CVSS Score: 3.5 (LOW)
CWE: CWE-918
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-52606
CVE: CVE-2024-52611
Published: 2025-02-11
Description: The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide anything sensitive, the information could assist an attacker in other malicious actions.
CVSS Score: 3.5 (LOW)
CWE: CWE-209
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-52611
CVE: CVE-2024-52612
Published: 2025-02-11
Description: SolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. This vulnerability requires authentication by a high- privileged account to be exploitable.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/cve-2024-52612
CVE: CVE-2025-1180
Published: 2025-02-11
Description: A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.1 (LOW)
CWE: CWE-119
References: https://sourceware.org/bugzilla/attachment.cgi?id=15917; https://sourceware.org/bugzilla/show_bug.cgi?id=32642; https://vuldb.com/?ctiid.295083
CVE: CVE-2025-1181
Published: 2025-02-11
Description: A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: https://sourceware.org/bugzilla/attachment.cgi?id=15918; https://sourceware.org/bugzilla/show_bug.cgi?id=32643; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24
CVE: CVE-2025-0589
Published: 2025-02-11
Description: In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-648
References: https://advisories.octopus.com/post/2025/sa2025-01/
CVE: CVE-2025-1182
Published: 2025-02-11
Description: A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as b425859021d17adf62f06fb904797cf8642986ad. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: https://sourceware.org/bugzilla/attachment.cgi?id=15919; https://sourceware.org/bugzilla/show_bug.cgi?id=32644; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b425859021d17adf62f06fb904797cf8642986ad
CVE: CVE-2025-0525
Published: 2025-02-11
Description: In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversary with information that may aid in further attacks against the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://advisories.octopus.com/post/2024/sa2025-02/
CVE: CVE-2025-26408
Published: 2025-02-11
Description: The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. This enables an attacker to extract information, modify and debug the device's firmware. All known versions are affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1191
References: https://r.sec-consult.com/wattsense; https://support.wattsense.com/hc/en-150/articles/[PII_REDACTED]437-Release-Notes; http://seclists.org/fulldisclosure/2025/Feb/9
CVE: CVE-2025-26409
Published: 2025-02-11
Description: A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used to gain a root shell on the device. This issue is fixed in recent firmware versions BSP >= 6.4.1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1191, CWE-1299, CWE-1299
References: https://r.sec-consult.com/wattsense; https://support.wattsense.com/hc/en-150/articles/[PII_REDACTED]437-Release-Notes; http://seclists.org/fulldisclosure/2025/Feb/9
CVE: CVE-2025-26410
Published: 2025-02-11
Description: The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://r.sec-consult.com/wattsense; https://support.wattsense.com/hc/en-150/articles/[PII_REDACTED]437-Release-Notes; http://seclists.org/fulldisclosure/2025/Feb/9
CVE: CVE-2025-26411
Published: 2025-02-11
Description: An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web interface to be able to conduct this attack. This issue is fixed in recent firmware versions BSP >= 6.1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://r.sec-consult.com/wattsense; https://support.wattsense.com/hc/en-150/articles/[PII_REDACTED]437-Release-Notes; http://seclists.org/fulldisclosure/2025/Feb/9
CVE: CVE-2023-37482
Published: 2025-02-11
Description: The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://cert-portal.siemens.com/productcert/html/ssa-195895.html
CVE: CVE-2024-13506
Published: 2025-02-11
Description: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.97/includes/admin/class-geodir-admin-post-view.php#L317; https://plugins.trac.wordpress.org/changeset/3225839; https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d9ba14-c0c9-426e-927e-9139a0882f0d?source=cve
CVE: CVE-2024-23814
Published: 2025-02-11
Description: The integrated ICMP service of the network stack of affected devices can be  forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re-assembly. This could allow an unauthenticated remote attacker to cause a temporary denial of service condition of the ICMP service, other communication services are not affected. Affected devices will resume normal operation after the attack terminates.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://cert-portal.siemens.com/productcert/html/ssa-725549.html; https://cert-portal.siemens.com/productcert/html/ssa-769027.html
CVE: CVE-2024-45386
Published: 2025-02-11
Description: A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SIMOCODE ES V19 (All versions < V19 Update 1), SIRIUS Safety ES V19 (TIA Portal) (All versions < V19 Update 1), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions < V19 Update 1), TIA Administrator (All versions < V3.0.4). Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://cert-portal.siemens.com/productcert/html/ssa-342348.html
CVE: CVE-2024-53651
Published: 2025-02-11
Description: A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP300) (All versions), SIPROTEC 5 6MD89 (CP300) (All versions), SIPROTEC 5 6MU85 (CP300) (All versions), SIPROTEC 5 7KE85 (CP200) (All versions), SIPROTEC 5 7KE85 (CP300) (All versions), SIPROTEC 5 7SA82 (CP100) (All versions), SIPROTEC 5 7SA82 (CP150) (All versions), SIPROTEC 5 7SA86 (CP200) (All versions), SIPROTEC 5 7SA86 (CP300) (All versions), SIPROTEC 5 7SA87 (CP200) (All versions), SIPROTEC 5 7SA87 (CP300) (All versions), SIPROTEC 5 7SD82 (CP100) (All versions), SIPROTEC 5 7SD82 (CP150) (All versions), SIPROTEC 5 7SD86 (CP200) (All versions), SIPROTEC 5 7SD86 (CP300) (All versions), SIPROTEC 5 7SD87 (CP200) (All versions), SIPROTEC 5 7SD87 (CP300) (All versions), SIPROTEC 5 7SJ81 (CP100) (All versions), SIPROTEC 5 7SJ81 (CP150) (All versions), SIPROTEC 5 7SJ82 (CP100) (All versions), SIPROTEC 5 7SJ82 (CP150) (All versions), SIPROTEC 5 7SJ85 (CP200) (All versions), SIPROTEC 5 7SJ85 (CP300) (All versions), SIPROTEC 5 7SJ86 (CP200) (All versions), SIPROTEC 5 7SJ86 (CP300) (All versions), SIPROTEC 5 7SK82 (CP100) (All versions), SIPROTEC 5 7SK82 (CP150) (All versions), SIPROTEC 5 7SK85 (CP200) (All versions), SIPROTEC 5 7SK85 (CP300) (All versions), SIPROTEC 5 7SL82 (CP100) (All versions), SIPROTEC 5 7SL82 (CP150) (All versions), SIPROTEC 5 7SL86 (CP200) (All versions), SIPROTEC 5 7SL86 (CP300) (All versions), SIPROTEC 5 7SL87 (CP200) (All versions), SIPROTEC 5 7SL87 (CP300) (All versions), SIPROTEC 5 7SS85 (CP200) (All versions), SIPROTEC 5 7SS85 (CP300) (All versions), SIPROTEC 5 7ST85 (CP200) (All versions), SIPROTEC 5 7ST85 (CP300) (All versions), SIPROTEC 5 7ST86 (CP300) (All versions), SIPROTEC 5 7SX82 (CP150) (All versions), SIPROTEC 5 7SX85 (CP300) (All versions), SIPROTEC 5 7SY82 (CP150) (All versions), SIPROTEC 5 7UM85 (CP300) (All versions), SIPROTEC 5 7UT82 (CP100) (All versions), SIPROTEC 5 7UT82 (CP150) (All versions), SIPROTEC 5 7UT85 (CP200) (All versions), SIPROTEC 5 7UT85 (CP300) (All versions), SIPROTEC 5 7UT86 (CP200) (All versions), SIPROTEC 5 7UT86 (CP300) (All versions), SIPROTEC 5 7UT87 (CP200) (All versions), SIPROTEC 5 7UT87 (CP300) (All versions), SIPROTEC 5 7VE85 (CP300) (All versions), SIPROTEC 5 7VK87 (CP200) (All versions), SIPROTEC 5 7VK87 (CP300) (All versions), SIPROTEC 5 7VU85 (CP300) (All versions), SIPROTEC 5 Compact 7SX800 (CP050) (All versions). Affected devices do not encrypt certain data within the on-board flash storage on their PCB.  This could allow an attacker with physical access to read the entire filesystem of the device.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-312
References: https://cert-portal.siemens.com/productcert/html/ssa-111547.html
CVE: CVE-2024-53977
Published: 2025-02-11
Description: A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example setup script contained in affected applications allows a specific executable file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges in installations where administrators or processes with elevated privileges launch the script from a user-writable directory.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://cert-portal.siemens.com/productcert/html/ssa-637914.html
CVE: CVE-2024-54089
Published: 2025-02-11
Description: A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC Series (BACnet) (All versions). Affected devices contain a weak encryption mechanism based on a hard-coded key.
This could allow an attacker to guess or decrypt the password from the cyphertext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://cert-portal.siemens.com/productcert/html/ssa-615116.html
CVE: CVE-2024-54090
Published: 2025-02-11
Description: A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC Series (BACnet) (All versions). Affected devices contain an out-of-bounds read in the memory dump function.
This could allow an attacker with Medium (MED) or higher privileges to cause the device to enter an insecure cold start state.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-615116.html
CVE: CVE-2025-0513
Published: 2025-02-11
Description: In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they could embed code which may impact the user viewing the error message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://advisories.octopus.com/post/2024/sa2025-04/
CVE: CVE-2025-0526
Published: 2025-02-11
Description: In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://advisories.octopus.com/post/2024/sa2025-03/; https://advisories.octopus.com/post/2025/sa2025-03/
CVE: CVE-2025-0862
Published: 2025-02-11
Description: The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is limited to Chromium-based browsers (e.g. Chrome, Edge, Brave).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/supersaas-appointment-scheduling/tags/2.1.12/includes/shortcode.php#L15; https://plugins.trac.wordpress.org/browser/supersaas-appointment-scheduling/tags/2.1.12/includes/shortcode.php#L31; https://plugins.trac.wordpress.org/changeset/3235242/
CVE: CVE-2025-23363
Published: 2025-02-11
Description: A vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions < V14.3.0.14), Teamcenter V2312 (All versions < V2312.0010), Teamcenter V2406 (All versions < V2406.0008), Teamcenter V2412 (All versions < V2412.0004). The SSO login service of affected applications accepts user-controlled input that could specify a link to an external site. This could allow an attacker to redirect the legitimate user to an attacker-chosen URL to steal valid session data. For a successful exploit, the legitimate user must actively click on an attacker-crafted link.
CVSS Score: 7.4 (HIGH)
CWE: CWE-601
References: https://cert-portal.siemens.com/productcert/html/ssa-656895.html
CVE: CVE-2025-23403
Published: 2025-02-11
Description: A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do not properly restrict the user permission for the registry key. This could allow an authenticated attacker to load vulnerable drivers into the system leading to privilege escalation or bypassing endpoint protection and other security measures.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732
References: https://cert-portal.siemens.com/productcert/html/ssa-369369.html