rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-22144 Account Takeover in NamelessMC
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by email the reset code is NULL, but when the account is manually validated by a user with admincp.core.emails or admincp.users.edit permissions then the reset_code will no longer be NULL but empty. An attacker can request http://localhost/nameless/index.php?route=/forgot_password/&c= and reset the password. As a result an attacker may compromise another users password and take over their account. This issue has been addressed in release version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-610
description: CWE-610: Externally Controlled Reference to a Resource in Another Sphere
Affected products: vendor: NamelessMC
product: Nameless
Published: 2025-01-13T19:49:03.887Z
CVE-2025-22145 Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.
Problem types: cwe_id: CWE-98
description: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: CarbonPHP
product: carbon
Published: 2025-01-08T20:40:37.545Z
CVE-2025-22146 Improper authentication on SAML SSO process allows user impersonation in sentry
Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. The Sentry SaaS fix was deployed on Jan 14, 2025. For self hosted users; if only a single organization is allowed `(SENTRY_SINGLE_ORGANIZATION = True)`, then no action is needed. Otherwise, users should upgrade to version 25.1.0 or higher. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: getsentry
product: sentry
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-01-15T19:57:59.734Z
CVE-2025-22149 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh
JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal from a JWK Set is equivalent to revocation. The affected auto-caching HTTP client was added in version v0.5.0 and fixed in v0.6.0. The only workaround would be to remove the provided auto-caching HTTP client and replace it with a custom implementation. This involves setting the HTTPClientStorageOptions.RefreshInterval to zero (or not specifying the value).
Problem types: cwe_id: CWE-672
description: CWE-672: Operation on a Resource after Expiration or Release
Affected products: vendor: MicahParks
product: jwkset
Published: 2025-01-09T17:22:59.757Z
CVE-2025-22150 Undici Uses Insufficiently Random Values
Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
Problem types: cwe_id: CWE-330
description: CWE-330: Use of Insufficiently Random Values
Affected products: vendor: nodejs
product: undici
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-01-21T17:46:58.872Z
CVE-2025-22151 Strawberry GraphQL has a type resolution vulnerability
Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node interface. When querying for a specific type using the global node field (e.g., FruitType:some-id), the resolver may incorrectly return an instance of a different type mapped to the same model (e.g., SpecialFruitType). This can lead to information disclosure if the alternate type exposes sensitive fields and potential privilege escalation if the alternate type contains data intended for restricted access. This vulnerability is fixed in 0.257.0.
Problem types: cwe_id: CWE-843
description: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: strawberry-graphql
product: strawberry
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-09T18:51:18.221Z
CVE-2025-22152 Improper Path Validation Enables Path Traversal in Multiple Components in Atheos
Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack vectors present in multiple PHP files. This vulnerability is fixed in v600.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Atheos
product: Atheos
Published: 2025-01-10T15:23:16.919Z
CVE-2025-22153 try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.
Problem types: cwe_id: CWE-843
description: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: zopefoundation
product: RestrictedPython
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L
version: 3.1
Published: 2025-01-23T17:34:27.056Z
CVE-2025-22157 
This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions:

9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server

5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server

This PrivEsc (Privilege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged user. 

Atlassian recommends that Jira Core Data Center and Server and Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

Jira Core Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.20

Jira Service Management Data Center and Server 5.12: Upgrade to a release greater than or equal to 5.12.20

Jira Core Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5

Jira Service Management Data Center 10.3: Upgrade to a release greater than or equal to 10.3.5

Jira Core Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0

Jira Service Management Data Center 10.4: Upgrade to a release greater than or equal to 10.6.0

Jira Core Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1

Jira Service Management Data Center 10.5: Upgrade to a release greater than or equal to 10.5.1

See the release notes. You can download the latest version of Jira Core Data Center and Jira Service Management Data Center from the download center. 

This vulnerability was reported via our Atlassian (Internal) program.
Problem types: description: PrivEsc (Privilege Escalation)
Affected products: vendor: Atlassian
product: Jira Core Data Center
vendor: Atlassian
product: Jira Core Server
vendor: Atlassian
product: Jira Service Management Data Center
vendor: Atlassian
product: Jira Service Management Server
Credits: lang: en
value: Internal (Atlassian)
Published: 2025-05-20T18:00:01.328Z
CVE-2025-22165 
This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac.

This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. 

Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://www.sourcetreeapp.com/download-archives .

You can download the latest version of Sourcetree for Mac from the download center https://www.sourcetreeapp.com/download-archives .

This vulnerability was found through the Atlassian Bug Bounty Program by Karol Mazurek (AFINE).
Problem types: description: Security Misconfiguration
Affected products: vendor: Atlassian
product: Sourcetree for Mac
Credits: lang: en
value: Karol Mazurek (AFINE)
Published: 2025-07-24T22:30:00.776Z
CVE-2025-22166 
This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.

This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
 Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25
 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7
 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Atlassian (Internal) program.
Problem types: description: DoS (Denial of Service)
Affected products: vendor: Atlassian
product: Confluence Data Center
Published: 2025-10-21T16:00:05.978Z
CVE-2025-22167 
This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by the Jira JVM process. Atlassian recommends that Jira Software Data Center and Server customers upgrade to the latest version; if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
 Jira Software Data Center and Server 9.12: Upgrade to a release greater than or equal to 9.12.28
 Jira Software Data Center and Server 10.3: Upgrade to a release greater than or equal to 10.3.12
 Jira Software Data Center and Server 11.0: Upgrade to a release greater than or equal to 11.1.0

See the release notes. You can download the latest version of Jira Software Data Center and Server from the download center. This vulnerability was reported via our Atlassian (Internal) program.
Problem types: description: Path Traversal (Arbitrary Read/Write)
Affected products: vendor: Atlassian
product: Jira Software Data Center
vendor: Atlassian
product: Jira Software Server
Published: 2025-10-22T01:00:06.278Z
CVE-2025-22168 
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user's private checklist.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:00.663Z
CVE-2025-22169 
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:04.452Z
CVE-2025-22170 
Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:04.355Z
CVE-2025-22171 
Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:01.353Z
CVE-2025-22172 
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read external reports without the required permission.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:03.984Z
CVE-2025-22173 
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without the required permission.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:04.376Z
CVE-2025-22174 
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the required permission.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:04.050Z
CVE-2025-22175 
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:00.592Z
CVE-2025-22176 
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view audit log items.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:02.956Z
CVE-2025-22177 
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:00.632Z
CVE-2025-22178 
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the "Why" page.
Problem types: description: Improper Authorization
Affected products: vendor: Atlassian
product: Jira Align
Credits: lang: en
value: Frank Lycops, NATO Cyber Security Centre
Published: 2025-10-22T16:30:04.731Z
CVE-2025-22204 Extension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions < 12.0.0 for Joomla
Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code
Affected products: vendor: regularlabs.com
product: Sourcerer for Joomla
default_status: unaffected
Credits: lang: en
value: akaoma.com
Published: 2025-02-04T07:20:46.052Z
CVE-2025-22205 Extension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for Joomla
Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.
Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal
Affected products: vendor: www.admiror-design-studio.com
product: Admiror Gallery component for Joomla
default_status: unaffected
Credits: lang: en
value: Kruczek Robert, www.safety-online.pl
Published: 2025-02-04T07:21:28.335Z
CVE-2025-22206 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.2 for Joomla
A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: joomsky.com
product: JS Jobs component for Joomla
default_status: unaffected
Credits: lang: en
value: Adam Wallwork
Published: 2025-02-04T14:20:48.002Z
CVE-2025-22207 [20250201] - Core - SQL injection vulnerability in Scheduled Tasks component
Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Calum Hutton, snyk.io
Published: 2025-02-18T16:03:29.639Z
CVE-2025-22208 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla
A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: joomsky.com
product: JS Jobs component for Joomla
default_status: unaffected
Credits: lang: en
value: Adam Wallwork
Published: 2025-02-15T08:10:59.715Z
CVE-2025-22209 Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.3 for Joomla
A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: joomsky.com
product: JS Jobs component for Joomla
default_status: unaffected
Credits: lang: en
value: Adam Wallwork
Published: 2025-02-15T08:10:58.539Z
CVE-2025-22210 Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla
A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: hikashop.com
product: Hikashop component for Joomla
default_status: unaffected
Credits: lang: en
value: Adam Wallwork
Published: 2025-02-25T05:16:48.342Z
CVE-2025-22211 Extension - webdesigner-profi.de - SQL injection in JoomShopping component version 1.0.0 - 5.5.5 for Joomla
A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the country management area in backend.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: webdesigner-profi.de
product: JoomShopping component for Joomla
default_status: unaffected
Credits: lang: en
value: Adam Wallwork
Published: 2025-02-25T21:29:22.929Z