rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-41108 Improper Authentication vulnerability in Ghost Robotics' Vision 60
The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station (tablet) and gaining unauthorised full control of the robot. The absence of encryption and authentication mechanisms in the communication protocol allows an attacker to capture legitimate traffic between the robot and the controller, replicate it, and send any valid command to the robot from any attacking computer or device. The communication protocol used in this interface is based on MAVLink, a widely documented protocol, which increases the likelihood of attack. There are two methods for connecting to the robot remotely: Wi-Fi and 4G/LTE.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Ghost Robotics
product: Vision 60
default_status: unaffected
Credits: lang: en
value: Adrián Campazas Vega
lang: en
value: Claudia Álvarez Aparicio
lang: en
value: Pedro Cabrera Cámara
lang: en
value: Miguel Gallego Vara
lang: en
value: Javier Valero Martí
Published: 2025-10-22T08:14:54.009Z
CVE-2025-41109 Use of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60
Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port. The vulnerability is due to the lack of authentication mechanisms when establishing connections through these ports. Specifically, with regard to network connectivity, the robot's internal router automatically assigns IP addresses to any device physically connected to it. An attacker could connect a WiFi access point under their control to gain access to the robot's network without needing the credentials for the deployed network. Once inside, the attacker can monitor all its data, as the robot runs on ROS 2 without authentication by default.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Ghost Robotics
product: Vision 60
default_status: unaffected
Credits: lang: en
value: Adrián Campazas Vega
lang: en
value: Claudia Álvarez Aparicio
Published: 2025-10-22T08:15:42.407Z
CVE-2025-41110 Improper Authentication vulnerability in Ghost Robotics' Vision 60
Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi and view all its data, as it runs on ROS 2 without default authentication. In addition, the attacker can connect via SSH and gain full control of the robot, which could cause physical damage to the robot itself or its environment.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Ghost Robotics
product: Vision 60
default_status: unaffected
Credits: lang: en
value: Adrián Campazas Vega
lang: en
value: Claudia Álvarez Aparicio
Published: 2025-10-22T08:16:24.193Z
CVE-2025-41111 Missing Authorization vulnerability in CanalDenuncia.app
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_denuncia' in '/backend/api/buscarComentariosByDenuncia.php'.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: CanalDenuncia
product: CanalDenuncia.app
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-11-04T13:08:40.472Z
CVE-2025-41112 Missing Authorization vulnerability in CanalDenuncia.app
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarConfiguracionParametros2.php'.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: CanalDenuncia
product: CanalDenuncia.app
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-11-04T13:09:53.897Z
CVE-2025-41113 Missing Authorization vulnerability in CanalDenuncia.app
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_denuncia' in '/backend/api/buscarDenunciaByPin.php'.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: CanalDenuncia
product: CanalDenuncia.app
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-11-04T13:10:12.086Z
CVE-2025-41114 Missing Authorization vulnerability in CanalDenuncia.app
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'id_user' in '/backend/api/buscarDocumentosByIdDenunciaUsuario.php'.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: CanalDenuncia
product: CanalDenuncia.app
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-11-04T13:10:31.829Z
CVE-2025-41115 Incorrect privilege assignment
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.

In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.

This vulnerability applies only if all of the following conditions are met:
- `enableSCIM` feature flag set to true
- `user_sync_enabled` config option in the `[auth.scim]` block set to true
Affected products: vendor: Grafana
product: Grafana Enterprise
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 10
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-11-21T14:25:38.945Z
CVE-2025-41116 Incorrect oauth passthrough in Grafana Databricks Datasource
When using the Grafana Databricks Datasource Plugin,
if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it  could result in 

the wrong user identifier being used, and information for which the viewer is not authorized being returned. 

This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0
Problem types: cwe_id: CWE-653
description: CWE-653
Affected products: vendor: Grafana Labs
product: Grafana Databricks Datasource Plugin
default_status: unaffected
Published: 2025-11-11T20:18:07.602Z
CVE-2025-41117 XSS in Grafana Explore stack trace
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.

Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
Affected products: vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: 2026-02-12T08:49:08.545Z
CVE-2025-41118 Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS).

If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API.

To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We highly recommend limiting the public internet exposure of all our databases, such that they are only accessible by trusted users or internal systems.

This vulnerability is fixed in versions:

1.15.x: 1.15.2 and above.
1.16.x: 1.16.1 and above.
1.17.x: 1.17.0 and above (i.e. all versions).

Thanks to Théo Cusnir for reporting this vulnerability to us via our bug bounty program.
Affected products: vendor: Grafana
product: Pyroscope
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9.1
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2026-04-15T19:15:17.689Z
CVE-2025-41225 VMware vCenter Server authenticated command-execution vulnerability
The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: VMware
product: vCenter Server
default_status: unaffected
vendor: VMware
product: Cloud Foundation
default_status: unaffected
vendor: VMware
product: Telco Cloud Platform
default_status: unaffected
vendor: VMware
product: Telco Cloud Infrastructure
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-05-20T14:24:17.487Z
CVE-2025-41226 Guest Operations Denial-of-Service Vulnerability
VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a VM, who is already authenticated through vCenter Server or ESXi may trigger this issue to create a denial-of-service condition of guest VMs with VMware Tools running and guest operations enabled.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: VMware
product: ESXi
default_status: unaffected
vendor: VMware
product: Cloud Foundation
default_status: unaffected
vendor: VMware
product: Telco Cloud Platform
default_status: unaffected
vendor: VMware
product: Telco Cloud Infrastructure
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2025-05-20T14:24:24.680Z
CVE-2025-41227 Denial-of-Service Vulnerability
VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the host process leading to a denial-of-service condition.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: VMware
product: ESXi
default_status: unaffected
vendor: VMware
product: Cloud Foundation
default_status: unaffected
vendor: VMware
product: Telco Cloud Platform
default_status: unaffected
vendor: VMware
product: Telco Cloud Infrastructure
default_status: unaffected
vendor: VMware
product: Workstation
default_status: unaffected
vendor: VMware
product: Fusion
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-05-20T14:24:29.316Z
CVE-2025-41228 VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: VMware
product: vCenter Server
default_status: unaffected
vendor: VMware
product: Cloud Foundation
default_status: unaffected
vendor: VMware
product: Telco Cloud Platform
default_status: unaffected
vendor: VMware
product: Telco Cloud Infrastructure
default_status: unaffected
vendor: VMware
product: ESXi
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-05-20T14:24:34.436Z
CVE-2025-41229 VMware Cloud Foundation Directory Traversal Vulnerability
VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: VMware
product: Cloud Foundation
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2025-05-20T12:53:57.430Z
CVE-2025-41230 VMware Cloud Foundation Information Disclosure Vulnerability
VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to gain access to sensitive information.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: VMware
product: Cloud Foundation
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-05-20T12:54:30.145Z
CVE-2025-41231 VMware Cloud Foundation Missing Authorisation Vulnerability
VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive information.
Problem types: description: Missing Authorisation
Affected products: vendor: n/a
product: VMware Cloud Foundation
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Published: 2025-05-20T12:54:41.570Z
CVE-2025-41232 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.

Your application may be affected by this if the following are true:

  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
  *  You have Spring Security method annotations on a private method
In that case, the target method may be able to be invoked without proper authorization.

You are not affected if:

  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
  *  You have no Spring Security-annotated private methods
Affected products: vendor: Spring
product: Spring Security
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-05-21T10:23:07.078Z
CVE-2025-41234 RFD Attack via “Content-Disposition” Header Sourced from Request
Description

In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input.

Specifically, an application is vulnerable when all the following are true:

  *  The header is prepared with org.springframework.http.ContentDisposition.
  *  The filename is set via ContentDisposition.Builder#filename(String, Charset).
  *  The value for the filename is derived from user-supplied input.
  *  The application does not sanitize the user-supplied input.
  *  The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details).


An application is not vulnerable if any of the following is true:

  *  The application does not set a “Content-Disposition” response header.
  *  The header is not prepared with org.springframework.http.ContentDisposition.
  *  The filename is set via one of:  *  ContentDisposition.Builder#filename(String), or
  *  ContentDisposition.Builder#filename(String, ASCII)



  *  The filename is not derived from user-supplied input.
  *  The filename is derived from user-supplied input but sanitized by the application.
  *  The attacker cannot inject malicious content in the downloaded content of the response.


Affected Spring Products and VersionsSpring Framework:

  *  6.2.0 - 6.2.7
  *  6.1.0 - 6.1.20
  *  6.0.5 - 6.0.28
  *  Older, unsupported versions are not affected


MitigationUsers of affected versions should upgrade to the corresponding fixed version.

Affected version(s)Fix versionAvailability6.2.x6.2.8OSS6.1.x6.1.21OSS6.0.x6.0.29 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary.


CWE-113 in `Content-Disposition` handling in VMware Spring Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks via unsanitized user input in `ContentDisposition.Builder#filename(String, Charset)` with non-ASCII charsets.
Problem types: cwe_id: CWE-113
description: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Affected products: vendor: VMware
product: Spring Framework
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
version: 3.1
Published: 2025-06-12T21:14:42.957Z
CVE-2025-41235 CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
Affected products: vendor: VMware
product: Spring cloud Gateway
default_status: affected
vendor: VMware
product: Spring Cloud Gateway Server MVC
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Published: 2025-05-30T05:57:16.411Z
CVE-2025-41236 VMXNET3 integer-overflow vulnerability
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: VMware
product: ESXi
default_status: unaffected
vendor: VMware
product: Cloud Foundation
default_status: unaffected
vendor: VMware
product: Workstation
default_status: unaffected
vendor: VMware
product: Fusion
default_status: unaffected
vendor: VMware
product: Telco Cloud Platform
default_status: unaffected
vendor: VMware
product: Telco Cloud Infrastructure
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-07-15T18:34:12.719Z
CVE-2025-41237 VMCI integer-underflow vulnerability
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: VMware
product: Cloud Foundation
default_status: unaffected
vendor: VMware
product: vSphere Foundation
default_status: unaffected
vendor: VMware
product: ESXi
default_status: unaffected
vendor: VMware
product: Workstation
default_status: unaffected
vendor: VMware
product: Fusion
default_status: unaffected
vendor: VMware
product: Telco Cloud Platform
default_status: unaffected
vendor: VMware
product: Telco Cloud Infrastructure
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-07-15T18:34:21.083Z