deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0536
Published: 2025-01-17
Description: A vulnerability classified as critical was found in 1000 Projects Attendance Tracking Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_action.php. The manipulation of the argument attendance_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/lan041221/cve/blob/main/Attendance_Tracking_Management_System_SQL_Injection.md; https://vuldb.com/?ctiid.292420
CVE: CVE-2025-0537
Published: 2025-01-17
Description: A vulnerability, which was classified as problematic, has been found in code-projects Car Rental Management System 1.0. This issue affects some unknown processing of the file /admin/manage-pages.php. The manipulation of the argument pgdetails leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/aaryan-11-x/My-CVEs/blob/main/CVE-2025-0537.md; https://vuldb.com/?ctiid.292421
CVE: CVE-2025-21185
Published: 2025-01-17
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21185
CVE: CVE-2025-21399
Published: 2025-01-17
Description: Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
CVSS Score: 7.4 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21399; https://www.vicarius.io/vsociety/posts/elevation-of-privilege-vulnerability-in-microsoft-edge-chromium-based-detection-script; https://www.vicarius.io/vsociety/posts/elevation-of-privilege-vulnerability-in-microsoft-edge-chromium-based-mitigation-script
CVE: CVE-2023-50738
Published: 2025-01-17
Description: A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to 
override this downgrade protection has been identified.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-354, CWE-1328
References: https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE: CVE-2024-57033
Published: 2025-01-17
Description: WeGIA < 3.2.0 is vulnerable to Cross Site Scripting (XSS) via the dados_addInfo parameter of documentos_funcionario.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nmmorette/vulnerability-research/tree/main/CVE-2024-57033; https://www.wegia.org/
CVE: CVE-2024-57035
Published: 2025-01-17
Description: WeGIA v3.2.0 is vulnerable to SQL Injection viathe nextPage parameter in /controle/control.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/nilsonLazarin/WeGIA/issues/827; https://github.com/nmmorette/vulnerability-research/tree/main/CVE-2024-57035
CVE: CVE-2024-57252
Published: 2025-01-17
Description: OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/J-0k3r/CVE-2024-57252; https://github.com/J-0k3r/some/blob/main/ssrf.pdf
CVE: CVE-2025-0538
Published: 2025-01-17
Description: A vulnerability, which was classified as problematic, was found in code-projects Tourism Management System 1.0. Affected is an unknown function of the file /admin/manage-pages.php. The manipulation of the argument pgedetails leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/aaryan-11-x/My-CVEs/blob/main/CVE-2025-0538.md; https://vuldb.com/?ctiid.292422
CVE: CVE-2025-0540
Published: 2025-01-17
Description: A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /expadd.php. The manipulation of the argument expcat leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/magic[PII_REDACTED]/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.292432
CVE: CVE-2025-21606
Published: 2025-01-17
Description: stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name `eu.exelban.Stats.SMC.Helper`. The associated binary, eu.exelban.Stats.SMC.Helper, is a privileged helper tool designed to execute actions requiring elevated privileges on behalf of the client, such as setting fan modes, adjusting fan speeds, and executing the `powermetrics` command. The root cause of this vulnerability lies in the `shouldAcceptNewConnection` method, which unconditionally returns YES (or true), allowing any XPC client to connect to the service without any form of verification. As a result, unauthorized clients can establish a connection to the Mach service and invoke methods exposed by the HelperTool interface. An attacker can exploit this vulnerability to modify the hardware settings of the user’s device and execute arbitrary code with root privileges. This issue has been addressed in version 2.11.21 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-345
References: https://github.com/exelban/stats/commit/c10759f7a186efdd82ddd818dae2ac1f853691fc; https://github.com/exelban/stats/security/advisories/GHSA-qwhf-px96-7f6v
CVE: CVE-2025-23039
Published: 2025-01-17
Description: Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to the theft of sensitive information. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79
References: https://github.com/caido/caido/security/advisories/GHSA-3mfw-fhfp-mgrv
CVE: CVE-2025-23202
Published: 2025-01-17
Description: Bible Module is a tool designed for ROBLOX developers to integrate Bible functionality into their games. The `FetchVerse` and `FetchPassage` functions in the Bible Module are susceptible to injection attacks due to the absence of input validation. This vulnerability could allow an attacker to manipulate the API request URLs, potentially leading to unauthorized access or data tampering. This issue has been addressed in version 0.0.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-20
References: https://github.com/devycreates/Bible-Module/commit/5b783855fc3285be2da8639c97ac37af28f8c55a; https://github.com/devycreates/Bible-Module/security/advisories/GHSA-cm7w-99v2-prrq
CVE: CVE-2025-23205
Published: 2025-01-17
Description: nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of `enable_subdomains = False`. #1915 disables a protection which would allow user Alice to craft a page embedding formgrader in an IFrame. If Bob visits that page, his credentials will be sent and the formgrader page loaded. Because Alice's page is on the same Origin as the formgrader iframe, Javasript on Alice's page has _full access_ to the contents of the page served by formgrader using Bob's credentials. This issue has been addressed in release 0.9.5 and all users are advised to upgrade. Users unable to upgrade may disable `frame-ancestors: self`, or enable per-user and per-service subdomains with `JupyterHub.enable_subdomains = True` (then even if embedding in an IFrame is allowed, the host page does not have access to the contents of the frame).
CWE: CWE-668
References: https://github.com/jupyter/nbgrader/commit/73e137511ac1dc02e95790d4fd6d4d88dab42325; https://github.com/jupyter/nbgrader/pull/1915; https://github.com/jupyter/nbgrader/security/advisories/GHSA-fcr8-4r9f-r66m
CVE: CVE-2025-23206
Published: 2025-01-17
Description: The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow. However, the current `tls.connect` method will always set `rejectUnauthorized: false` which is a potential security concern. CDK should follow the best practice and set `rejectUnauthorized: true`. However, this could be a breaking change for existing CDK applications and we should fix this with a feature flag. Note that this is marked as low severity Security advisory because the issuer url is provided by CDK users who define the CDK application. If they insist on connecting to a unauthorized OIDC provider, CDK should not disallow this. Additionally, the code block is run in a Lambda environment which mitigate the MITM attack. The patch is in progress. To mitigate, upgrade to CDK v2.177.0 (Expected release date 2025-02-22). Once upgraded, users should make sure the feature flag '@aws-cdk/aws-iam:oidcRejectUnauthorizedConnections' is set to true in `cdk.context.json` or `cdk.json`. There are no known workarounds for this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-347
References: https://docs.aws.amazon.com/cdk/v2/guide/featureflags.html; https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.ts#L34; https://github.com/aws/aws-cdk/commit/3e4f3773bfa48b75bf0adc7d53d46bbec7714a9e#diff-38a03353f201fd2e520df67fb43f9f000257bffd6e9acaa5569cce7005a77560
CVE: CVE-2025-0541
Published: 2025-01-17
Description: A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/edit_member.php. The manipulation of the argument name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/nbeisss/CVE/issues/1; https://vuldb.com/?ctiid.292433; https://vuldb.com/?id.292433
CVE: CVE-2025-23207
Published: 2025-01-17
Description: KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `"\\htmlData"` and sanitize HTML output from KaTeX.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-116, CWE-79
References: https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c; https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546
CVE: CVE-2017-13322
Published: 2025-01-17
Description: In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services due to a logic error in the code. This could lead to a local denial of service with no additional execution privileges needed.  User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-783
References: https://source.android.com/security/bulletin/pixel/2018-05-01
CVE: CVE-2018-9375
Published: 2025-01-17
Description: In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9379
Published: 2025-01-17
Description: In multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of deleted photos due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9382
Published: 2025-01-17
Description: In multiple functions of WifiServiceImpl.java, there is a possible way to activate Wi-Fi hotspot from a non-owner profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9383
Published: 2025-01-17
Description: In asn1_ber_decoder of asn1_decoder.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9384
Published: 2025-01-17
Description: In multiple locations, there is a possible way to bypass KASLR due to an unusual root cause. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9434
Published: 2025-01-17
Description: In multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/pixel/2018-07-01
CVE: CVE-2018-9447
Published: 2025-01-17
Description: In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible way to crash the emergency callback mode due to a missing null check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://source.android.com/security/bulletin/pixel/2018-08-01
CVE: CVE-2020-0402
Published: 2025-01-17
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2021-0323
Published: 2025-01-17
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2021-0447
Published: 2025-01-17
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2021-21158
Published: 2025-01-17
Description: Rejected reason: Further investigation determines issue is not within scope of this CNA
CVE: CVE-2022-0303
Published: 2025-01-17
Description: Rejected reason: Further investigation determines issue is not a vulnerability
CVE: CVE-2022-20128
Published: 2025-01-17
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-23208
Published: 2025-01-17
Description: zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://github.com/project-zot/zot/blob/5e30fec65c49e3139907e2819ccb39b2e3bd784e/pkg/meta/boltdb/boltdb.go#L1665; https://github.com/project-zot/zot/commit/002ac62d8a15bf0cba010b3ba7bde86f9837b613; https://github.com/project-zot/zot/security/advisories/GHSA-c9p4-xwr9-rfhx
CVE: CVE-2018-9387
Published: 2025-01-18
Description: In multiple functions of mnh-sm.c, there is a possible way to trigger a heap overflow due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9389
Published: 2025-01-18
Description: In ip6_append_data of ip6_output.c, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9401
Published: 2025-01-18
Description: In many locations, there is a possible way to access kernel memory in user space due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9405
Published: 2025-01-18
Description: In BnDmAgent::onTransact of dm_agent.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9406
Published: 2025-01-18
Description: In NlpService, there is a possible way to obtain location information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9461
Published: 2025-01-18
Description: In onAttachFragment of ShareIntentActivity.java, there is a possible way for an app to read files in the messages app due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2018-08-01
CVE: CVE-2018-9464
Published: 2025-01-18
Description: In multiple locations, there is a possible way to read protected files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-08-01
CVE: CVE-2020-0040
Published: 2025-01-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2020-0436
Published: 2025-01-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-50739
Published: 2025-01-18
Description: A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE: CVE-2024-11923
Published: 2025-01-18
Description: Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to version 1.3
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://www.fortra.com/security/advisories/product-security/fi-2025-003
CVE: CVE-2025-23209
Published: 2025-01-18
Description: Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret; https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603; https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x
CVE: CVE-2024-12071
Published: 2025-01-18
Description: The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_network_post() function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/evergreen-content-poster/trunk/admin/class-evergreen_content_poster-admin.php#L333; https://plugins.trac.wordpress.org/browser/evergreen-content-poster/trunk/includes/class-evergreen_content_poster.php#L345; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224190%40evergreen-content-poster&new=3224190%40evergreen-content-poster&sfp_email=&sfph_mail=
CVE: CVE-2024-13515
Published: 2025-01-18
Description: The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'path' parameter in all versions up to, and including, 2.28.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/webzunft/image-source-control/commit/d1461b886ed2991281c2eb95e98c9b211e737a93; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3172639%40image-source-control-isc&new=3172639%40image-source-control-isc&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3188412%40image-source-control-isc&new=3188412%40image-source-control-isc&sfp_email=&sfph_mail=