rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-3114 Spotfire Code Execution Vulnerability
Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.

Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.
Affected products: vendor: Spotfire
product: Spotfire Enterprise Runtime for R
default_status: unaffected
vendor: Spotfire
product: Spotfire Statistics Services
default_status: unaffected
vendor: Spotfire
product: Spotfire Analyst
default_status: unknown
vendor: Spotfire
product: Deployment Kit used in Spotfire Server
default_status: unknown
vendor: Spotfire
product: Spotfire Desktop
default_status: unaffected
vendor: Spotfire
product: Spotfire for AWS Marketplace
default_status: unknown
vendor: Spotfire
product: Spotfire Enterprise Runtime for R - Server Edition
default_status: unknown
Published: 2025-04-09T17:29:48.612Z
CVE-2025-3115 Spotfire Data Function Vulnerability
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions.
Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
Affected products: vendor: Spotfire
product: Spotfire Statistics Services
default_status: unaffected
vendor: Spotfire
product: Spotfire Analyst
default_status: unknown
vendor: Spotfire
product: Deployment Kit used in Spotfire Server
default_status: unknown
vendor: Spotfire
product: Spotfire Desktop
default_status: unknown
vendor: Spotfire
product: Spotfire for AWS Marketplace
default_status: unknown
vendor: Spotfire
product: Spotfire Enterprise Runtime for R - Server Edition
default_status: unknown
vendor: Spotfire
product: Spotfire Service for Python
default_status: unknown
vendor: Spotfire
product: Spotfire Service for R
default_status: unknown
Published: 2025-04-09T18:12:28.348Z
CVE-2025-3116 
CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an
authenticated malicious user sends special malformed HTTPS request containing improper formatted body
data to the controller.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Schneider Electric
product: Modicon Controllers M241/M251
default_status: unaffected
vendor: Schneider Electric
product: Modicon Controllers M258 / LMC058
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-06-10T08:34:50.585Z
CVE-2025-3117 
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability
exists impacting configuration file paths that could cause an unvalidated data injected by authenticated
malicious user leading to modify or read data in a victim’s browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Schneider Electric
product: Modicon Controllers M241/M251
default_status: unaffected
vendor: Schneider Electric
product: Modicon Controllers M262
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-06-10T08:43:15.540Z
CVE-2025-3118 SourceCodester Online Tutor Portal view_course.php sql injection
A vulnerability was found in SourceCodester Online Tutor Portal 1.0. It has been classified as critical. This affects an unknown part of the file /tutor/courses/view_course.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Online Tutor Portal
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: wanglun (VulDB User)
lang: en
value: wanglun (VulDB User)
Published: 2025-04-02T21:00:12.775Z
CVE-2025-3119 SourceCodester Online Tutor Portal manage_course.php sql injection
A vulnerability was found in SourceCodester Online Tutor Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /tutor/courses/manage_course.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Online Tutor Portal
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: wanglun (VulDB User)
lang: en
value: wanglun (VulDB User)
Published: 2025-04-02T21:31:05.341Z
CVE-2025-3120 SourceCodester Apartment Visitors Management System add-apartment.php sql injection
A vulnerability was found in SourceCodester Apartment Visitors Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /add-apartment.php. The manipulation of the argument apartmentno leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Apartment Visitors Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: wanglun (VulDB User)
lang: en
value: wanglun (VulDB User)
Published: 2025-04-02T21:31:07.699Z
CVE-2025-3121 PyTorch torch.jit.jit_module_from_flatbuffer memory corruption
A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: n/a
product: PyTorch
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
baseSeverity: LOW
Credits: lang: en
value: Default436352 (VulDB User)
Published: 2025-04-02T22:00:12.390Z
CVE-2025-3122 WebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereference
A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctionBody of the file src/interp/binary-reader-interp.cc. The manipulation leads to null pointer dereference. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: WebAssembly
product: wabt
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
baseSeverity: LOW
Published: 2025-04-02T22:00:14.705Z
CVE-2025-3123 WonderCMS Theme Installation/Plugin Installation installUpdateModuleAction unrestricted upload
A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he philosophy has always been, admin [...] bear responsibility to not install themes/plugins from untrusted sources."
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: n/a
product: WonderCMS
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: cc1110 (VulDB User)
Published: 2025-04-02T22:31:04.900Z
CVE-2025-3124 Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized access to private repository names
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have access to in the Security Overview in GitHub Advanced Security. The Security Overview was required to be filtered only using the `archived:` filter and all other access controls were functioning normally. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.17 and was fixed in versions 3.13.14, 3.14.11, 3.15.6, and 3.16.2.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: GitHub
product: Enterprise Server
default_status: affected
Published: 2025-04-17T22:50:14.017Z
CVE-2025-3125 Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE).

This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: WSO2
product: WSO2 Identity Server
default_status: unaffected
vendor: WSO2
product: WSO2 Enterprise Integrator
default_status: unaffected
vendor: WSO2
product: WSO2 Open Banking IAM
default_status: unaffected
vendor: WSO2
product: WSO2 Identity Server as Key Manager
default_status: unaffected
vendor: WSO2
product: WSO2 API Manager
default_status: unaffected
vendor: WSO2
product: WSO2 API Control Plane
default_status: unaffected
vendor: WSO2
product: WSO2 Universal Gateway
default_status: unaffected
vendor: WSO2
product: WSO2 Traffic Manager
default_status: unaffected
vendor: WSO2
product: org.wso2.carbon.commons:org.wso2.carbon.application.upload
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Danh Nguyen (k4it0) from VIB Pentest Team
Published: 2025-11-05T14:49:44.597Z
CVE-2025-3128 Mitsubishi Electric Europe smartRTU OS Command Injection
A remote unauthenticated attacker who has bypassed authentication could 
execute arbitrary OS commands to disclose, tamper with, destroy or 
delete information in Mitsubishi Electric smartRTU, or cause a denial-of
 service condition on the product.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: Mitsubishi Electric Europe
product: smartRTU
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe of Claroty Team82 reported this vulnerability to CISA.
Published: 2025-08-21T19:37:28.430Z
CVE-2025-3129 Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Drupal
product: Access code
default_status: unaffected
Credits: lang: en
value: Marcin Maruszewski (marcin maruszewski)
lang: en
value: Gergely Lekli (glekli)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
Published: 2025-04-02T21:10:22.236Z
CVE-2025-3130 Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Obfuscate
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: Nigel Cunningham (nigelcunningham)
lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
Published: 2025-04-02T21:10:46.804Z
CVE-2025-3131 ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031
Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: ECA: Event - Condition - Action
default_status: unaffected
Credits: lang: en
value: Juraj Nemec (poker10)
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: Jürgen Haas (jurgenhaas)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Juraj Nemec (poker10)
Published: 2025-04-09T17:47:34.125Z
CVE-2025-3134 code-projects Payroll Management System add_overtime.php sql injection
A vulnerability classified as critical has been found in code-projects Payroll Management System 1.0. This affects an unknown part of the file /add_overtime.php. The manipulation of the argument rate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Payroll Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: YAEMIKO-W (VulDB User)
Published: 2025-04-03T01:31:04.817Z
CVE-2025-3135 fcba_zzm ics-park Smart Park Management System update sql injection
A vulnerability classified as critical was found in fcba_zzm ics-park Smart Park Management System 2.1. This vulnerability affects unknown code of the file /api/system/dept/update. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: fcba_zzm
product: ics-park Smart Park Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: beize (VulDB User)
Published: 2025-04-03T01:31:09.657Z
CVE-2025-3136 PyTorch CUDACachingAllocator.cpp torch.cuda.memory.caching_allocator_delete memory corruption
A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_delete of the file c10/cuda/CUDACachingAllocator.cpp. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: n/a
product: PyTorch
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
baseSeverity: LOW
Credits: lang: en
value: Default436352 (VulDB User)
Published: 2025-04-03T03:31:05.598Z
CVE-2025-3137 PHPGurukul Online Security Guards Hiring System changeimage.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Online Security Guards Hiring System 1.0. Affected is an unknown function of the file /admin/changeimage.php. The manipulation of the argument editid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Online Security Guards Hiring System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Published: 2025-04-03T03:31:08.651Z
CVE-2025-3138 PHPGurukul Online Security Guards Hiring System edit-guard-detail.php sql injection
A vulnerability has been found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit-guard-detail.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Online Security Guards Hiring System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Published: 2025-04-03T04:00:18.633Z
CVE-2025-3139 code-projects Bus Reservation System Login Form login buffer overflow
A vulnerability was found in code-projects Bus Reservation System 1.0 and classified as critical. Affected by this issue is the function Login of the component Login Form. The manipulation of the argument Str1 leads to buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: code-projects
product: Bus Reservation System
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Lxxxt (VulDB User)
Published: 2025-04-03T04:00:20.465Z
CVE-2025-3140 SourceCodester Online Medicine Ordering System view_category.php sql injection
A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /view_category.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Online Medicine Ordering System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Lena-lyy (VulDB User)
lang: en
value: Lena-lyy (VulDB User)
Published: 2025-04-03T04:31:05.693Z
CVE-2025-3141 SourceCodester Online Medicine Ordering System manage_category.php sql injection
A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage_category.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Online Medicine Ordering System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Lena-lyy (VulDB User)
lang: en
value: Lena-lyy (VulDB User)
Published: 2025-04-03T05:00:16.544Z
CVE-2025-3142 SourceCodester Apartment Visitor Management System add-apartment.php sql injection
A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /add-apartment.php. The manipulation of the argument buildingno leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Apartment Visitor Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Lena-lyy (VulDB User)
lang: en
value: Lena-lyy (VulDB User)
Published: 2025-04-03T05:31:05.298Z
CVE-2025-3143 SourceCodester Apartment Visitor Management System visitor-entry.php sql injection
A vulnerability classified as critical has been found in SourceCodester Apartment Visitor Management System 1.0. Affected is an unknown function of the file /visitor-entry.php. The manipulation of the argument visname/address leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Apartment Visitor Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Lena-lyy (VulDB User)
lang: en
value: Lena-lyy (VulDB User)
Published: 2025-04-03T06:00:12.442Z
CVE-2025-3144 MindSpore mindspore.numpy.fft.hfftn memory corruption
A vulnerability classified as problematic was found in MindSpore 2.5.0. Affected by this vulnerability is the function mindspore.numpy.fft.hfftn. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: n/a
product: MindSpore
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
baseSeverity: LOW
Credits: lang: en
value: Default436352 (VulDB User)
Published: 2025-04-03T06:00:19.126Z