deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-21694
Published: 2025-02-12
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/proc: fix softlockup in __read_vmcore (part 2)

Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the
number of softlockups in __read_vmcore at kdump time have gone down, but
they still happen sometimes.

In a memory constrained environment like the kdump image, a softlockup is
not just a harmless message, but it can interfere with things like RCU
freeing memory, causing the crashdump to get stuck.

The second loop in __read_vmcore has a lot more opportunities for natural
sleep points, like scheduling out while waiting for a data write to
happen, but apparently that is not always enough.

Add a cond_resched() to the second loop in __read_vmcore to (hopefully)
get rid of the softlockups.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/649b266606bc413407ce315f710c8ce8a88ee30a; https://git.kernel.org/stable/c/65c367bd9d4f43513c7f837df5753bea9561b836; https://git.kernel.org/stable/c/80828540dad0757b6337c6561d49c81038f38d87
CVE: CVE-2025-21695
Published: 2025-02-12
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86: dell-uart-backlight: fix serdev race

The dell_uart_bl_serdev_probe() function calls devm_serdev_device_open()
before setting the client ops via serdev_device_set_client_ops(). This
ordering can trigger a NULL pointer dereference in the serdev controller's
receive_buf handler, as it assumes serdev->ops is valid when
SERPORT_ACTIVE is set.

This is similar to the issue fixed in commit 5e700b384ec1
("platform/chrome: cros_ec_uart: properly fix race condition") where
devm_serdev_device_open() was called before fully initializing the
device.

Fix the race by ensuring client ops are set before enabling the port via
devm_serdev_device_open().

Note, serdev_device_set_baudrate() and serdev_device_set_flow_control()
calls should be after the devm_serdev_device_open() call.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/1b2128aa2d45ab20b22548dcf4b48906298ca7fd; https://git.kernel.org/stable/c/d3a24d923333f75aaece9acb051d676edc0afb75
CVE: CVE-2025-21696
Published: 2025-02-12
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: clear uffd-wp PTE/PMD state on mremap()

When mremap()ing a memory region previously registered with userfaultfd as
write-protected but without UFFD_FEATURE_EVENT_REMAP, an inconsistency in
flag clearing leads to a mismatch between the vma flags (which have
uffd-wp cleared) and the pte/pmd flags (which do not have uffd-wp
cleared).  This mismatch causes a subsequent mprotect(PROT_WRITE) to
trigger a warning in page_table_check_pte_flags() due to setting the pte
to writable while uffd-wp is still set.

Fix this by always explicitly clearing the uffd-wp pte/pmd flags on any
such mremap() so that the values are consistent with the existing clearing
of VM_UFFD_WP.  Be careful to clear the logical flag regardless of its
physical form; a PTE bit, a swap PTE bit, or a PTE marker.  Cover PTE,
huge PMD and hugetlb paths.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0cef0bb836e3cfe00f08f9606c72abd72fe78ca3; https://git.kernel.org/stable/c/310ac886d68de661c3a334198d8604b722d7fdf8
CVE: CVE-2025-21697
Published: 2025-02-12
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Ensure job pointer is set to NULL after job completion

After a job completes, the corresponding pointer in the device must
be set to NULL. Failing to do so triggers a warning when unloading
the driver, as it appears the job is still active. To prevent this,
assign the job pointer to NULL after completing the job, indicating
the job has finished.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/14e0a874488e79086340ba8e2d238cb9596b68a8; https://git.kernel.org/stable/c/1bd6303d08c85072ce40ac01a767ab67195105bd; https://git.kernel.org/stable/c/2a1c88f7ca5c12dff6fa6787492ac910bb9e4407
CVE: CVE-2025-21698
Published: 2025-02-12
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-21699
Published: 2025-02-12
Description: In the Linux kernel, the following vulnerability has been resolved:

gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag

Truncate an inode's address space when flipping the GFS2_DIF_JDATA flag:
depending on that flag, the pages in the address space will either use
buffer heads or iomap_folio_state structs, and we cannot mix the two.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2a40a140e11fec699e128170ccaa98b6b82cb503; https://git.kernel.org/stable/c/4516febe325342555bb09ca5b396fb816d655821; https://git.kernel.org/stable/c/4dd57d1f0e9844311c635a7fb39abce4f2ac5a61
CVE: CVE-2025-26339
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26339
CVE: CVE-2025-26340
Published: 2025-02-12
Description: A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-321
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26340
CVE: CVE-2025-26341
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26341
CVE: CVE-2025-26342
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26342
CVE: CVE-2025-26343
Published: 2025-02-12
Description: A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1390
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26343
CVE: CVE-2025-26344
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable passwordless guest mode via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26344
CVE: CVE-2025-26345
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26345
CVE: CVE-2025-26346
Published: 2025-02-12
Description: A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26346
CVE: CVE-2025-26347
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26347
CVE: CVE-2025-26348
Published: 2025-02-12
Description: A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26348
CVE: CVE-2025-26349
Published: 2025-02-12
Description: A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-23
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26349
CVE: CVE-2025-26350
Published: 2025-02-12
Description: A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-434
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26350
CVE: CVE-2025-26351
Published: 2025-02-12
Description: A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-35
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26351
CVE: CVE-2025-26352
Published: 2025-02-12
Description: A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-35
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26352
CVE: CVE-2025-26353
Published: 2025-02-12
Description: A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-35
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26353
CVE: CVE-2025-26354
Published: 2025-02-12
Description: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-35
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26354
CVE: CVE-2025-26355
Published: 2025-02-12
Description: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-35
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26355
CVE: CVE-2025-26356
Published: 2025-02-12
Description: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-35
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26356
CVE: CVE-2025-26357
Published: 2025-02-12
Description: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-35
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26357
CVE: CVE-2025-26358
Published: 2025-02-12
Description: A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to modify system configuration via crafted HTTP requests.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26358
CVE: CVE-2025-26359
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26359
CVE: CVE-2025-26360
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to delete dashboards via crafted HTTP requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26360
CVE: CVE-2025-26361
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26361
CVE: CVE-2025-26362
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26362
CVE: CVE-2025-26363
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable an authentication profile server via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26363
CVE: CVE-2025-26364
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable an authentication profile server via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26364
CVE: CVE-2025-26365
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable front panel authentication via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26365
CVE: CVE-2025-26366
Published: 2025-02-12
Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable front panel authentication via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26366
CVE: CVE-2025-26367
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create arbitrary user groups via crafted HTTP requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26367
CVE: CVE-2025-26368
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove user groups via crafted HTTP requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26368
CVE: CVE-2025-26369
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add privileges to user groups via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26369
CVE: CVE-2025-26370
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove privileges from user groups via crafted HTTP requests.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26370
CVE: CVE-2025-26371
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to add users to groups via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26371
CVE: CVE-2025-26372
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove users from groups via crafted HTTP requests.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26372
CVE: CVE-2025-26373
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26373
CVE: CVE-2025-26374
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26374
CVE: CVE-2025-26375
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to create users with arbitrary privileges via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26375
CVE: CVE-2025-26376
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to modify user data via crafted HTTP requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26376
CVE: CVE-2025-26377
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove users via crafted HTTP requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26377
CVE: CVE-2025-26378
Published: 2025-02-12
Description: A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26378
CVE: CVE-2024-12251
Published: 2025-02-12
Description: In Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0), a command injection attack is possible through improper neutralization of hyperlink elements.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://docs.telerik.com/devtools/winui/security/kb-security-command-injection-cve-2024-12251
CVE: CVE-2024-12379
Published: 2025-02-12
Description: A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/508559; https://hackerone.com/reports/2871791
CVE: CVE-2024-54160
Published: 2025-02-12
Description: dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sanitized when previewing a header or footer.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Jflye/CVE-2024-54160--Opensearch-HTML-Injection; https://github.com/opensearch-project/dashboards-reporting/compare/2.18.0.0...2.19.0.0; https://github.com/opensearch-project/dashboards-reporting/pull/476
CVE: CVE-2025-0376
Published: 2025-02-12
Description: An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/512603; https://hackerone.com/reports/2930243
CVE: CVE-2025-1042
Published: 2025-02-12
Description: An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-552
References: https://gitlab.com/gitlab-org/gitlab/-/issues/50849943; https://hackerone.com/reports/2886976