deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5888
Published: 2025-03-03
Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE: CVE-2025-1879
Published: 2025-03-03
Description: A vulnerability was found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This issue affects some unknown processing of the component APK. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the physical device. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
CVSS Score: 2.4 (LOW)
CWE: CWE-259, CWE-798, CWE-798
References: https://github.com/geo-chen/i-Drive; https://vuldb.com/?ctiid.298193; https://vuldb.com/?id.298193
CVE: CVE-2025-1880
Published: 2025-03-03
Description: A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device Pairing. The manipulation leads to authentication bypass by primary weakness. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
CVSS Score: 2.0 (LOW)
CWE: CWE-287, CWE-305
References: https://github.com/geo-chen/i-Drive; https://vuldb.com/?ctiid.298194; https://vuldb.com/?id.298194
CVE: CVE-2025-1881
Published: 2025-03-03
Description: A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Video Footage/Live Video Stream. The manipulation leads to improper access controls. The attack can be launched remotely. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/geo-chen/i-Drive; https://vuldb.com/?ctiid.298195; https://vuldb.com/?id.298195
CVE: CVE-2025-1882
Published: 2025-03-03
Description: A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been rated as critical. Affected by this issue is some unknown functionality of the component Device Setting Handler. The manipulation leads to improper access control for register interface. The attack needs to be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284, CWE-1262
References: https://github.com/geo-chen/i-Drive; https://vuldb.com/?ctiid.298196; https://vuldb.com/?id.298196
CVE: CVE-2024-55064
Published: 2025-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in EasyVirt DC NetScope <= 8.6.4 allow remote attackers to inject arbitrary JavaScript or HTML code via the (1) smtp_server, (2) smtp_account, (3) smtp_password, or (4) email_recipients parameter to /smtp/update; the (5) ntp or (6) dns parameter to /proxy/ntp/change; the (7) newVcenterAddress parameter to /process_new_vcenter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-55064.md
CVE: CVE-2025-1890
Published: 2025-03-04
Description: A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/caigo8/CVE-md/blob/main/shishuocms/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md; https://vuldb.com/?ctiid.298408; https://vuldb.com/?id.298408
CVE: CVE-2025-1891
Published: 2025-03-04
Description: A vulnerability was found in shishuocms 1.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/caigo8/CVE-md/blob/main/shishuocms/CSRF%E6%B7%BB%E5%8A%A0%E7%AE%A1%E7%90%86%E5%91%98.md; https://vuldb.com/?ctiid.298409; https://vuldb.com/?id.298409
CVE: CVE-2025-27219
Published: 2025-03-04
Description: In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml; https://hackerone.com/reports/2936778; https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
CVE: CVE-2025-27220
Published: 2025-03-04
Description: In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml; https://hackerone.com/reports/2890322; https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
CVE: CVE-2025-27221
Published: 2025-03-04
Description: In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
CVSS Score: 3.2 (LOW)
CWE: CWE-212, CWE-212
References: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml; https://hackerone.com/reports/2957667; https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
CVE: CVE-2025-1695
Published: 2025-03-04
Description: In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an increase in CPU resource utilization.  This vulnerability allows a remote attacker to cause a degradation that can lead to a limited denial-of-service (DoS).  There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://my.f5.com/manage/s/article/K000149959
CVE: CVE-2025-1892
Published: 2025-03-04
Description: A vulnerability was found in shishuocms 1.1. It has been classified as problematic. Affected is an unknown function of the file /manage/folder/add.json of the component Directory Deletion Page. The manipulation of the argument folderName leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/caigo8/CVE-md/blob/main/shishuocms/%E5%AD%98%E5%82%A8%E5%9E%8BXSS.md; https://vuldb.com/?ctiid.298410; https://vuldb.com/?id.298410
CVE: CVE-2025-1893
Published: 2025-03-04
Description: A vulnerability was found in Open5GS up to 2.7.2. It has been declared as problematic. Affected by this vulnerability is the function gmm_state_authentication of the file src/amf/gmm-sm.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. The patch is named e31e9965f00d9c744a7f728497cb4f3e97744ee8. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/open5gs/open5gs/commit/e31e9965f00d9c744a7f728497cb4f3e97744ee8; https://github.com/open5gs/open5gs/issues/3707; https://github.com/open5gs/open5gs/issues/3707#issue[PII_REDACTED]
CVE: CVE-2025-1894
Published: 2025-03-04
Description: A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search-result.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Maochuyue/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.298412
CVE: CVE-2025-1895
Published: 2025-03-04
Description: A vulnerability classified as critical has been found in Tenda TX3 16.03.13.11_multi. This affects an unknown part of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/TX3/tenda_tx3_bof_1.pdf; https://vuldb.com/?ctiid.298413; https://vuldb.com/?id.298413
CVE: CVE-2025-1896
Published: 2025-03-04
Description: A vulnerability classified as critical was found in Tenda TX3 16.03.13.11_multi. This vulnerability affects unknown code of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/TX3/tenda_tx3_bof_2.pdf; https://vuldb.com/?ctiid.298414; https://vuldb.com/?id.298414
CVE: CVE-2025-1897
Published: 2025-03-04
Description: A vulnerability, which was classified as critical, has been found in Tenda TX3 16.03.13.11_multi. This issue affects some unknown processing of the file /goform/SetNetControlList. The manipulation of the argument list leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/TX3/tenda_tx3_bof_3.pdf; https://vuldb.com/?ctiid.298415; https://vuldb.com/?id.298415
CVE: CVE-2025-1898
Published: 2025-03-04
Description: A vulnerability, which was classified as critical, was found in Tenda TX3 16.03.13.11_multi. Affected is an unknown function of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/TX3/tenda_tx3_bof_4.pdf; https://vuldb.com/?ctiid.298416; https://vuldb.com/?id.298416
CVE: CVE-2025-1899
Published: 2025-03-04
Description: A vulnerability has been found in Tenda TX3 16.03.13.11_multi and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/TX3/tenda_tx3_bof_5.pdf; https://vuldb.com/?ctiid.298417; https://vuldb.com/?id.298417
CVE: CVE-2024-13686
Published: 2025-03-04
Description: The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vw_storefront_reset_all_settings() function in all versions up to, and including, 0.9.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the themes settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=261535%40vw-storefront&new=261535%40vw-storefront&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/299ed515-ba64-413a-a03a-2db801520ae0?source=cve
CVE: CVE-2025-0587
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-190
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-0912
Published: 2025-03-04
Description: The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://github.com/impress-org/givewp/pull/7679/files; https://plugins.trac.wordpress.org/changeset/3234114/give/trunk/src/Donations/Properties/BillingAddress.php; https://plugins.trac.wordpress.org/changeset/3234114/give/trunk/src/Donations/Repositories/DonationRepository.php
CVE: CVE-2025-1321
Published: 2025-03-04
Description: The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including, 9.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3246754%40teachpress&new=3246754%40teachpress&sfp_email=&sfph_mail=#file6; https://www.wordfence.com/threat-intel/vulnerabilities/id/cb453fe3-ba89-437c-b3fb-9ec207eaa9f0?source=cve
CVE: CVE-2025-1639
Published: 2025-03-04
Description: The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to further infect a victim when Elementor is not activated on a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://themeforest.net/item/arolax-creative-digital-agency-theme/53547630; https://www.wordfence.com/threat-intel/vulnerabilities/id/fb310bdb-fc74-47b2-9371-3d10abd287fb?source=cve
CVE: CVE-2025-1900
Published: 2025-03-04
Description: A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /add-table.php. The manipulation of the argument tableno leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/chenzi-dynasty/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.298418
CVE: CVE-2025-1901
Published: 2025-03-04
Description: A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/check_availability.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/chenzi-dynasty/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.298419
CVE: CVE-2025-1902
Published: 2025-03-04
Description: A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /password-recovery.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/panghuanjie/Code-audits/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.298420
CVE: CVE-2025-1903
Published: 2025-03-04
Description: A vulnerability was found in Codezips Online Shopping Website 1.0. It has been rated as critical. This issue affects some unknown processing of the file /cart_add.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/takakie/CVE/blob/main/cve_3.md; https://vuldb.com/?ctiid.298421; https://vuldb.com/?id.298421
CVE: CVE-2025-20011
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
CVSS Score: 3.3 (LOW)
CWE: CWE-401
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-20021
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-20024
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-190
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-20042
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-20081
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-20091
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-20626
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-21084
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through through NULL pointer dereference.. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-476
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-21089
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-21097
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-21098
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922, CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-22443
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-22835
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
CVSS Score: 3.8 (LOW)
CWE: CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-22837
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-22841
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-22847
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE: CVE-2025-22897
Published: 2025-03-04
Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow.
CVSS Score: 3.3 (LOW)
CWE: CWE-120
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md