deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11709
Published: 2025-10-14
Description: A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1989127; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-82/
CVE: CVE-2025-11710
Published: 2025-10-14
Description: A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1989899; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-82/
CVE: CVE-2025-11711
Published: 2025-10-14
Description: There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-591
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1989978; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-82/
CVE: CVE-2025-11712
Published: 2025-10-14
Description: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-116
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1979536; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-83/
CVE: CVE-2025-11713
Published: 2025-10-14
Description: Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-116
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1986142; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-83/
CVE: CVE-2025-11714
Published: 2025-10-14
Description: Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-125, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1973699%2C1989945%2C1990970%2C1991040%2C1992113; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-82/
CVE: CVE-2025-11715
Published: 2025-10-14
Description: Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1983838%2C1987624%2C1988244%2C1988912%2C1989734%2C1990085%2C1991899; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-83/
CVE: CVE-2025-11716
Published: 2025-10-14
Description: Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1818679; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-84/
CVE: CVE-2025-11717
Published: 2025-10-14
Description: When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability was fixed in Firefox 144.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1872601; https://www.mozilla.org/security/advisories/mfsa2025-81/
CVE: CVE-2025-11718
Published: 2025-10-14
Description: When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event. This vulnerability was fixed in Firefox 144.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1980808; https://www.mozilla.org/security/advisories/mfsa2025-81/
CVE: CVE-2025-11719
Published: 2025-10-14
Description: Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability was fixed in Firefox 144 and Thunderbird 144.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1991950; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-84/
CVE: CVE-2025-11720
Published: 2025-10-14
Description: The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability was fixed in Firefox 144.
CVSS Score: 8.1 (HIGH)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1979534; https://bugzilla.mozilla.org/show_bug.cgi?id=1984370; https://www.mozilla.org/security/advisories/mfsa2025-81/
CVE: CVE-2025-11721
Published: 2025-10-14
Description: Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144 and Thunderbird 144.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-119
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1986816; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-84/
CVE: CVE-2025-7328
Published: 2025-10-14
Description: Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical functions. These could result in potential denial-of-service, admin account takeover, or NAT rule modifications. Devices would no longer be able to communicate through NATR as a result of denial-of-service or NAT rule modifications. NAT rule modification could also result in device communication to incorrect endpoints. Admin account takeover could allow modification of configuration and require physical access to restore.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1756.html
CVE: CVE-2025-7329
Published: 2025-10-14
Description: A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or make the webpage unavailable. The vulnerability stems from missing special character filtering and encoding. Successful exploitation requires an attacker to be able to update configuration fields behind admin login.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1756.html
CVE: CVE-2025-7330
Published: 2025-10-14
Description: A cross-site request forgery security issue exists in the product and version listed. The vulnerability stems from missing CSRF checks on the impacted form. This allows for unintended configuration modification if an attacker can convince a logged in admin to visit a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1756.html
CVE: CVE-2025-9063
Published: 2025-10-14
Description: An authentication bypass security issue exists within FactoryTalk View Machine Edition  Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs, and more.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1753.html
CVE: CVE-2025-9064
Published: 2025-10-14
Description: A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the knowledge of filenames to be deleted.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-22
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1753.html
CVE: CVE-2025-9066
Published: 2025-10-14
Description: A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perform XXE, resulting in a temporary denial-of-service.
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1752html
CVE: CVE-2025-9067
Published: 2025-10-14
Description: A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows user credentials can initiate a repair and hijack the resulting console window. This allows the launching of a command prompt running with SYSTEM-level privileges, allowing full access to all files, processes, and system resources.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1754.html
CVE: CVE-2025-9068
Published: 2025-10-14
Description: A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed with FTLinx. Authenticated attackers with valid Windows Users credentials can initiate a repair and hijack the resulting console window for vbpinstall.exe. This allows the launching of a command prompt running with SYSTEM-level privileges, allowing full access to all files, processes, and system resources.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1754.html
CVE: CVE-2025-9124
Published: 2025-10-14
Description: A denial-of-service security issue in the affected product. The security issue stems from a fault occurring when a crafted CIP unconnected explicit message is sent. This can result in a major non-recoverable fault.
CWE: CWE-248
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1755.html
CVE: CVE-2025-9177
Published: 2025-10-14
Description: A denial-of-service security issue exists in the affected product and version. The security issue stems from a high number of requests sent to the web server. This could result in a web server crash however; this does not impact I/O control or communication . A power cycle is required to recover and utilize the webpage.
CWE: CWE-770
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1757.html
CVE: CVE-2025-9178
Published: 2025-10-14
Description: A denial-of-service security issue exists in the affected product and version. The security issue is caused through CIP communication using crafted payloads. The security issue could result in no CIP communication with 1715 EtherNet/IP Adapter.A restart is required to recover.
CWE: CWE-787
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1757.html
CVE: CVE-2025-22831
Published: 2025-10-14
Description: APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf
CVE: CVE-2025-22832
Published: 2025-10-14
Description: APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf
CVE: CVE-2025-22833
Published: 2025-10-14
Description: APTIOV contains a vulnerability in BIOS where an attacker may cause a Buffer Copy without Checking Size of Input by local accessing. Successful exploitation of this vulnerability may lead to arbitrary code execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf
CVE: CVE-2025-33044
Published: 2025-10-14
Description: APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local means. Successful exploitation of this vulnerability may lead to memory corruption and impact Integrity and Availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf
CVE: CVE-2025-47856
Published: 2025-10-14
Description: Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-250
CVE: CVE-2024-44088
Published: 2025-10-14
Description: Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information and even account takeover.



This issue affects Apache Geode: all versions prior to 1.15.2

Users are recommended to upgrade to version 1.15.2, which fixes the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/161r34nokmcc0w74mnf04lskgb8g1d3g; http://www.openwall.com/lists/oss-security/2025/10/14/5
CVE: CVE-2025-0033
Published: 2025-10-14
Description: Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-284
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3020.html
CVE: CVE-2025-10242
Published: 2025-10-14
Description: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US
CVE: CVE-2025-10243
Published: 2025-10-14
Description: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US
CVE: CVE-2025-10985
Published: 2025-10-14
Description: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US
CVE: CVE-2025-10986
Published: 2025-10-14
Description: Path traversal in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to write data in unintended locations on disk.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US
CVE: CVE-2025-27906
Published: 2025-10-14
Description: IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files and folders are visible in the browser to a user; however, the contents of the files cannot be read obtained or modified.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-548
References: https://www.ibm.com/support/pages/node/7247854
CVE: CVE-2025-54889
Published: 2025-10-14
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps manufacturer configuration modules) allows Stored XSS by users with elevated privileges.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-54889-centreon-web-all-versions-medium-severity-5123
CVE: CVE-2025-54891
Published: 2025-10-14
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Resource access configuration modules) allows Stored 

XSS by users with elevated privileges.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-54891-centreon-web-all-versions-medium-severity-5122
CVE: CVE-2025-54892
Published: 2025-10-14
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules) 

allows Stored XSS by users with elevated privileges.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-54892-centreon-web-all-versions-medium-severity-5121
CVE: CVE-2025-56747
Published: 2025-10-14
Description: Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://suryadina.com/academy-lms-instructor-escalation-3n7b9f2w5k
CVE: CVE-2025-59428
Published: 2025-10-14
Description: EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit permissions can embed a malicious SVG element containing a link in the body field of an article. When an authenticated user clicks the malicious link, they are redirected to an attacker-controlled HTML page that executes a CSRF request against the api/v1/User endpoint. If the victim is prompted for and enters their credentials, an attacker-controlled account is created with privileges determined by the CSRF payload. This issue has been patched in version 9.1.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-79
References: https://github.com/espocrm/espocrm/security/advisories/GHSA-c26c-wvhr-fr6r
CVE: CVE-2025-5946
Published: 2025-10-14
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection.
On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-5946-centreon-web-all-versions-high-severity-5104
CVE: CVE-2025-62156
Published: 2025-10-14
Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic (workflow/executor/executor.go) uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that header.Name stays within the intended extraction directory. A malicious archive entry can supply a traversal or absolute path that, after cleaning, overrides the destination directory and causes files to be written outside the /work/tmp extraction path and into system directories such as /etc inside the container. The vulnerability enables arbitrary file creation or overwrite in system configuration locations (for example /etc/passwd, /etc/hosts, /etc/crontab), which can lead to privilege escalation or persistence within the affected container. Update to 3.6.12 or 3.7.3 to remediate the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://github.com/argoproj/argo-workflows/blob/946a2d6b9ac3309371fe47f49ae94c33ca7d488d/workflow/executor/executor.go#L993; https://github.com/argoproj/argo-workflows/commit/5659ad9b641fcf52c04ed594cd6493f9170f6011; https://github.com/argoproj/argo-workflows/commit/9f6bc5d236cd1b24d[PII_REDACTED]11d71ad17a4c3