deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-48894
Published: 2025-12-01
Description: A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2115; https://www.socomec.fr/sites/default/files/2025-04/CVE-2024-48894---Diris-Digiware-Webview-_VULNERABILITIES_2025-04-11-17-22-18_English_0.pdf; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2115
CVE: CVE-2024-49572
Published: 2025-12-01
Description: A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service and weaken credentials resulting in default documented credentials being applied to the device. An attacker can send an unauthenticated packet to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2118; https://www.socomec.fr/sites/default/files/2025-04/CVE-2024-49572---Diris-Digiware-Webview-_VULNERABILITIES_2025-04-11-17-12-08_English_0.pdf; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2118
CVE: CVE-2024-53684
Published: 2025-12-01
Description: A cross-site request forgery (csrf) vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to unauthorized access. An attacker can stage a malicious webpage to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-2116; https://www.socomec.fr/sites/default/files/2025-10/CVE-2024-53684---Diris-Digiware-Mxx-Dxx-_VULNERABILITIES_2025-10-01-16-43-14_English_0.pdf; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2116
CVE: CVE-2025-10101
Published: 2025-12-01
Description: Heap-based Buffer Overflow, Out-of-bounds Write vulnerability in Avast Antivirus on MacOS of a crafted Mach-O file may allow Local Execution of Code or Denial of Service of antivirus protection.
This issue affects Antivirus: from 15.7 before 3.9.2025.
CVSS Score: 8.1 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2025-11699
Published: 2025-12-01
Description: nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a 
a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-613
References: https://github.com/nopSolutions/nopCommerce/issues/7044; https://seclists.org/fulldisclosure/2025/Aug/14; https://www.nopcommerce.com/en/release-notes?srsltid=AfmBOoravPKjN19pm_XZbXZ7GvPhkt8cxlK6794BJRZlY5RxJU_yNoTT
CVE: CVE-2025-13829
Published: 2025-12-01
Description: Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user.



 Critical information retrieved: 
  *  APIKEY (1 year user Session)
  *  RefreshToken (10 minutes user Session)
  *  Password hashed with bcrypt
  *  User IP
  *  Email
  *  Full Name
CWE: CWE-863
References: https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28
CVE: CVE-2025-20085
Published: 2025-12-01
Description: A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service and weaken credentials resulting in default documented credentials being applied to the device. An attacker can send an unauthenticated packet to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2138; https://www.socomec.fr/sites/default/files/2025-04/CVE-2025-20085---Diris-Digiware-Webview-_VULNERABILITIES_2025-04-11-17-14-39_English_0.pdf; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2138
CVE: CVE-2025-23417
Published: 2025-12-01
Description: A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2139; https://www.socomec.fr/sites/default/files/2025-04/CVE-2025-23417---Diris-Digiware-Webview-_VULNERABILITIES_2025-04-11-17-16-19_English_0.pdf; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2139
CVE: CVE-2025-26858
Published: 2025-12-01
Description: A buffer overflow vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted set of network packets can lead to denial of service. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2152; https://www.socomec.fr/sites/default/files/2025-10/CVE-2025-26858---Diris-Digiware-Mxx-Dxx-_VULNERABILITIES_2025-10-01-16-38-44_English_0.pdf; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2152
CVE: CVE-2025-3500
Published: 2025-12-01
Description: Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981.6 before 25.3.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-190
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2025-54848
Published: 2025-12-01
Description: A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.An attacker can trigger this denial-of-service condition by sending a sequence of Modbus TCP messages to port 502 using the Write Single Register function code (6). The attack sequence begins with a message to register 58112 with a value of 1000, indicating that a configuration change will follow. Next, a message is sent to register 29440 with a value corresponding to the new Modbus address to be configured. Finally, a message to register 57856 with a value of 161 commits the configuration change. After this configuration change, the device will be in a denial-of-service state.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2248
CVE: CVE-2025-54849
Published: 2025-12-01
Description: A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.An attacker can trigger this denial-of-service condition by sending a single Modbus TCP message to port 502 using the Write Single Register function code (6) to write the value 1 to register 4352. This action changes the Modbus address to 15. After this message is sent, the device will be in a denial-of-service state.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2248
CVE: CVE-2025-54850
Published: 2025-12-01
Description: A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.An attacker can trigger this denial-of-service condition by sending a sequence of Modbus RTU over TCP messages to port 503 using the Write Single Register function code (6). The attack sequence begins with a message to register 58112 with a value of 1000, indicating that a configuration change will follow. Next, a message is sent to register 29440 with a value corresponding to the new Modbus address to be configured. Finally, a message to register 57856 with a value of 161 commits the configuration change.
After this configuration change, the device will be in a denial-of-service state.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2248
CVE: CVE-2025-54851
Published: 2025-12-01
Description: A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted series of network requests can lead to a denial of service. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.An attacker can trigger this denial-of-service condition by sending a single Modbus TCP message to port 503 using the Write Single Register function code (6) to write the value 1 to register 4352. This action changes the Modbus address to 15. After this message is sent, the device will be in a denial-of-service state.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2248
CVE: CVE-2025-55221
Published: 2025-12-01
Description: A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to a denial of service. An attacker can send an unauthenticated packet to trigger this vulnerability.This vulnerability is specific to the malicious message sent via Modbus TCP over port 502.
CVSS Score: 8.6 (HIGH)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2251
CVE: CVE-2025-55222
Published: 2025-12-01
Description: A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to a denial of service. An attacker can send an unauthenticated packet to trigger this vulnerability.This vulnerability is specific to the malicious message sent via Modbus RTU over TCP on port 503.
CVSS Score: 8.6 (HIGH)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2251
CVE: CVE-2025-57489
Published: 2025-12-01
Description: Incorrect access control in the SDAgent component of Shirt Pocket SuperDuper! v3.10 allows attackers to escalate privileges to root due to the improper use of a setuid binary.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://shirt.com; https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html; https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/
CVE: CVE-2025-61228
Published: 2025-12-01
Description: An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism
CVSS Score: 7.8 (HIGH)
CWE: CWE-494
References: http://shirt.com; https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html; https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/
CVE: CVE-2025-61229
Published: 2025-12-01
Description: An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-284
References: http://shirt.com; https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html; https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/
CVE: CVE-2025-63095
Published: 2025-12-01
Description: Improper input validation in the BitstreamWriter::write_bits() function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://gist.github.com/thesmartshadow/b092e[PII_REDACTED]b981a069847a33064; https://github.com/tempus-ex/hello-video-codec; https://github.com/tempus-ex/hello-video-codec/blob/3e9551c699311ea12ad7f2fce9562fbc990d524c/src/bitstream.rs
CVE: CVE-2025-63532
Published: 2025-12-01
Description: A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. The application fails to properly sanitize user-supplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the search field, an attacker can bypass authentication and gain unauthorized access to the system.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89
References: https://drive.google.com/file/d/12yeOXW_sN69QjsQtW0_k9AGqozi1s0di/view?usp=sharing; https://github.com/Shridharshukl/Blood-Bank-Management-System; https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63532.md
CVE: CVE-2025-63533
Published: 2025-12-01
Description: A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php components. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript payloads into the rname, remail, rpassword, rphone, rcity parameters, which are then executed in the victim's browser when the page is viewed.
CVSS Score: 8.5 (HIGH)
CWE: CWE-79
References: https://drive.google.com/file/d/12yeOXW_sN69QjsQtW0_k9AGqozi1s0di/view?usp=sharing; https://github.com/Shridharshukl/Blood-Bank-Management-System; https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63533.md
CVE: CVE-2025-63534
Published: 2025-12-01
Description: A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the login.php component. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript payloads into the msg and error parameters, which are then executed in the victim's browser when the page is viewed.
CVSS Score: 8.5 (HIGH)
CWE: CWE-79
References: https://drive.google.com/file/d/12yeOXW_sN69QjsQtW0_k9AGqozi1s0di/view?usp=sharing; https://github.com/Shridharshukl/Blood-Bank-Management-System; https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63534.md
CVE: CVE-2025-63535
Published: 2025-12-01
Description: A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The application fails to properly sanitize usersupplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the search field, an attacker can bypass authentication and gain unauthorized access to the system.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89
References: https://drive.google.com/file/d/12yeOXW_sN69QjsQtW0_k9AGqozi1s0di/view?usp=sharing; https://github.com/Shridharshukl/Blood-Bank-Management-System; https://github.com/kiwi865/CVEs/blob/main/CVE-2025-63535.md
CVE: CVE-2025-64775
Published: 2025-12-01
Description: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: https://cwiki.apache.org/confluence/display/WW/S2-068; http://www.openwall.com/lists/oss-security/2025/12/01/2
CVE: CVE-2025-65403
Published: 2025-12-01
Description: A buffer overflow in the g_cfg.MaxUsers component of LightFTP v2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/hfiref0x/LightFTP; https://shimo.im/docs/9030JMJpv4IM4Nkw
CVE: CVE-2025-65404
Published: 2025-12-01
Description: A buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via a crafted MP3 stream.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/rgaufman/live555; https://shimo.im/docs/16q8xMxpPlH8Z2q7
CVE: CVE-2025-65405
Published: 2025-12-01
Description: A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS/AAC file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/rgaufman/live555; https://shimo.im/docs/25q5XMXpOwSr8w3D
CVE: CVE-2025-8351
Published: 2025-12-01
Description: Heap-based Buffer Overflow, Out-of-bounds Read vulnerability in Avast Antivirus on MacOS when scanning a malformed file may allow Local Execution of Code or Denial-of-Service of the anitvirus engine process.This issue affects Antivirus: from 8.3.70.94 before 8.3.70.98.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-122, CWE-125
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2025-65406
Published: 2025-12-01
Description: A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MKV file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122
References: https://github.com/rgaufman/live555; https://shimo.im/docs/1lq7rMrp8lI1vW3e
CVE: CVE-2025-65408
Published: 2025-12-01
Description: A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/rgaufman/live555; https://shimo.im/docs/VMAPLVLp57SJ92Ag
CVE: CVE-2025-65793
Published: 2025-12-01
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-65794
Published: 2025-12-01
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-7007
Published: 2025-12-01
Description: NULL Pointer Dereference vulnerability in Avast Antivirus on MacOS, Avast Anitvirus on Linux when scanning a malformed Windows PE file causes the antivirus process to crash.This issue affects Antivirus: 16.0.0; Anitvirus: 3.0.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2025-13653
Published: 2025-12-01
Description: In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://docs.search-guard.com/latest/changelog-searchguard-flx-4_0_1; https://search-guard.com/cve-advisory/
CVE: CVE-2025-13835
Published: 2025-12-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/arconix-shortcodes/vulnerability/wordpress-arconix-shortcodes-plugin-2-1-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-13836
Published: 2025-12-01
Description: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/python/cpython/commit/14b1fdb0a94b96f86fc7b86671ea9582b8676628; https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15; https://github.com/python/cpython/commit/4ce27904b597c77d74dd93f2c912676021a99155
CVE: CVE-2025-13837
Published: 2025-12-01
Description: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036; https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b; https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70
CVE: CVE-2025-11772
Published: 2025-12-01
Description: A carefully crafted DLL, copied to 

C:\ProgramData\Synaptics

 folder, allows a local user to execute 
arbitrary code with elevated privileges during driver installation.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-427
References: https://www.synaptics.com/sites/default/files/2025-12/fingerprint-driver-co-installer-security-brief-2025-12-01.pdf
CVE: CVE-2025-34297
Published: 2025-12-01
Description: KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures.
CWE: CWE-190
References: https://github.com/mborgerding/kissfft/commit/1b[PII_REDACTED]9c3716154caefc0deab8758506e3; https://github.com/mborgerding/kissfft/issues/120; https://www.vulncheck.com/advisories/kissfft-integer-overflow-heap-buffer-overflow
CVE: CVE-2025-63365
Published: 2025-12-01
Description: SoftSea EPUB File Reader 1.0.0.0 is vulnerable to Directory Traversal. The vulnerability resides in the EPUB file processing component, specifically in the functionality responsible for extracting and handling EPUB archive contents.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: http://epub.com; https://jeroscope.com/advisories/2025/jero-2025-001/
CVE: CVE-2025-65407
Published: 2025-12-01
Description: A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG Program stream.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/rgaufman/live555; https://shimo.im/docs/VMAPLVLpzZcZvoAg
CVE: CVE-2025-12756
Published: 2025-12-01
Description: Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-51682
Published: 2025-12-01
Description: mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative functions directly.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-602
References: http://mjobtime.com; https://labs.infoguard.ch/advisories/cve-2025-51682_cve-2025-51683_time_management_softare_sqli-rce/; https://labs.infoguard.ch/advisories/cve-2025-51682_cve-2025-51683_time_management_softare_sqli-rce/