rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-0407 liujianview gymxmjpa EquipmentController.java EquipmentDaoImpl sql injection
A vulnerability was found in liujianview gymxmjpa 1.0. It has been declared as critical. Affected by this vulnerability is the function EquipmentDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/EquipmentController.java. The manipulation of the argument hyname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: liujianview
product: gymxmjpa
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: LVZC3 (VulDB User)
Published: 2025-01-13T01:31:05.940Z
CVE-2025-0408 liujianview gymxmjpa LoosController.java LoosDaoImpl sql injection
A vulnerability was found in liujianview gymxmjpa 1.0. It has been rated as critical. Affected by this issue is the function LoosDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/LoosController.java. The manipulation of the argument loosName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: liujianview
product: gymxmjpa
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: LVZC3 (VulDB User)
Published: 2025-01-13T02:00:12.582Z
CVE-2025-0409 liujianview gymxmjpa MembertypeController.java MembertypeDaoImpl sql injection
A vulnerability classified as critical has been found in liujianview gymxmjpa 1.0. This affects the function MembertypeDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/MembertypeController.java. The manipulation of the argument typeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: liujianview
product: gymxmjpa
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: LVZC3 (VulDB User)
Published: 2025-01-13T02:31:05.066Z
CVE-2025-0410 liujianview gymxmjpa MenberConntroller.java MenberDaoInpl sql injection
A vulnerability classified as critical was found in liujianview gymxmjpa 1.0. This vulnerability affects the function MenberDaoInpl of the file src/main/java/com/liujian/gymxmjpa/controller/MenberConntroller.java. The manipulation of the argument hyname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: liujianview
product: gymxmjpa
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: LVZC3 (VulDB User)
Published: 2025-01-13T02:31:06.610Z
CVE-2025-0411 7-Zip Mark-of-the-Web Bypass Vulnerability
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
Problem types: cwe_id: CWE-693
description: CWE-693: Protection Mechanism Failure
Affected products: vendor: 7-Zip
product: 7-Zip
default_status: unknown
Published: 2025-01-25T04:28:24.270Z
CVE-2025-0412 Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability
Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22139.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Luxion
product: KeyShot Viewer
default_status: unknown
Published: 2025-01-13T03:20:44.774Z
CVE-2025-0413 Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability
Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. 
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Technical Data Reporter component. By creating a symbolic link, an attacker can abuse the service to change the permissions of arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-25014.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Parallels
product: Desktop
default_status: unknown
Published: 2025-02-04T23:09:18.874Z
CVE-2025-0415 Command Injection in NTP Setting
A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for downstream systems that rely on its network services.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Moxa
product: EDF-G1002-BP Series
default_status: unaffected
vendor: Moxa
product: EDR-810 Series
default_status: unaffected
vendor: Moxa
product: EDR-8010 Series
default_status: unaffected
vendor: Moxa
product: EDR-G9004 Series
default_status: unaffected
vendor: Moxa
product: EDR-G9010 Series
default_status: unaffected
vendor: Moxa
product: OnCell G4302-LTE4 Series
default_status: unaffected
vendor: Moxa
product: TN-4900 Series
default_status: unaffected
vendor: Moxa
product: NAT-102 Series
default_status: unaffected
Published: 2025-04-02T06:22:11.432Z
CVE-2025-0416 Valmet DNA Local privilege escalation through insecure DCOM configuration
Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows permission that allows a process to impersonate another user. An attacker can use this vulnerability to escalate their privileges and take complete control of the system.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Valmet
product: Valmet DNA
default_status: unaffected
Credits: lang: en
value: Sixtus Leonhardsberger and Felix Eberstaller of LimesSecurity
Published: 2025-04-01T04:05:14.236Z
CVE-2025-0417 Valmet DNA Lack of protection against brute force attacks
Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then performing switching operations.
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Valmet
product: Valmet DNA
default_status: unaffected
Credits: lang: en
value: Sixtus Leonhardsberger and Felix Eberstaller of LimesSecurity
Published: 2025-04-01T04:02:54.268Z
CVE-2025-0418 Valmet DNA user passwords in plain text
Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: Valmet
product: Valmet DNA
default_status: unaffected
Credits: lang: en
value: Sixtus Leonhardsberger and Felix Eberstaller of LimesSecurity
Published: 2025-04-01T03:59:40.489Z
CVE-2025-0419 XSS in Mikrogrup's Zirve Nova
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. Zirve Nova allows Cross-Site Scripting (XSS).

This issue affects Zirve Nova: from 235 through 20250131.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Zirve Information Technologies Inc.
product: Zirve Nova
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Credits: lang: en
value: Berat ARSLAN
Published: 2025-09-17T08:20:40.788Z
CVE-2025-0420 XSS in Mikrogrup's Paraşüt
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting (XSS).

This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Paraşüt Software
product: Paraşüt
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Credits: lang: en
value: Berat ARSLAN
Published: 2025-09-17T09:14:03.419Z
CVE-2025-0421 iFrame Injection in Mikrogrup's Shopside
Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.

This issue affects Shopside: through 05022025.
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: Shopside Software Technologies Inc.
product: Shopside
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Credits: lang: en
value: Berat ARSLAN
Published: 2025-11-19T13:28:36.779Z
CVE-2025-0422 Authenticated Remote Code Execution via ScriptVar
An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote Code Execution) For this, the user must be able to create "ScriptVars" with the type „script" and preview them by, for example, creating a new "Info". By default, admin users have those permissions, but with the granular permission system, those permissions may be assigned to other users. An attacker is able to execute commands on the server running the "bestinformed Web" application if an account with the correct permissions was compromised before.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Cordaware
product: bestinformed Web
default_status: unaffected
Credits: lang: en
value: Manuel Kiesel (cyllective AG)
lang: en
value: David Miller (cyllective AG)
Published: 2025-02-18T07:57:04.886Z
CVE-2025-0423 Multiple Unauthenticated Stored Cross-Site Scripting
In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their session using an "Unauthenticated Stored Cross-Site Scripting". The attacker is then able to ride the session of those users and can abuse their privileges on the "bestinformed Web" application.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Cordaware
product: bestinformed Web
default_status: unaffected
Credits: lang: en
value: Manuel Kiesel (cyllective AG)
lang: en
value: David Miller (cyllective AG)
Published: 2025-02-18T07:57:17.412Z
CVE-2025-0424 Multiple Authenticated Stored Cross-Site Scripting
In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scripting vulnerabilities. An authenticated attacker is able to compromise the sessions of other users on the server by injecting JavaScript code into their session using an "Authenticated Stored Cross-Site Scripting". Those other users might have more privileges than the attacker, enabling a form of horizontal movement.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Cordaware
product: bestinformed Web
default_status: unaffected
Credits: lang: en
value: Manuel Kiesel (cyllective AG)
lang: en
value: David Miller (cyllective AG)
Published: 2025-02-18T07:57:25.806Z
CVE-2025-0425 Local Privilege Escalation via Config Manipulation
Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this client connects. This is dangerous as the "bestinformed Infoclient" runs with elevated permissions ("nt authority\system"). By changing the server address to a malicious server, or a script simulating a server, the user is able to escalate his privileges by abusing certain features of the "bestinformed Web" server. Those features include:
  *  Pushing of malicious update packages
  *  Arbitrary Registry Read as "nt authority\system"


An attacker is able to escalate his privileges to "nt authority\system" on the Windows client running the "bestinformed Infoclient". 


This attack is not possible if a custom configuration ("Infoclient.ini") containing the flags "ShowOnTaskbar=false" or "DisabledItems=stPort,stAddress" is deployed.
Problem types: cwe_id: CWE-15
description: CWE-15: External Control of System or Configuration Setting
Affected products: vendor: Cordaware
product: bestinformed Infoclient
default_status: unaffected
Credits: lang: en
value: Manuel Kiesel (cyllective AG)
lang: en
value: David Miller (cyllective AG)
Published: 2025-02-18T07:57:35.329Z
CVE-2025-0426 
A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Kubernetes
product: kubelet
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Tim Allclair
Published: 2025-02-13T15:16:13.703Z
CVE-2025-0427 Mali GPU Kernel Driver allows access to already freed memory
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r8p0 through r49p3, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r19p0 through r49p3, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p3, from r50p0 through r53p0.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Arm Ltd
product: Bifrost GPU Kernel Driver
default_status: unaffected
vendor: Arm Ltd
product: Valhall GPU Kernel Driver
default_status: unaffected
vendor: Arm Ltd
product: Arm 5th Gen GPU Architecture Kernel Driver
default_status: unaffected
Published: 2025-05-02T09:58:00.766Z
CVE-2025-0428 AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_prompts function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: senols
product: AI Puffer – Your AI engine for WordPress (formerly AI Power)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Tran Anh Duc
Published: 2025-01-22T07:29:40.161Z
CVE-2025-0429 AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_ai_forms() function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: senols
product: AI Puffer – Your AI engine for WordPress (formerly AI Power)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Tran Anh Duc
Published: 2025-01-22T07:29:40.953Z
CVE-2025-0430 Belledonne Communications Linphone-Desktop NULL Pointer Dereference
Belledonne Communications Linphone-Desktop 
 is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to create a denial-of-service condition.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Belledonne Communications
product: Linphone-Desktop
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-01-17T17:34:26.652Z
CVE-2025-0431 Enterprise Protection Backslash URL Rewrite Bypass
Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email.  This occurs due to improper filtering of backslashes within URLs and affects all versions of 8.21, 8.20 and 8.18 prior to 8.21.0 patch 5115, 8.20.6 patch 5114 and 8.18.6 patch 5113 respectively.
Problem types: cwe_id: CWE-790
description: CWE-790 Improper Filtering of Special Elements
Affected products: vendor: Proofpoint
product: Enterprise Protection
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
version: 3.1
Published: 2025-03-19T16:18:23.793Z
CVE-2025-0432 HMS Networks Ewon Flexy 202 Cleartext Transmission of Sensitive Information
EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: HMS Networks
product: Ewon Flexy 202
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Khalid Markar, Parul Sindhwad and Dr. Faruk Kazi from CoE-CNDS Lab, VJTI, Mumbai, India reported this vulnerability to CISA
Published: 2025-01-28T15:56:10.373Z
CVE-2025-0433 Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: litonice13
product: Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Matthew Rollings
Published: 2025-03-04T08:23:42.853Z
CVE-2025-0434 
Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Out of bounds memory access
Affected products: vendor: Google
product: Chrome
Published: 2025-01-15T10:58:51.905Z
CVE-2025-0435 
Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2025-01-15T10:58:52.176Z