deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8620
Published: 2025-08-06
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/impress-org/givewp/issues/8042; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336253%40give&new=3336253%40give&sfp_email=&sfph_mail=; https://www.linkedin.com/posts/givewp_givewp-support-handpicked-from-the-best-activity[PII_REDACTED]290974720-Dt4U/?utm_source=share&utm_medium=member_desktop&rcm=ACoAABmBk5UBxPIzCp0cgsD1_1xKASTMphetnI4
CVE: CVE-2025-46386
Published: 2025-08-06
Description: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-46387
Published: 2025-08-06
Description: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-46388
Published: 2025-08-06
Description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-46389
Published: 2025-08-06
Description: CWE-620: Unverified Password Change
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-620
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-46390
Published: 2025-08-06
Description: CWE-204: Observable Response Discrepancy
CVSS Score: 7.5 (HIGH)
CWE: CWE-204
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-46391
Published: 2025-08-06
Description: CWE-284: Improper Access Control
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-5197
Published: 2025-08-06
Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in version 4.53.0. This issue can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting model conversion processes between TensorFlow and PyTorch formats.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/huggingface/transformers/commit/944b56000be5e9b61af8301aa340838770ad8a0b; https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bf; https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bf
CVE: CVE-2025-23310
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause stack buffer overflow by specially crafted inputs. A successful exploit of this vulnerability might lead to remote code execution, denial of service, information disclosure, and data tampering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23310; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23310
CVE: CVE-2025-23311
Published: 2025-08-06
Description: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a stack overflow through specially crafted HTTP requests. A successful exploit of this vulnerability might lead to remote code execution, denial of service, information disclosure, or data tampering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23311; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23311
CVE: CVE-2025-23317
Published: 2025-08-06
Description: NVIDIA Triton Inference Server contains a vulnerability in the HTTP server, where an attacker could start a reverse shell by sending a specially crafted HTTP request. A successful exploit of this vulnerability might lead to remote code execution, denial of service, data tampering, or information disclosure.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-122
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23317; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23317
CVE: CVE-2025-23318
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclosure.
CVSS Score: 8.1 (HIGH)
CWE: CWE-805, CWE-787
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23318; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23318
CVE: CVE-2025-23319
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds write by sending a request. A successful exploit of this vulnerability might lead to remote code execution, denial of service, data tampering, or information disclosure.
CVSS Score: 8.1 (HIGH)
CWE: CWE-805, CWE-787
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23319; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23319
CVE: CVE-2025-23320
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause the shared memory limit to be exceeded by sending a very large request. A successful exploit of this vulnerability might lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23320; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23320
CVE: CVE-2025-23321
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a divide by zero issue by issuing an invalid request. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23321; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23321
CVE: CVE-2025-23322
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where multiple requests could cause a double free when a stream is cancelled before it is processed. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23322; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23322
CVE: CVE-2025-23323
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause an integer overflow or wraparound, leading to a segmentation fault, by providing an invalid request. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23323; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23323
CVE: CVE-2025-23324
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause an integer overflow or wraparound, leading to a segmentation fault,  by providing an invalid request. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23324; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23324
CVE: CVE-2025-23325
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause uncontrolled recursion through a specially crafted input. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23325; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23325
CVE: CVE-2025-23326
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer overflow through a specially crafted input. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-680
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23326; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23326
CVE: CVE-2025-23327
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer overflow through specially crafted inputs. A successful exploit of this vulnerability might lead to denial of service and data tampering.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23327; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23327
CVE: CVE-2025-23331
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a memory allocation with excessive size value, leading to a segmentation fault, by providing an invalid request. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-789
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23331; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23331
CVE: CVE-2025-23333
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by manipulating shared memory data. A successful exploit of this vulnerability might lead to information disclosure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23333; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23333
CVE: CVE-2025-23334
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by sending a request. A successful exploit of this vulnerability might lead to information disclosure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23334; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23334
CVE: CVE-2025-23335
Published: 2025-08-06
Description: NVIDIA Triton Inference Server for Windows and Linux and the Tensor RT backend contain a vulnerability where an attacker could cause an underflow by a specific model configuration and a specific input. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-191
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23335; https://nvidia.custhelp.com/app/answers/detail/a_id/5687; https://www.cve.org/CVERecord?id=CVE-2025-23335
CVE: CVE-2025-3320
Published: 2025-08-06
Description: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://www.ibm.com/support/pages/node/7241472
CVE: CVE-2025-3354
Published: 2025-08-06
Description: IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: https://www.ibm.com/support/pages/node/7241472
CVE: CVE-2025-8616
Published: 2025-08-06
Description: A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass Authentication. This issue affects Advanced Authentication on or before 6.5.0.
CWE: CWE-294
References: https://staging.docs.microfocus.com/doc/42/main/advancedauthentication6504
CVE: CVE-2024-52885
Published: 2025-08-06
Description: The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the Mobile Access gateway.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-35, CWE-22
References: https://support.checkpoint.com/results/sk/sk183137
CVE: CVE-2025-2028
Published: 2025-08-06
Description: Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://support.checkpoint.com/results/sk/sk183349
CVE: CVE-2025-36020
Published: 2025-08-06
Description: IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.ibm.com/support/pages/node/7241547
CVE: CVE-2025-50233
Published: 2025-08-06
Description: A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter in the backend template editor. By manipulating the parameter, attackers can perform directory traversal and access sensitive files outside the intended template directory, potentially exposing system configuration, PHP source code, or other sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/xiaoyangsec/cve; https://github.com/xiaoyangsec/cve/blob/main/README.md
CVE: CVE-2025-50234
Published: 2025-08-06
Description: MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sys_auth($pic, 1) function, which utilizes a hard-coded key Mc_Encryption_Key (bD2voYwPpNuJ7B8), defined in the db.php file. The decrypted URL is passed to the geturl() method, which uses cURL to make a request to the URL without proper security checks. An attacker can craft a malicious encrypted pic parameter, which, when decrypted, points to internal addresses or local file paths (such as http://127.0.0.1 or file://). By using the file:// protocol, the attacker can access arbitrary files on the local file system (e.g., file:///etc/passwd, file:///C:/Windows/System32/drivers/etc/hosts), allowing them to read sensitive configuration files, log files, and more, leading to information leakage or system exposure. The danger of this SSRF vulnerability includes accessing internal services and local file systems through protocols like http://, ftp://, and file://, which can result in sensitive data leakage, remote code execution, privilege escalation, or full system compromise, severely affecting the system's security and stability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/xiaoyangsec/mccms/blob/main/MCCMS-SSRF.md
CVE: CVE-2025-50286
Published: 2025-08-06
Description: A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://github.com/binneko/CVE-2025-50286
CVE: CVE-2025-51040
Published: 2025-08-06
Description: Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/p0et08/Electrolink-FM-DAB-TV
CVE: CVE-2025-51306
Published: 2025-08-06
Description: In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incorrect session management.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1259
References: https://gatling.io/products; https://github.com/Flo354/vulnerabilities/blob/main/gatling-enterprise/CVE-2025-51306-broken-logout.md; https://github.com/Flo354/vulnerabilities/blob/main/gatling-enterprise/CVE-2025-51306-change-permissions-not-reflected.md
CVE: CVE-2025-51308
Published: 2025-08-06
Description: In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, allowing him to collect some information, due to missing authorization checks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://gatling.io/products; https://github.com/Flo354/vulnerabilities/blob/main/gatling-enterprise/CVE-2025-51308-broken-access-control.md; https://github.com/Flo354/vulnerabilities/tree/main/gatling-enterprise
CVE: CVE-2024-8244
Published: 2025-08-06
Description: The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.
CVSS Score: 3.7 (LOW)
References: https://go.dev/issue/70007; https://pkg.go.dev/vuln/GO-2025-9999
CVE: CVE-2025-48393
Published: 2025-08-06
Description: The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest firmware version of Eaton G4 PDU which is available on the Eaton download center.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-295
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1002.pdf
CVE: CVE-2025-48394
Published: 2025-08-06
Description: An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version which is available on the Eaton download center.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1002.pdf
CVE: CVE-2025-51531
Published: 2025-08-06
Description: A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arbitrary JavaScript in the context of a victim's browser via injecting a crafted payload into the tabfields parameter at /dpw/scripts/cgiip.exe/WService. The vendor has stated that the issue is fixed in 2025_06_000, released in June 2025.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.sec4you-pentest.com/schwachstelle/sage-dpw-schwachstelle-xss-in-db-monitor-tabfields/; https://www.sec4you-pentest.com/schwachstellen/
CVE: CVE-2025-51532
Published: 2025-08-06
Description: Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The vendor has stated that the issue is fixed in 2025_06_000, released in June 2025.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.sec4you-pentest.com/schwachstelle/sage-dpw-unauthentifizierter-zugriff-adminbereich-db-monitor/; https://www.sec4you-pentest.com/schwachstellen/
CVE: CVE-2025-53786
Published: 2025-08-06
Description: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.
CVSS Score: 8.0 (HIGH)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53786
CVE: CVE-2025-20215
Published: 2025-08-06
Description: A vulnerability in the meeting-join functionality of Cisco Webex Meetings could have allowed an unauthenticated, network-proximate attacker to complete a meeting-join process in place of an intended targeted user, provided the requisite conditions were satisfied. Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no customer action is needed.

This vulnerability existed due to client certificate validation issues. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by monitoring local wireless or adjacent networks for client-join requests and attempting to interrupt and complete the meeting-join flow as another user who was currently joining a meeting. To successfully exploit the vulnerability, an attacker would need the capability to position themselves in a local wireless or adjacent network, to monitor and intercept the targeted network traffic flows, and to satisfy timing requirements in order to interrupt the meeting-join flow and exploit the vulnerability. A successful exploit could have allowed the attacker to join the meeting as another user. However, the Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerability that is described in this advisory.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-295
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-join-yNXfqHk4