rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-21598 Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crash
An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd.
This issue affects:

Junos OS: 



  *  from 21.2R3-S8 before 21.2R3-S9, 
  *  from 21.4R3-S7 before 21.4R3-S9, 
  *  from 22.2R3-S4 before 22.2R3-S5, 
  *  from 22.3R3-S2 before 22.3R3-S4, 
  *  from 22.4R3 before 22.4R3-S5, 
  *  from 23.2R2 before 23.2R2-S2, 
  *  from 23.4R1 before 23.4R2-S1, 
  *  from 24.2R1 before 24.2R1-S1, 24.2R2.


Junos OS Evolved:
  *  from 21.4R3-S7-EVO before 21.4R3-S9-EVO, 
  *  from 22.2R3-S4-EVO before 22.2R3-S5-EVO, 
  *  from 22.3R3-S2-EVO before 22.3R3-S4-EVO, 
  *  from 22.4R3-EVO before 22.4R3-S5-EVO, 
  *  from 23.2R2-EVO before 23.2R2-S2-EVO, 
  *  from 23.4R1-EVO before 23.4R2-S1-EVO, 
  *  from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.


This issue requires a BGP session to be established.

This issue can propagate and multiply through multiple ASes until reaching vulnerable devices.

This issue affects iBGP and eBGP.

This issue affects IPv4 and IPv6.

An indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:

For example, by issuing the command on the neighboring device:
 show log messages

Reviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:
  rpd[<pid>]: Received malformed update from <IP address> (External AS <AS#>)
and
  rpd[<pid>]: Malformed Attribute
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
description: Denial of Service (DoS)
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-01-09T18:16:32.549Z
CVE-2025-21599 Junos OS Evolved: Receipt of specifically malformed IPv6 packets causes kernel memory exhaustion leading to Denial of Service
A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Tunnel Driver (jtd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause Denial of Service. 

Receipt of specifically malformed IPv6 packets, destined to the device, causes kernel memory to not be freed, resulting in memory exhaustion leading to a system crash and Denial of Service (DoS). Continuous receipt and processing of these packets will continue to exhaust kernel memory, creating a sustained Denial of Service (DoS) condition.
This issue only affects systems configured with IPv6.

This issue affects Junos OS Evolved: 



  *  from 22.4-EVO before 22.4R3-S5-EVO, 
  *  from 23.2-EVO before 23.2R2-S2-EVO, 
  *  from 23.4-EVO before 23.4R2-S2-EVO, 
  *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.




This issue does not affect Juniper Networks Junos OS Evolved versions prior to 22.4R1-EVO.
Problem types: cwe_id: CWE-401
description: CWE-401 Missing Release of Memory after Effective Lifetime
Affected products: vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-01-09T16:46:57.412Z
CVE-2025-21600 Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash
An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of 

 Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.



This issue only affects systems configured in
      either of two ways:

    
    
        *  systems with BGP traceoptions enabled

        *  systems with BGP family traffic-engineering (BGP-LS)
          configured


 and can be exploited from a directly connected and configured BGP peer. 

This issue affects iBGP and eBGP 

with 

any address family

 configured, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS: 



  *  

from 21.4 before 21.4R3-S9, 
  *  from 22.2 before 22.2R3-S5, 
  *  from 22.3 before 22.3R3-S4, 
  *  from 22.4 before 22.4R3-S5, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S3, 
  *  from 24.2 before 24.2R1-S2, 24.2R2; 




Junos OS Evolved: 



  *  from 21.4-EVO before 21.4R3-S9-EVO, 
  *  from 22.2-EVO before 22.2R3-S5-EVO, 
  *  from 22.3-EVO before 22.3R3-S4-EVO, 
  *  from 22.4-EVO before 22.4R3-S5-EVO, 
  *  from 23.2-EVO before 23.2R2-S3-EVO, 
  *  from 23.4-EVO before 23.4R2-S2-EVO, 
  *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.


This issue does not affect versions of Junos OS prior to 21.3R1.


This issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.



This is a similar, but different vulnerability than the issue reported as CVE-2024-39516.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Juniper SIRT would like to acknowledge and thank Craig Dods from Meta’s Infrastructure Security Engineering team for responsibly reporting this vulnerability.
Published: 2025-01-09T16:49:42.367Z
CVE-2025-21601 Junos OS: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is enabled for specific services an attacker may cause a CPU spike by sending genuine packets to the device
An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper Networks Junos OS on SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series, allows an unauthenticated, network-based attacker, sending genuine traffic targeted to the device to cause the CPU to climb until the device becomes unresponsive. 

Continuous receipt of these packets will create a sustained Denial of Service (DoS) condition.




This issue affects Junos OS: 



  *  All versions before 21.4R3-S9,
  *  from 22.2 before 22.2R3-S5,
  *  from 22.4 before 22.4R3-S4,
  *  from 23.2 before 23.2R2-S3,
  *  from 23.4 before 23.4R2-S3,
  *  from 24.2 before 24.2R1-S1, 24.2R2.


An indicator of compromise is to review the CPU % of the httpd process in the CLI:
e.g.
  show system processes extensive | match httpd  PID nobody       52    0    20M    191M select   2   0:01   80.00% httpd{httpd} <<<<< the percentage of httpd usage if high may be an indicator
Problem types: description: 573 - Improper Following of Specification by Caller
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Alexander Zielke with VegaSystems GmbH & Co. KG
Published: 2025-04-09T19:51:36.325Z
CVE-2025-21602 Junos OS and Junos OS Evolved: Receipt of specially crafted BGP update packet causes RPD crash
An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a specific BGP update packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). 

Continuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects Junos OS: 



  *  from 21.4 before 21.4R3-S9, 
  *  from 22.2 before 22.2R3-S5, 
  *  from 22.3 before 22.3R3-S4,
  *  from 22.4 before 22.4R3-S5, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S3, 
  *  from 24.2 before 24.2R1-S2, 24.2R2; 


This issue does not affect versions prior to 21.1R1.





Junos OS Evolved: 



  *  from 21.4 before 21.4R3-S9-EVO, 
  *  from 22.2 before 22.2R3-S5-EVO, 
  *  from 22.3 before 22.3R3-S4-EVO,
  *  from 22.4 before 22.4R3-S5-EVO, 
  *  from 23.2 before 23.2R2-S3-EVO, 
  *  from 23.4 before 23.4R2-S3-EVO, 
  *  from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO.


This issue does not affect versions prior to 21.1R1-EVO
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Juniper SIRT would like to acknowledge and thank Craig Dods from Meta’s Infrastructure Security Engineering team for responsibly reporting this vulnerability.
Published: 2025-01-09T16:49:25.387Z
CVE-2025-21603 
Cross-site scripting vulnerability exists in MZK-DP300N firmware versions 1.05 and earlier. If an attacker logs in to the affected product and manipulates the device settings, an arbitrary script may be executed on the logged-in user's web browser when accessing a crafted URL.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: PLANEX COMMUNICATIONS INC.
product: MZK-DP300N
Published: 2025-01-08T03:30:50.390Z
CVE-2025-21604 LangChain4j-AIDeepin Using MD5 to Hash files may cause file upload conflicts
LangChain4j-AIDeepin is a Retrieval enhancement generation (RAG) project. Prior to 3.5.0, LangChain4j-AIDeepin uses MD5 to hash files, which may cause file upload conflicts. This issue is fixed in 3.5.0.
Problem types: cwe_id: CWE-328
description: CWE-328: Use of Weak Hash
Affected products: vendor: moyangzhan
product: langchain4j-aideepin
Published: 2025-01-06T15:34:54.794Z
CVE-2025-21605 Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client
Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system will run out of memory. This issue has been patched in version 7.4.3. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways. Either using network access control tools like firewalls, iptables, security groups, etc, or enabling TLS and requiring users to authenticate using client side certificates.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: redis
product: redis
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-04-23T15:38:11.042Z
CVE-2025-21606 Local Privilege Escalation via Exposed XPC Method Due to Client Verification Failure in stats
stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name `eu.exelban.Stats.SMC.Helper`. The associated binary, eu.exelban.Stats.SMC.Helper, is a privileged helper tool designed to execute actions requiring elevated privileges on behalf of the client, such as setting fan modes, adjusting fan speeds, and executing the `powermetrics` command. The root cause of this vulnerability lies in the `shouldAcceptNewConnection` method, which unconditionally returns YES (or true), allowing any XPC client to connect to the service without any form of verification. As a result, unauthorized clients can establish a connection to the Mach service and invoke methods exposed by the HelperTool interface. An attacker can exploit this vulnerability to modify the hardware settings of the user’s device and execute arbitrary code with root privileges. This issue has been addressed in version 2.11.21 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: exelban
product: stats
Published: 2025-01-17T20:10:05.277Z
CVE-2025-21607 Success of Certain Precompile Calls not Checked in Vyper
Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. None the less an advisory has been made out of an abundance of caution. This issue is fixed in 0.4.1.
Problem types: cwe_id: CWE-670
description: CWE-670: Always-Incorrect Control Flow Implementation
Affected products: vendor: vyperlang
product: vyper
Published: 2025-01-14T17:32:58.169Z
CVE-2025-21608 Forged packets over MQTT can show up in direct messages in Meshtastic firmware
Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able to appear as a DM in client to a node even though they were not decoded with PKC. This issue has been addressed in version 2.5.19 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-668
description: CWE-668: Exposure of Resource to Wrong Sphere
Affected products: vendor: meshtastic
product: firmware
Published: 2025-02-18T18:17:28.752Z
CVE-2025-21609 SiYuan has an arbitrary file deletion vulnerability
SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.
Problem types: cwe_id: CWE-459
description: CWE-459: Incomplete Cleanup
cwe_id: CWE-552
description: CWE-552: Files or Directories Accessible to External Parties
Affected products: vendor: siyuan-note
product: siyuan
Published: 2025-01-03T16:26:36.420Z
CVE-2025-21610 Trix allows Cross-site Scripting via `javascript:` url in a link
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious `javascript:` URL as a link that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. Users should upgrade to Trix editor version 2.1.12 or later to receive a patch. In addition to upgrading, affected users can disallow browsers that don't support a Content Security Policy (CSP) as a workaround for this and other cross-site scripting vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: basecamp
product: trix
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-01-03T16:29:54.939Z
CVE-2025-21611 tgstation-server's role authorization incorrectly OR'd with user's enabled status
tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions regardless of their permissions. Notably, the WriteUsers right is unaffected so users may not use this bug to permanently elevate their account permissions. The fix is release in tgstation-server-v6.12.3.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: tgstation
product: tgstation-server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-01-06T15:38:20.174Z
CVE-2025-21612 Cross-site Scripting in TabberTransclude in Extension:TabberNeue
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: StarCitizenTools
product: mediawiki-extensions-TabberNeue
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Published: 2025-01-06T15:47:27.214Z
CVE-2025-21613 go-git has an Argument Injection via the URL field
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.
Problem types: cwe_id: CWE-88
description: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: go-git
product: go-git
Published: 2025-01-06T16:13:10.611Z
CVE-2025-21614 go-git clients vulnerable to DoS via maliciously crafted Git server replies
go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: go-git
product: go-git
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-01-06T16:20:16.140Z
CVE-2025-21615 AAT allows data exfiltration by other apps installed on the same device
AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: bailuk
product: AAT
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-01-06T16:25:27.758Z
CVE-2025-21616 Plane has a Cross-site scripting (XSS) via SVG image upload
Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: makeplane
product: plane
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-01-06T21:22:24.129Z