deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-58081
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: mmp2: call pm_genpd_init() only after genpd.name is set

Setting the genpd's struct device's name with dev_set_name() is
happening within pm_genpd_init(). If it remains NULL, things can blow up
later, such as when crafting the devfs hierarchy for the power domain:

  Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read
  ...
  Call trace:
   strlen from start_creating+0x90/0x138
   start_creating from debugfs_create_dir+0x20/0x178
   debugfs_create_dir from genpd_debug_add.part.0+0x4c/0x144
   genpd_debug_add.part.0 from genpd_debug_init+0x74/0x90
   genpd_debug_init from do_one_initcall+0x5c/0x244
   do_one_initcall from kernel_init_freeable+0x19c/0x1f4
   kernel_init_freeable from kernel_init+0x1c/0x12c
   kernel_init from ret_from_fork+0x14/0x28

Bisecting tracks this crash back to commit 899f44531fe6 ("pmdomain: core:
Add GENPD_FLAG_DEV_NAME_FW flag"), which exchanges use of genpd->name
with dev_name(&genpd->dev) in genpd_debug_add.part().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/763517124e27b07fa300b486d7d13c5d563a215e; https://git.kernel.org/stable/c/e24b15d4704dcb73920c3d18a6157abd18df08c1; https://git.kernel.org/stable/c/eca01d5911fb34218d10a58d8d9534b758c8fd0a
CVE: CVE-2024-58082
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

media: nuvoton: Fix an error check in npcm_video_ece_init()

When function of_find_device_by_node() fails, it returns NULL instead of
an error code. So the corresponding error check logic should be modified
to check whether the return value is NULL and set the error code to be
returned as -ENODEV.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/bdd823b9d068284e1d998b962cfef29236365df3; https://git.kernel.org/stable/c/c36b830754ae1dd1db41c27f57b29267878f9702; https://git.kernel.org/stable/c/c4b7779abc6633677e6edb79e2809f4f61fde157
CVE: CVE-2024-58083
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()

Explicitly verify the target vCPU is fully online _prior_ to clamping the
index in kvm_get_vcpu().  If the index is "bad", the nospec clamping will
generate '0', i.e. KVM will return vCPU0 instead of NULL.

In practice, the bug is unlikely to cause problems, as it will only come
into play if userspace or the guest is buggy or misbehaving, e.g. KVM may
send interrupts to vCPU0 instead of dropping them on the floor.

However, returning vCPU0 when it shouldn't exist per online_vcpus is
problematic now that KVM uses an xarray for the vCPUs array, as KVM needs
to insert into the xarray before publishing the vCPU to userspace (see
commit c5b077549136 ("KVM: Convert the kvm->vcpus array to a xarray")),
i.e. before vCPU creation is guaranteed to succeed.

As a result, incorrectly providing access to vCPU0 will trigger a
use-after-free if vCPU0 is dereferenced and kvm_vm_ioctl_create_vcpu()
bails out of vCPU creation due to an error and frees vCPU0.  Commit
afb2acb2e3a3 ("KVM: Fix vcpu_array[0] races") papered over that issue, but
in doing so introduced an unsolvable teardown conundrum.  Preventing
accesses to vCPU0 before it's fully online will allow reverting commit
afb2acb2e3a3, without re-introducing the vcpu_array[0] UAF race.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/09d50ccf0b2d739db4a485b08afe7520a4402a63; https://git.kernel.org/stable/c/125da53b3c0c9d7f58353aea0076e9efd6498ba7; https://git.kernel.org/stable/c/1e7381f3617d14b3c11da80ff5f8a93ab14cfc46
CVE: CVE-2024-58084
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()

Commit 2e4955167ec5 ("firmware: qcom: scm: Fix __scm and waitq
completion variable initialization") introduced a write barrier in probe
function to store global '__scm' variable.  We all known barriers are
paired (see memory-barriers.txt: "Note that write barriers should
normally be paired with read or address-dependency barriers"), therefore
accessing it from concurrent contexts requires read barrier.  Previous
commit added such barrier in qcom_scm_is_available(), so let's use that
directly.

Lack of this read barrier can result in fetching stale '__scm' variable
value, NULL, and dereferencing it.

Note that barrier in qcom_scm_is_available() satisfies here the control
dependency.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/b628510397b5cafa1f5d3e848a28affd1c635302; https://git.kernel.org/stable/c/e03db7c1255ebabba5e1a447754faeb138de15a2; https://git.kernel.org/stable/c/fee921e3c641f64185abee83f9a6e65f0b380682
CVE: CVE-2024-58085
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

tomoyo: don't emit warning in tomoyo_write_control()

syzbot is reporting too large allocation warning at tomoyo_write_control(),
for one can write a very very long line without new line character. To fix
this warning, I use __GFP_NOWARN rather than checking for KMALLOC_MAX_SIZE,
for practically a valid line should be always shorter than 32KB where the
"too small to fail" memory-allocation rule applies.

One might try to write a valid line that is longer than 32KB, but such
request will likely fail with -ENOMEM. Therefore, I feel that separately
returning -EINVAL when a line is longer than KMALLOC_MAX_SIZE is redundant.
There is no need to distinguish over-32KB and over-KMALLOC_MAX_SIZE.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3df7546fc03b8f004eee0b9e3256369f7d096685; https://git.kernel.org/stable/c/414705c0303350d139b1dc18f329fe47dfb642dd; https://git.kernel.org/stable/c/a01c200fa7eb59da4d2dbbb48b61f4a0d196c09f
CVE: CVE-2024-58086
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Stop active perfmon if it is being destroyed

If the active performance monitor (`v3d->active_perfmon`) is being
destroyed, stop it first. Currently, the active perfmon is not
stopped during destruction, leaving the `v3d->active_perfmon` pointer
stale. This can lead to undefined behavior and instability.

This patch ensures that the active perfmon is stopped before being
destroyed, aligning with the behavior introduced in commit
7d1fd3638ee3 ("drm/v3d: Stop the active perfmon before being destroyed").
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1c5673a2c8926adbb61f340c779b28e18188a8cd; https://git.kernel.org/stable/c/21f1435b1e6b012a07c42f36b206d2b66fc8f13b; https://git.kernel.org/stable/c/22e19c8c5f6b709f4ae40227392a30d57bac187d
CVE: CVE-2025-0337
Published: 2025-03-06
Description: ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. 

This issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1948695
CVE: CVE-2025-21829
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"

The Call Trace is as below:
"
  <TASK>
  ? show_regs.cold+0x1a/0x1f
  ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]
  ? __warn+0x84/0xd0
  ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]
  ? report_bug+0x105/0x180
  ? handle_bug+0x46/0x80
  ? exc_invalid_op+0x19/0x70
  ? asm_exc_invalid_op+0x1b/0x20
  ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]
  ? __rxe_cleanup+0x124/0x170 [rdma_rxe]
  rxe_destroy_qp.cold+0x24/0x29 [rdma_rxe]
  ib_destroy_qp_user+0x118/0x190 [ib_core]
  rdma_destroy_qp.cold+0x43/0x5e [rdma_cm]
  rtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core]
  rtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server]
  process_one_work+0x21d/0x3f0
  worker_thread+0x4a/0x3c0
  ? process_one_work+0x3f0/0x3f0
  kthread+0xf0/0x120
  ? kthread_complete_and_exit+0x20/0x20
  ret_from_fork+0x22/0x30
  </TASK>
"
When too many rdma resources are allocated, rxe needs more time to
handle these rdma resources. Sometimes with the current timeout, rxe
can not release the rdma resources correctly.

Compared with other rdma drivers, a bigger timeout is used.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/45e[PII_REDACTED]88bc52c9abac35524b4d332a8f8; https://git.kernel.org/stable/c/720653309dd31c8a927ef5d87964578ad544980f; https://git.kernel.org/stable/c/7a2de8126ed3801f2396720e10a03cd546a3cea1
CVE: CVE-2025-21830
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

landlock: Handle weird files

A corrupted filesystem (e.g. bcachefs) might return weird files.
Instead of throwing a warning and allowing access to such file, treat
them as regular files.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0fde195a373ab1267e60baa9e1a703a97e7464cd; https://git.kernel.org/stable/c/2569e65d2eb6ac1afe6cb6dfae476afee8b6771a; https://git.kernel.org/stable/c/39bb3d56f1c351e76bb18895d0e73796e653d5c1
CVE: CVE-2025-21831
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1

commit 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend") sets the
policy that all PCIe ports are allowed to use D3.  When the system is
suspended if the port is not power manageable by the platform and won't be
used for wakeup via a PME this sets up the policy for these ports to go
into D3hot.

This policy generally makes sense from an OSPM perspective but it leads to
problems with wakeup from suspend on the TUXEDO Sirius 16 Gen 1 with a
specific old BIOS. This manifests as a system hang.

On the affected Device + BIOS combination, add a quirk for the root port of
the problematic controller to ensure that these root ports are not put into
D3hot at suspend.

This patch is based on

  https://lore.kernel.org/linux-pci/[PII_REDACTED]4457.1229-2-mario.limonciello@amd.com

but with the added condition both in the documentation and in the code to
apply only to the TUXEDO Sirius 16 Gen 1 with a specific old BIOS and only
the affected root ports.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5ee3dd6e59b834e4d66e8b16fc684749ee40a257; https://git.kernel.org/stable/c/8852e056e297df1d8635ee7504e780d3184e45d0; https://git.kernel.org/stable/c/a78dfe50fffe6058afed2bb04c50c2c9a16664ee
CVE: CVE-2025-21832
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

block: don't revert iter for -EIOCBQUEUED

blkdev_read_iter() has a few odd checks, like gating the position and
count adjustment on whether or not the result is bigger-than-or-equal to
zero (where bigger than makes more sense), and not checking the return
value of blkdev_direct_IO() before doing an iov_iter_revert(). The
latter can lead to attempting to revert with a negative value, which
when passed to iov_iter_revert() as an unsigned value will lead to
throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT.

Be sane and don't revert for -EIOCBQUEUED, like what is done in other
spots.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/68f16d3034a06661245ecd22f0d586a8b4e7c473; https://git.kernel.org/stable/c/6c26619effb1b4cb7d20b4e666ab8f71f6a53ccb; https://git.kernel.org/stable/c/84671b0630ccb46ae9f1f99a45c7d63ffcd6a474
CVE: CVE-2025-21833
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE

There is a WARN_ON_ONCE to catch an unlikely situation when
domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless
happens we must avoid using a NULL pointer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/60f030f7418d3f1d94f2fb207fe3080e1844630b; https://git.kernel.org/stable/c/68ec78beb4a3fb0877cbaaf49758c85410c05977; https://git.kernel.org/stable/c/df96876be3b064aefc493f760e0639765d13ed0d
CVE: CVE-2025-21834
Published: 2025-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

seccomp: passthrough uretprobe systemcall without filtering

When attaching uretprobes to processes running inside docker, the attached
process is segfaulted when encountering the retprobe.

The reason is that now that uretprobe is a system call the default seccomp
filters in docker block it as they only allow a specific set of known
syscalls. This is true for other userspace applications which use seccomp
to control their syscall surface.

Since uretprobe is a "kernel implementation detail" system call which is
not used by userspace application code directly, it is impractical and
there's very little point in forcing all userspace applications to
explicitly allow it in order to avoid crashing tracked processes.

Pass this systemcall through seccomp without depending on configuration.

Note: uretprobe is currently only x86_64 and isn't expected to ever be
supported in i386.

[kees: minimized changes for easier backporting, tweaked commit log]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5a262628f4cf2437d863fe41f9d427177b87664c; https://git.kernel.org/stable/c/cf6cb56ef24410fb5308f9655087f1eddf4452e6; https://git.kernel.org/stable/c/fa80018aa5be10c35e9fa896b7b4061a8dce3eed
CVE: CVE-2025-2032
Published: 2025-03-06
Description: A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/IceFoxH/VULN/issues/7; https://vuldb.com/?ctiid.298774; https://vuldb.com/?id.298774
CVE: CVE-2025-2033
Published: 2025-03-06
Description: A vulnerability, which was classified as critical, was found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /user_dashboard/view_donor.php. The manipulation of the argument donor_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/intercpt/XSS1/blob/main/SQL.md; https://vuldb.com/?ctiid.298776
CVE: CVE-2024-52923
Published: 2025-03-06
Description: An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Lack of a boundary check during the decoding of DL NAS Transport messages leads to a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-52924
Published: 2025-03-06
Description: An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Lack of boundary check during the decoding of Registration Accept messages can lead to out-of-bounds writes on the stack
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2025-2034
Published: 2025-03-06
Description: A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit-class.php?cid=1. The manipulation of the argument classname/capacity/classtiming leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wangCCTV/cve/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.298777
CVE: CVE-2025-2035
Published: 2025-03-06
Description: A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /customer_register.php. The manipulation of the argument name leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.298778; https://vuldb.com/?id.298778; https://vuldb.com/?submit.512404
CVE: CVE-2024-50600
Published: 2025-03-06
Description: An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack of a boundary check in STOP_KEEP_ALIVE_OFFLOAD leads to out-of-bounds access. An attacker can send a malformed message to the target through the Wi-Fi driver.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2025-24796
Published: 2025-03-06
Description: Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by an administrator. Collabora Online typically hosts each document instance within a jail and is allowed to download content from locations controlled by the net.lok_allow configuration option, which by default include the private IP ranges to enable access to the local network. If enabled, macros were allowed run executable binaries. By combining an ability to host executables, typically in the local network, in an allowed accessible location, with a macro enabled Collabora Online, it was then possible to install arbitrary binaries within the jail and execute them. These executables are restricted to the same jail file system and user as the document instance but can be used to bypass the additional limits on what network hosts are accessible and provide more flexibility as a platform for further attempts. This is issue is fixed in 24.04.12.4, 23.05.19, 22.05.25 and later macros.
CWE: CWE-829
References: https://github.com/CollaboraOnline/online/security/advisories/GHSA-4jjq-vgqp-qw45
CVE: CVE-2025-25191
Published: 2025-03-06
Description: Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Intermesh/groupoffice/commit/c5c83e19a5cdf93b0e758726c97597861f1d6eda; https://github.com/Intermesh/groupoffice/security/advisories/GHSA-j7p3-v652-p3gf
CVE: CVE-2025-25294
Published: 2025-03-06
Description: Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the "EnvoyProxy.spec.telemetry.accessLog" setting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-117
References: https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a; https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj
CVE: CVE-2025-25361
Published: 2025-03-06
Description: An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/c0rdXy/POC/blob/master/CVE/PublicCMS/XSS_02/XSS_02.md; https://github.com/c0rdXy/POC/blob/master/CVE/PublicCMS/XSS_02/XSS_02.md
CVE: CVE-2025-25381
Published: 2025-03-06
Description: Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames and passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/advisories/GHSA-x2cr-cpw2-j9x5; https://github.com/edwin-0990/CVE_ID/blob/main/CVE-2025-25381/README.md; https://www.tenable.com/cve/CVE-2025-25381
CVE: CVE-2025-26167
Published: 2025-03-06
Description: Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/SpikeReply/advisories/blob/0f15f5aefb959fbaff049da7cc3e36733e25b580/cve/buffalo/cve-2025-26167.md; https://github.com/SpikeReply/advisories/blob/0f15f5aefb959fbaff049da7cc3e36733e25b580/cve/buffalo/cve-2025-26167.md
CVE: CVE-2025-26699
Published: 2025-03-06
Description: An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-770
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/g/django-announce; https://www.djangoproject.com/weblog/2025/mar/06/security-releases/
CVE: CVE-2025-27506
Published: 2025-03-06
Description: NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/auth.controller.ts#L251; https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPassword.ts#L71; https://github.com/nocodb/nocodb/commit/ea821edb133e621e26183ae65c8ff9ee5d6f2723
CVE: CVE-2025-27509
Published: 2025-03-06
Description: fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT) provisioning is enabled, or create new accounts tied to forged assertions if f MDM enrollment is enabled. This vulnerability is fixed in 4.64.2, 4.63.2, 4.62.4, and 4.58.1.
CWE: CWE-285
References: https://github.com/fleetdm/fleet/commit/718c95e47ad010ad6b8ceb3f3460e921fbfc53bb; https://github.com/fleetdm/fleet/security/advisories/GHSA-52jx-g6m5-h735