rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-0631 PowerFlex® 755 Credential Exposure Vulnerability
A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being sent in clear text.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Rockwell Automation
product: PowerFlex 755
default_status: unaffected
Published: 2025-01-28T18:27:32.084Z
CVE-2025-0632 Local File Inclusion (LFI) leading to sensitive data exposure
Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data including credentials, and with no rate limiting a malicious actor could enumerate the filesystem of the host machine and potentially lead to full host compromise.

This issue affects Rock Maker Web: from 3.2.1.1 and later
Problem types: cwe_id: CWE-98
description: CWE-98 Improper Control of Filename for Include
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Formulatrix
product: Rock Maker Web
default_status: unaffected
Credits: lang: en
value: Nicholas Page
Published: 2025-04-21T05:27:06.090Z
CVE-2025-0633 Heap Overflow in iniparser.c
Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of bound memory
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: iniparser
product: iniparser
default_status: unaffected
Published: 2025-02-19T07:01:22.478Z
CVE-2025-0634 
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Samsung Open Source
product: rLottie
default_status: unaffected
Credits: lang: en
value: Meta Product Security
Published: 2025-06-30T01:44:57.595Z
CVE-2025-0635 Denial of Service condition in M-Files Server
Denial of service condition in M-Files Server in versions before 

25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: M-Files Corporation
product: M-Files Server
default_status: unaffected
Published: 2025-01-23T11:07:51.496Z
CVE-2025-0636 Arbitrary Code Execution vulnerability in Ericsson RAN Compute and Site Controller
EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Ericsson
product: Site Controller 6610
default_status: unaffected
vendor: Ericsson
product: RAN Compute (all BB versions)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-10-13T06:26:16.829Z
CVE-2025-0637 Inadequate access control in Beta10
It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles. The vulnerability has been identified at least in the file or path ‘/app/tools.html’.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Beta10
product: Beta10
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-01-23T15:26:16.067Z
CVE-2025-0638 Routinator crashes when illegal characters are present in manifest file names
The initial code parsing the manifest did not check the content of the file names yet later code assumed that it was checked and panicked when encountering illegal characters, resulting in a crash of Routinator.
Problem types: cwe_id: CWE-1286
description: CWE-1286: Improper Validation of Syntactic Correctness of Input
Affected products: vendor: NLnet Labs
product: Routinator
default_status: affected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: Haya Schulmann, Niklas Vogel; Goethe University Frankfurt/ATHENE Center
Published: 2025-01-22T15:48:44.796Z
CVE-2025-0639 Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [sigitsetiawansss](https://hackerone.com/sigitsetiawansss) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2025-04-24T07:31:06.117Z
CVE-2025-0640 IDOR in Akinsoft's OctoCloud
Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows Resource Leak Exposure.

This issue affects OctoCloud: from s1.09.02 before v1.11.01.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Akinsoft
product: OctoCloud
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Credits: lang: en
value: Berat ARSLAN
Published: 2025-09-02T11:48:09.493Z
CVE-2025-0642 Hard-coded Credentials in PosCube's Assist
Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allows Excavation, Authentication Bypass.

This issue affects Assist: through 10.02.2025.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: PosCube Hardware Software and Consulting Ltd. Co.
product: Assist
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Credits: lang: en
value: Şahnur Eren ALOĞLU
Published: 2025-10-02T12:37:29.648Z
CVE-2025-0643 XSS in Narkom Communication Technologies' Pyxis Signage
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Stored XSS.

This issue affects Pyxis Signage: through 31012025.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Narkom Communication and Software Technologies Trade Ltd. Co.
product: Pyxis Signage
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Tunahan TEKEOĞLU
Published: 2025-11-20T13:26:16.317Z
CVE-2025-0645 Arbitrary File Upload in Narkom Communication Technologies' Pyxis Signage
Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Pyxis Signage: through 31012025.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Narkom Communication and Software Technologies Trade Ltd. Co.
product: Pyxis Signage
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Tunahan TEKEOĞLU
Published: 2025-11-20T13:33:38.885Z
CVE-2025-0647 
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the same PE or another PE in the shareability domain. In this case, the PE may retain stale TLB entries which should have been invalidated by the TLBI.
Problem types: cwe_id: CWE-226
description: CWE-226 Sensitive Information in Resource Not Removed Before Reuse
Affected products: vendor: Arm
product: Neoverse-N2
default_status: unaffected
vendor: Arm
product: Neoverse-V3AE
default_status: unaffected
vendor: Arm
product: Neoverse-V3
default_status: unaffected
vendor: Arm
product: Neoverse-V2
default_status: unaffected
vendor: Arm
product: Cortex-X925
default_status: unaffected
vendor: Arm
product: Cortex-X4
default_status: unaffected
vendor: Arm
product: Cortex-X3
default_status: unaffected
vendor: Arm
product: Cortex-X2
default_status: unaffected
vendor: Arm
product: Cortex-A710
default_status: unaffected
vendor: Arm
product: C1-Premium
default_status: unaffected
vendor: Arm
product: C1-Ultra
default_status: unaffected
Published: 2026-01-14T10:58:44.342Z
CVE-2025-0648 M-Files Server crash via EOT database driver configuration
Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3  allows a highly privileged attacker to cause denial of service via configuration change.
Problem types: cwe_id: CWE-248
description: CWE-248 Uncaught Exception
Affected products: vendor: M-Files Corporation
product: M-Files Server
default_status: unaffected
Published: 2025-01-23T11:06:19.319Z
CVE-2025-0649 Stack Exhaustion In Tensorflow Serving
Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Google
product: Tensorflow
default_status: unaffected
Credits: lang: en
value: Ori Hollander of the JFrog Vulnerability Research Team
Published: 2025-05-06T20:20:02.345Z
CVE-2025-0651 File symlink abuse might lead to deleting files belonging to SYSTEM user
Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.

User with a low system privileges  can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user.
This issue affects WARP: before 2024.12.492.0.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Cloudflare
product: WARP
default_status: unaffected
Credits: lang: en
value: https://hackerone.com/sim0nsecurity?type=user
Published: 2025-01-22T17:34:16.705Z
CVE-2025-0652 Incorrect Authorization in GitLab
An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [foxribeye](https://hackerone.com/foxribeye) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2025-03-13T05:55:59.744Z
CVE-2025-0656 IBM Concert Software cross-site scripting
IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: IBM
product: Concert Software
cpes: cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-09-01T14:23:54.041Z
CVE-2025-0657 ALC WebCTRL Carrier i-Vu and Gen5 Controllers Array Index out-of-range
A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver
  version  drv_gen5_106-01-2380, allows
  malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to
  return the device to network visibility.
Problem types: cwe_id: CWE-129
description: CWE-129 Improper Validation of Array Index
cwe_id: CWE-248
description: CWE-248 Uncaught Exception
Affected products: vendor: Automated Logic
product: WebCtrl
default_status: unaffected
vendor: Automated Logic
product: Gen5 Controllers
default_status: unaffected
vendor: Carrier
product: i-Vu
default_status: unaffected
Credits: lang: en
value: Christopher Morales Gonzalez
Published: 2025-11-27T01:00:59.653Z
CVE-2025-0658 Automated Logic and Carrier Zone Controllers malformed packets denial of service
A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol
causes the device to crash. The device enters a fault state; after a reset,
a second packet can leave it permanently unresponsive until a manual power cycle
is performed.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Automated Logic
product: Zone Controllers
default_status: unaffected
vendor: Carrier
product: Zone Controllers
default_status: unaffected
Credits: lang: en
value: Christopher Morales Gonzalez
Published: 2025-11-27T01:00:16.431Z
CVE-2025-0659 Path Traversal and Rockwell Automation Third-party Vulnerability in DataMosaix™ Private Cloud
A path
traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifying the character
sequence in the body of the vulnerable endpoint, it is possible to overwrite
files outside of the intended directory. A threat actor with admin privileges could
leverage this vulnerability to overwrite reports including user projects.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Rockwell Automation
product: DataEdgePlatform DataMosaix™ Private Cloud
default_status: unaffected
Published: 2025-01-28T15:16:38.188Z
CVE-2025-0660 Stored XSS in Folder Function by Rogue Admin
Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names.  The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Versions below 9 are not affected. Thanks, Alfin Joseph for reporting.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Concrete CMS
product: Concrete CMS
default_status: unaffected
Credits: lang: en
value: Alfin Joseph
Published: 2025-03-10T20:57:57.707Z
CVE-2025-0661 DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure
The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, draft, or scheduled posts that they should not have access to by duplicating the post.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: detheme
product: DethemeKit for Elementor
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Craig Smith
Published: 2025-02-13T06:58:04.120Z
CVE-2025-0662 Uninitialized kernel memory disclosure via ktrace(2)
In some cases, the ktrace facility will log the contents of kernel structures to userspace.  In one such case, ktrace dumps a variable-sized sockaddr to userspace.  There, the full sockaddr is copied, even when it is shorter than the full size.  This can result in up to 14 uninitialized bytes of kernel memory being copied out to userspace.

It is possible for an unprivileged userspace program to leak 14 bytes of a kernel heap allocation to userspace.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Yichen Chai
lang: en
value: Zhuo Ying Jiang Li
Published: 2025-01-30T04:49:56.482Z
CVE-2025-0663 Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login
A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key is used across all tenants to sign authentication cookies, allowing a privileged user in one tenant to forge authentication cookies for users in other tenants.

Because the Auto-Login feature is enabled by default, this flaw may allow an attacker to gain unauthorized access and potentially take over accounts in other tenants. Successful exploitation requires access to Adaptive Authentication functionality, which is typically restricted to high-privileged users. The vulnerability is only exploitable when Auto-Login is enabled, reducing its practical impact in deployments where the feature is disabled.
Affected products: vendor: WSO2
product: WSO2 Open Banking IAM
default_status: unaffected
vendor: WSO2
product: WSO2 Identity Server as Key Manager
default_status: unaffected
vendor: WSO2
product: WSO2 Identity Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-09-23T16:58:06.589Z
CVE-2025-0664 
A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library. This may impair endpoint defenses and allow the attacker to achieve code execution with SYSTEM-level privileges.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Trellix
product: Trellix Endpoint Security (HX) Agent
default_status: unaffected
Published: 2025-07-21T07:08:24.915Z
CVE-2025-0665 eventfd double close
libcurl would wrongly close the same eventfd file descriptor twice when taking
down a connection channel after having completed a threaded name resolve.
Problem types: description: CWE-1341 Multiple Releases of Same Resource or Handle
Affected products: vendor: curl
product: curl
default_status: unaffected
Credits: lang: en
value: Christian Heusel
lang: en
value: Andy Pan
Published: 2025-02-05T09:16:49.038Z
CVE-2025-0666 BOINC Server Stored XSS Injection in host_venue_action.php
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: through 1.4.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: BOINC
product: BOINC Server
default_status: unaffected
Published: 2025-05-07T07:38:07.341Z
CVE-2025-0667 BOINC Server Stored XSS Injection in pm.php
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: through 1.4.7.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: BOINC
product: BOINC Server
default_status: unaffected
Published: 2025-05-07T07:38:50.926Z
CVE-2025-0668 BOINC Server Multiple SQL Injections
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: before 1.4.5.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: BOINC
product: BOINC Server
default_status: unaffected
Published: 2025-05-07T07:39:26.843Z
CVE-2025-0669 BOINC Server Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in BOINC Server allows Cross Site Request Forgery.This issue affects BOINC Server: before 1.4.3.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: BOINC
product: BOINC Server
default_status: unaffected
Published: 2025-05-07T07:39:59.434Z