deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-23645
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Optimize Worldwide Find Content IDs find-content-ids allows Reflected XSS.This issue affects Find Content IDs: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/find-content-ids/vulnerability/wordpress-find-content-ids-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24598
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-8-17-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24599
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-9-9-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24602
Published: 2025-02-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP24 WP24 Domain Check wp24-domain-check allows Reflected XSS.This issue affects WP24 Domain Check: from n/a through <= 1.10.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp24-domain-check/vulnerability/wordpress-wp24-domain-check-plugin-1-10-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24648
Published: 2025-02-04
Description: Incorrect Privilege Assignment vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Privilege Escalation.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/admin-site-enhancements/vulnerability/wordpress-admin-and-site-enhancements-ase-plugin-7-6-1-1-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-24677
Published: 2025-02-04
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Remote Code Inclusion.This issue affects Post/Page Copying Tool: from n/a through <= 2.0.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-to-export-and-import-post-page-for-cross-site-migration-plugin-2-0-3-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-45659
Published: 2025-02-04
Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7182386
CVE: CVE-2025-0364
Published: 2025-02-04
Description: BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An unauthenticated remote attacker can create an administrative user through the default exposed SaaS registration mechanism. Once an administrator, the attacker can upload and execute arbitrary PHP code using the "Cloud Storage Addin," leading to unauthenticated code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://vulncheck.com/advisories/big-ant-upload-rce; https://github.com/vulncheck-oss/cve-2025-0364
CVE: CVE-2025-23058
Published: 2025-02-04
Description: A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges. Successful exploitation could enable a low-privileged user to execute administrative functions leading to an escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1390
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US
CVE: CVE-2025-23059
Published: 2025-02-04
Description: A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If exploited successfully, this vulnerability allows an authenticated remote attacker with high privileges to access and retrieve sensitive data, potentially compromising the integrity and security of the entire system.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US
CVE: CVE-2025-23060
Published: 2025-02-04
Description: A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unauthorized access to network resources as well as enabling data tampering.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-319
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US
CVE: CVE-2024-48019
Published: 2025-02-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris.


Application administrators can read arbitrary
files from the server filesystem through path traversal.


Users are recommended to upgrade to version 2.1.8, 3.0.3 or later, which fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22, CWE-552, CWE-22
References: https://lists.apache.org/thread/p70klgmyrgknhn0t195261wvwv5jw6hr; http://www.openwall.com/lists/oss-security/2025/02/04/2
CVE: CVE-2025-0444
Published: 2025-02-04
Description: Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/390889644
CVE: CVE-2025-0445
Published: 2025-02-04
Description: Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/392521083
CVE: CVE-2025-0451
Published: 2025-02-04
Description: Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/40061026
CVE: CVE-2025-24373
Published: 2025-02-04
Description: woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orders. This vulnerability allows unauthorized users to access any PDF document from a store if they: 1. Have access to a guest document link and 2. Replace the URL variable `my-account` with `bulk`. The issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerability compromises the confidentiality of sensitive documents, affecting all stores using the plugin with the guest access option enabled. This issue has been addressed in version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/wpovernight/woocommerce-pdf-invoices-packing-slips/commit/6daeff87f8a7f941f0f7cf4637f41d22c4428c30; https://github.com/wpovernight/woocommerce-pdf-invoices-packing-slips/security/advisories/GHSA-3j9m-cp35-94fr
CVE: CVE-2025-24971
Published: 2025-02-04
Description: DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was discovered in the DumbDrop application, `/upload/init` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely when the **Apprise Notification** enabled. This issue has been addressed in commit `4ff8469d` and all users are advised to patch. There are no known workarounds for this vulnerability.
CWE: CWE-78
References: https://github.com/DumbWareio/DumbDrop/commit/4ff8469d69019d200046a67d326f51703bc4da63; https://github.com/DumbWareio/DumbDrop/security/advisories/GHSA-rx8m-jqm7-vcgp; https://github.com/DumbWareio/DumbDrop/security/advisories/GHSA-rx8m-jqm7-vcgp
CVE: CVE-2025-25039
Published: 2025-02-04
Description: A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US
CVE: CVE-2025-0509
Published: 2025-02-04
Description: A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-552
References: https://github.com/sparkle-project/Sparkle/pull/2550; https://sparkle-project.org/documentation/security-and-reliability/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-0630
Published: 2025-02-04
Description: Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any authenticated user has privileged access to files on the device's filesystem.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-01
CVE: CVE-2025-0960
Published: 2025-02-04
Description: AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a denial-of-service condition or achieving remote code execution on the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://community.automationdirect.com/s/cybersecurity/security-advisories; https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-08
CVE: CVE-2025-24963
Published: 2025-02-04
Description: Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130; https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f; https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5
CVE: CVE-2025-24964
Published: 2025-02-04
Description: Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-1385
References: https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46; https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76; https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq
CVE: CVE-2025-24966
Published: 2025-02-04
Description: reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs, allowing attackers to inject arbitrary HTML code. In this scenario, the vulnerability exists in the "Add Target" functionality of the application, where the Target Organization and Target Description fields accept HTML payloads. The injected HTML is rendered and executed in the target area, potentially leading to malicious actions. Exploitation of HTML Injection can compromise the application's integrity and user trust. Attackers can execute unauthorized actions, steal sensitive information, or trick users into performing harmful actions. The organization's reputation, customer trust, and regulatory compliance could be negatively affected. This issue affects all versions up to and including 2.2.0. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yogeshojha/rengine/security/advisories/GHSA-4phc-m2wm-p8x6; https://github.com/yogeshojha/rengine/security/advisories/GHSA-4phc-m2wm-p8x6
CVE: CVE-2025-24967
Published: 2025-02-04
Description: reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field during user creation. This vulnerability allows unauthorized script execution whenever the admin views or interacts with the affected user entry, posing a significant risk to sensitive admin functionalities. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yogeshojha/rengine/security/advisories/GHSA-23wx-5q5w-334w; https://github.com/yogeshojha/rengine/security/advisories/GHSA-23wx-5q5w-334w
CVE: CVE-2025-24968
Published: 2025-02-04
Description: reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, such as `penetration_tester` or `auditor` to delete all projects in the system. This can lead to a complete system takeover by redirecting the attacker to the onboarding page, where they can add or modify users, including Sys Admins, and configure critical settings like API keys and user preferences. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/yogeshojha/rengine/security/advisories/GHSA-3327-6x79-q396; https://github.com/yogeshojha/rengine/security/advisories/GHSA-3327-6x79-q396
CVE: CVE-2024-35138
Published: 2025-02-04
Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.ibm.com/support/pages/node/7182386
CVE: CVE-2024-40700
Published: 2025-02-04
Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7182386
CVE: CVE-2024-43187
Published: 2025-02-04
Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.ibm.com/support/pages/node/7182386
CVE: CVE-2024-45657
Published: 2025-02-04
Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-732
References: https://www.ibm.com/support/pages/node/7182386
CVE: CVE-2024-45658
Published: 2025-02-04
Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
CVSS Score: 2.7 (LOW)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7182386
CVE: CVE-2024-55948
Published: 2025-02-04
Description: Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache (for example, the cache may have a response with missing  preloaded data). This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable anonymous cache by setting the `DISCOURSE_DISABLE_ANON_CACHE` environment variable to a non-empty value.
CVSS Score: 8.2 (HIGH)
CWE: CWE-346
References: https://github.com/discourse/discourse/security/advisories/GHSA-2352-252q-qc82
CVE: CVE-2024-56197
Published: 2025-02-04
Description: Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option is enabled, the other user is a member of a group added to this option, and the PM has been tagged. This issue has been patched in the latest `stable`, `beta` and `tests-passed` versions of Discourse. Users are advised to upgrade. Users unable to upgrade should remove all groups from the the "PM tags allowed for groups" option.
CVSS Score: 2.2 (LOW)
CWE: CWE-200
References: https://github.com/discourse/discourse/security/advisories/GHSA-xmgr-g9cp-v239
CVE: CVE-2024-56328
Published: 2025-02-04
Description: Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted onebox url. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP, disable inline Oneboxes globally, or allow specific domains for Oneboxing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/discourse/discourse/security/advisories/GHSA-j855-mhxj-x6vg
CVE: CVE-2025-22601
Published: 2025-02-04
Description: Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the `activate-account` route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-22
References: https://github.com/discourse/discourse/security/advisories/GHSA-gvpp-v7mp-wxxw
CVE: CVE-2025-22602
Published: 2025-02-04
Description: Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/discourse/discourse/security/advisories/GHSA-jcjx-694p-c5m3
CVE: CVE-2025-23023
Published: 2025-02-04
Description: Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache (for example, the cache may have a response with missing  preloaded data). This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade may disable anonymous cache by setting the `DISCOURSE_DISABLE_ANON_CACHE` environment variable to a non-empty value.
CVSS Score: 8.2 (HIGH)
CWE: CWE-346
References: https://github.com/discourse/discourse/security/advisories/GHSA-5h4h-2f46-r3c7
CVE: CVE-2024-13722
Published: 2025-02-04
Description: The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://checkmk.com/werks?version=2.3.0p10; https://korelogic.com/Resources/Advisories/KL-001-2025-001.txt; https://www.nagvis.org/downloads/changelog/1.9.42
CVE: CVE-2024-13723
Published: 2025-02-04
Description: The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://checkmk.com/werks?version=2.3.0p10; https://korelogic.com/Resources/Advisories/KL-001-2025-002.txt; https://www.nagvis.org/downloads/changelog/1.9.42