deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-57cc-2pf4-mhmx
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 5.3.2-0[PII_REDACTED]4645-761e56bb11cc
Patched in: 5.3.2-0[PII_REDACTED]4645-761e56bb11cc

Summary: Mattermost fails to properly validate team membership when processing channel mentions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563
GitHub Security Advisory: GHSA-57cc-2pf4-mhmx
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 11.2.0, < 11.2.2
Patched in: unpatched

Summary: Mattermost fails to properly validate team membership when processing channel mentions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563
GitHub Security Advisory: GHSA-57cc-2pf4-mhmx
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.11.0, < 10.11.10
Patched in: unpatched

Summary: Mattermost fails to properly validate team membership when processing channel mentions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563
GitHub Security Advisory: GHSA-57cc-2pf4-mhmx
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 11.1.0, < 11.1.3
Patched in: unpatched

Summary: Mattermost fails to properly validate team membership when processing channel mentions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563
GitHub Security Advisory: GHSA-57cc-2pf4-mhmx
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]4645-761e56bb11cc
Patched in: 8.0.0[PII_REDACTED]4645-761e56bb11cc

Summary: Mattermost fails to properly validate team membership when processing channel mentions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563
GitHub Security Advisory: GHSA-pp9j-pf5c-659x
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 5.3.2-0[PII_REDACTED]1531-cd17b61de41b
Patched in: 5.3.2-0[PII_REDACTED]1531-cd17b61de41b

Summary: Mattermost fails to sanitize sensitive data in WebSocket messages

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560
GitHub Security Advisory: GHSA-pp9j-pf5c-659x
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 11.2.0, < 11.2.2
Patched in: unpatched

Summary: Mattermost fails to sanitize sensitive data in WebSocket messages

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560
GitHub Security Advisory: GHSA-pp9j-pf5c-659x
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 10.11.0, < 10.11.10
Patched in: unpatched

Summary: Mattermost fails to sanitize sensitive data in WebSocket messages

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560
GitHub Security Advisory: GHSA-pp9j-pf5c-659x
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 11.1.0, < 11.1.3
Patched in: unpatched

Summary: Mattermost fails to sanitize sensitive data in WebSocket messages

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560
GitHub Security Advisory: GHSA-pp9j-pf5c-659x
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 8.0.0[PII_REDACTED]1531-cd17b61de41b
Patched in: 8.0.0[PII_REDACTED]1531-cd17b61de41b

Summary: Mattermost fails to sanitize sensitive data in WebSocket messages

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560
GitHub Security Advisory: GHSA-3c9r-7f29-qp32
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: < 5.3.2-0[PII_REDACTED]2346-61651b0df7ea
Patched in: 5.3.2-0[PII_REDACTED]2346-61651b0df7ea

Summary: Mattermost fails to properly validate login method restrictions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548
GitHub Security Advisory: GHSA-3c9r-7f29-qp32
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 11.2.0, < 11.2.2
Patched in: unpatched

Summary: Mattermost fails to properly validate login method restrictions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548
GitHub Security Advisory: GHSA-3c9r-7f29-qp32
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 10.11.0, < 10.11.10
Patched in: unpatched

Summary: Mattermost fails to properly validate login method restrictions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548
GitHub Security Advisory: GHSA-3c9r-7f29-qp32
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 11.1.0, < 11.1.3
Patched in: unpatched

Summary: Mattermost fails to properly validate login method restrictions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548
GitHub Security Advisory: GHSA-3c9r-7f29-qp32
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: < 8.0.0[PII_REDACTED]2346-61651b0df7ea
Patched in: 8.0.0[PII_REDACTED]2346-61651b0df7ea

Summary: Mattermost fails to properly validate login method restrictions

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548
GitHub Security Advisory: GHSA-w65c-fvp5-fvc5
Package: github.com/mattermost/mattermost-plugin-zoom (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 1.12.0
Patched in: 1.12.0

Summary: Mattermost Plugin Zoom fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint which allows unauthorized users to start Zoom meetings as any user and overwrite arbitrary posts via direct API calls with manipulated user IDs and post data.. Mattermost Advisory ID: MMSA-2025-00534
GitHub Security Advisory: GHSA-2phx-frhf-xr55
Package: github.com/mattermost/mattermost-plugin-zoom (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.11.0
Patched in: 1.11.0

Summary: Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels

Details:
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate the authenticated user when processing {{/plugins/zoom/api/v1/channel-preference}}, which allows any logged-in user to change Zoom meeting restrictions for arbitrary channels via crafted API requests.. Mattermost Advisory ID: MMSA-2025-00558
GitHub Security Advisory: GHSA-fw7p-63qq-7hpr
Package: filippo.io/edwards25519 (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-665: Improper Initialization
Vulnerable versions: < 1.1.1
Patched in: 1.1.1

Summary: filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

Details:
`(*Point).MultiScalarMult` failed to initialize its receiver.

If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result.

If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver was the zero value, MultiScalarMult returned an invalid point that compared Equal to every point.

*Note that MultiScalarMult is a rarely used advanced API. For example, if you only depend on `filippo.io/edwards25519` via `github.com/go-sql-driver/mysql`, **you are not affected**. If you were notified of this issue despite not being affected, consider switching to a vulnerability scanner that is more precise and respectful of your attention, like [govulncheck](https://go.dev/doc/tutorial/govulncheck).*
GitHub Security Advisory: GHSA-m6j8-rg6r-7mv8
Package: github.com/ethereum/go-ethereum (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: <= 1.16.8
Patched in: 1.16.9

Summary: Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

Details:
### Impact

Through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key.

### Patches

The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth. We recommend rotating the node key after applying the upgrade, which can be done by removing the file `<datadir>/geth/nodekey` before starting Geth.

### Credit

The issue was reported as a public pull request to go-ethereum by @fengjian.
GitHub Security Advisory: GHSA-2gjw-fg97-vg3r
Package: github.com/ethereum/go-ethereum (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 1.16.8
Patched in: 1.16.9

Summary: Go Ethereum affected by DoS via malicious p2p message

Details:
### Impact

A vulnerable node can be forced to shutdown/crash using a specially crafted message.
More details to be released later.

### Patches

The problem is resolved in the v1.16.9 and v1.17.0 releases of Geth.

### Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by Waleed Ahmed from vulsight.com
GitHub Security Advisory: GHSA-689v-6xwf-5jf3
Package: github.com/ethereum/go-ethereum (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 1.17.0
Patched in: 1.17.0

Summary: Go Ethereum affected by DoS via malicious p2p message

Details:
### Impact

An attacker can cause high memory usage by sending a specially-crafted p2p message.
More details to be released later.

### Patches

The issue is resolved in the v1.17.0 release. 

### Credit

This issue was reported to the Ethereum Foundation Bug Bounty Program by @revofusion
GitHub Security Advisory: GHSA-rrxv-pmq9-x67r
Package: github.com/refraction-networking/utls (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 1.6.0, < 1.8.2
Patched in: 1.8.2

Summary: uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120

Details:
The padding extension was incorrectly removed in utls for the non-pq variant of Chrome 120 fingerprint. Chrome removed this extension only when sending pq keyshares. Only this fingerprint is affected since newer fingerprints have pq keyshares by default and older fingerprints have this extension.

Affected symbols: `HelloChrome_120`

Fix commit: 8fe0b08e9a0e7e2d08b268f451f2c79962e6acd0

Thanks to telegram @acgdaily for reporting this issue.
GitHub Security Advisory: GHSA-7m29-f4hw-g2vx
Package: github.com/refraction-networking/utls (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
Vulnerable versions: >= 1.6.0, < 1.8.1
Patched in: 1.8.1

Summary: uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots

Details:
There is a fingerprint mismatch with Chrome when using GREASE ECH, having to do with ciphersuite selection. When Chrome selects the preferred ciphersuite in the outer ClientHello and the ciphersuite for ECH, it does so consistently based on hardware support. That means, for example, if it prefers AES for the outer ciphersuite, it would also use AES for ECH. The Chrome parrot in utls hardcodes AES preference for outer ciphersuites but selects the ECH ciphersuite randomly between AES and ChaCha20. So there is a 50% chance of selecting ChaCha20 for ECH while using AES for the outer ciphersuite, which is impossible in Chrome.

This is only a problem in GREASE ECH, since in real ECH Chrome selects the first valid ciphersuite when AES is preferred, which is the same in utls. So no change is done there.

Affected symbols: `HelloChrome_120`, `HelloChrome_120_PQ`, `HelloChrome_131`, `HelloChrome_133`

Fix commit: 24bd1e05a788c1add7f3037f4532ea552b2cee07

Thanks to telegram @acgdaily for reporting this issue.
GitHub Security Advisory: GHSA-wgm6-9rvv-3438
Package: github.com/abhinavxd/libredesk (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 1.0.2-0[PII_REDACTED][PII_REDACTED]31ce6
Patched in: 1.0.2-0[PII_REDACTED][PII_REDACTED]31ce6

Summary: Libredesk has a SSRF Vulnerability in Webhooks

Details:
**Date:** 2025-12-07
**Vulnerability:** Server-Side Request Forgery (SSRF)
**Component:** Webhooks Module

## Executive Summary
A critical security vulnerability exists in the LibreDesk Webhooks module that allows an authenticated "Application Admin" to compromise the underlying cloud infrastructure or internal corporate network where this service is being hosted.

The application fails to validate destination URLs for webhooks. This allows an attacker to force the server to make HTTP requests to arbitrary internal destinations.

## Confirmed Attack Vectors

### 1. Internal Port Scanning (Network Mapping)
Attackers can map the internal network by observing the difference between successful connections and connection errors. This works even if the response body is not returned.

**Proof of Exploitation (from Server Logs):**
*   **Open Port (8890)**: The server connects successfully.
    ```text
    timestamp=... level=info message="webhook delivered successfully" ... status_code=200
    ```
*   **Closed Port (8891)**: The server fails to connect.
    ```text
    timestamp=... level=error message="webhook delivery failed" ... error="... connect: connection refused"
    ```

**Impact**: An attacker can identify running services (databases, caches, internal apps) on the local network (e.g., `localhost`, `192.168.x.x`).

### 2. Information Leakage (Error-Based)
If the internal service returns a non-2xx response (e.g., 403 Forbidden, 404 Not Found, 500 Error), the application **logs the full response body**.

**Proof of Exploitation (from Server Logs):**
```text
timestamp=... level=error message="webhook delivery failed" ... 
response="{\"secret_key\": \"xxx123\", \"role\": \"admin\"}"
```

**Impact**: An attacker can extract sensitive data by targeting endpoints that return errors or by forcing errors on internal services.

## Technical Root Cause
1.  **Missing Input Validation**: `cmd/webhooks.go` only checks if the URL is empty, not if it resolves to a private IP.
2.  **Unrestricted HTTP Client**: `internal/webhook/webhook.go` uses a default `http.Client` that follows redirects and connects to any IP.
3.  **Verbose Error Logging**: The application logs the full response body on failure, creating a side-channel for data exfiltration.

## Remediation Required
To prevent this, the application must implement **Defense in Depth**:

1.  **Input Validation**: Block URLs resolving to private IP ranges (RFC 1918) and Link-Local addresses.
2.  **Safe HTTP Client**: Use a custom `http.Transport` that verifies the destination IP address *after* DNS resolution to prevent DNS rebinding attacks.
GitHub Security Advisory: GHSA-f5p9-j34q-pwcc
Package: github.com/jm33-m0/emp3r0r/core (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-663: Use of a Non-reentrant Function in a Concurrent Context
Vulnerable versions: < 0.0.0[PII_REDACTED]2424-ea4d074f081d
Patched in: 0.0.0[PII_REDACTED]2424-ea4d074f081d

Summary: emp3r0r Affected by Concurrent Map Access DoS (panic/crash)

Details:
## Summary

Multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger `fatal error: concurrent map read and map write`, causing C2 process crash (availability loss).

## Vulnerable Component(with code examples)

Operator relay map had mixed access patterns (iteration and mutation without a single lock policy):

```go
// vulnerable pattern (operator session map)
for sessionID, op := range OPERATORS { // iteration path
    ...
}

// concurrent mutation path elsewhere
OPERATORS[operatorSession] = &operator_t{...}
delete(OPERATORS, operatorSession)
```

Port-forwarding session map had read/write paths guarded inconsistently:

```go
// vulnerable pattern (port forward map)
if sess, ok := PortFwds[id]; ok { // read path
    ...
}

PortFwds[id] = newSession // write path
delete(PortFwds, id)      // delete path
```

FTP stream map similarly mixed concurrent iteration with mutation:

```go
// vulnerable pattern (FTP stream map)
for token, stream := range FTPStreams { // iteration path
    ...
}

FTPStreams[token] = stream // write path
delete(FTPStreams, token)  // delete path
```

## Attack Vector

1. Attacker (or stress traffic in authenticated flows) triggers high concurrency in normal control paths.
2. Operator sessions connect/disconnect while message forwarding and file-transfer workflows are active.
3. Concurrent read/write hits shared maps.
4. Go runtime panics with concurrent map read/write error.
5. C2 component exits, producing denial of service.

## Proof of Concept

1. Start C2 server with active operator session(s) in a lab environment.
2. Generate rapid operator session churn (connect/disconnect loops).
3. Simultaneously drive agent message tunnel traffic and/or file transfer activity.
4. Observe crash signature in logs: `fatal error: concurrent map read and map write`.
5. Optional: run with race detector in dev build to confirm race locations.

## Impact

- C2 service interruption due to process panic/crash.
- Operational instability under load or deliberate churn.
- Repeated crash-restart cycles can degrade command reliability and incident response workflows.