rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-31644 Appliance mode BIG-IP iControl REST and tmsh vulnerability
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: F5 acknowledges Matei "Mal" Badanoiu @ Deloitte for bringing this issue to our attention and following the highest standards of coordinated disclosure.
Published: 2025-05-07T22:04:10.938Z
CVE-2025-31645 
Uncontrolled search path for some System Event Log Viewer Utility software for all versions within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: System Event Log Viewer Utility software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-11-11T16:50:44.422Z
CVE-2025-31647 
Uncontrolled search path for some Intel(R) Graphics Software before version 25.22.1502.2 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: Intel(R) Graphics Software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-11-11T16:50:46.422Z
CVE-2025-31648 
Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (low) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-229
description: Improper Handling of Values
Affected products: vendor: n/a
product: Intel(R) Processor Family may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (low) and availability (none) impacts.
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.9
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
Published: 2026-02-10T16:25:36.350Z
CVE-2025-31649 Dell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerability
A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call to trigger this vulnerability.
Problem types: cwe_id: CWE-908
description: CWE-908 Use of Uninitialized Resource
Affected products: vendor: Broadcom
product: BCM5820X
default_status: unaffected
vendor: Dell
product: ControlVault3
default_status: unaffected
vendor: Dell
product: ControlVault3 Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Discovered by Philippe Laulheret of Cisco Talos.
Published: 2025-11-17T22:55:15.912Z
CVE-2025-31650 Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.90 though 8.5.100.


Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
Problem types: cwe_id: CWE-459
description: CWE-459 Incomplete Cleanup
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Published: 2025-04-28T19:14:31.107Z
CVE-2025-31651 Apache Tomcat: Bypass of rules in Rewrite Valve
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible 
for a specially crafted request to bypass some rewrite rules. If those 
rewrite rules effectively enforced security constraints, those 
constraints could be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Problem types: cwe_id: CWE-116
description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: COSCO Shipping Lines DIC
Published: 2025-04-28T19:17:21.721Z
CVE-2025-31654 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Growatt
product: Cloud portal
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Forescout Technologies reported these vulnerabilities to CISA.
Published: 2025-04-15T21:07:32.609Z
CVE-2025-31655 
Incorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: n/a
product: Intel(R) Battery Life Diagnostic Tool
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2026-02-10T16:25:37.949Z
CVE-2025-31672 Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names
Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry.
This issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file.
Users are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read  https://poi.apache.org/security.html  for recommendations about how to use the POI libraries securely.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache POI
default_status: unaffected
Published: 2025-04-09T11:59:33.900Z
CVE-2025-31673 Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002
Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Drupal core
default_status: unaffected
Credits: lang: en
value: jeff cardwell
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: jeff cardwell
lang: en
value: Mingsong  (mingsong)
lang: en
value: Juraj Nemec (poker10)
Published: 2025-03-31T21:34:16.118Z
CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
Problem types: cwe_id: CWE-915
description: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products: vendor: Drupal
product: Drupal core
default_status: unaffected
Credits: lang: en
value: anzuukino
lang: en
value: shin24
lang: en
value: ghost of drupal past
lang: en
value: Dave Long (longwave)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: nicxvan
lang: en
value: shin24
Published: 2025-03-31T21:34:53.144Z
CVE-2025-31675 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Drupal core
default_status: unaffected
vendor: Drupal
product: Link
default_status: unaffected
Credits: lang: en
value: Samuel Mortenson (samuel.mortenson)
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: Bram Driesen (bramdriesen)
lang: en
value: Alex Bronstein (effulgentsia)
lang: en
value: Jen Lampton (jenlampton)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Dave Long (longwave)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Joseph Zhao (pandaski)
lang: en
value: Adam G-H (phenaproxima)
lang: en
value: Samuel Mortenson (samuel.mortenson)
lang: en
value: Jess  (xjm)
Published: 2025-03-31T21:35:20.059Z
CVE-2025-31676 Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001
Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.
Problem types: cwe_id: CWE-1390
description: CWE-1390 Weak Authentication
Affected products: vendor: Drupal
product: Email TFA
default_status: unaffected
Credits: lang: en
value: Ursin Cola
lang: en
value: Ursin Cola
lang: en
value: abdulaziz zaid
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-03-31T21:36:58.560Z
CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003
Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: AI (Artificial Intelligence)
default_status: unaffected
Credits: lang: en
value: Marcus Johansson
lang: en
value: Marcus Johansson
lang: en
value: Michal Gow
lang: en
value: Kevin Quillen
lang: en
value: Andrew Belcher
lang: en
value: Greg Knaddison
lang: en
value: Drew Webber
lang: en
value: Juraj Nemec
Published: 2025-03-31T21:37:27.837Z
CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Drupal
product: AI (Artificial Intelligence)
default_status: unaffected
Credits: lang: en
value: Mingsong
lang: en
value: Scott Euser
lang: en
value: Marcus Johansson
lang: en
value: Andrew Belcher
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: Dave Long
Published: 2025-03-31T21:38:07.302Z
CVE-2025-31679 Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Ignition Error Pages
default_status: unaffected
Credits: lang: en
value: Dieter Holvoet
lang: en
value: catch
lang: en
value: Dieter Holvoet
lang: en
value: Heine Deelstra
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
lang: en
value: James Gilliland
Published: 2025-03-31T21:38:50.510Z
CVE-2025-31680 Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Matomo Analytics
default_status: unaffected
Credits: lang: en
value: Ivo  Van Geertruyen
lang: en
value: Ivo  Van Geertruyen
lang: en
value: Florent Torregrosa
lang: en
value: Ivo  Van Geertruyen
Published: 2025-03-31T21:39:31.274Z
CVE-2025-31681 Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Drupal
product: Authenticator Login
default_status: unaffected
Credits: lang: en
value: Ahmed Raza
lang: en
value: Ahmed Raza
lang: en
value: Damien McKenna
lang: en
value: Ivo  Van Geertruyen
lang: en
value: Juraj Nemec
Published: 2025-03-31T21:39:50.247Z
CVE-2025-31682 Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: Google Tag
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Jakob P
lang: en
value: Jim Berry
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-03-31T21:40:33.099Z
CVE-2025-31683 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Google Tag
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff
lang: en
value: Florent Torregrosa
lang: en
value: Jim Berry
lang: en
value: Jakob P
lang: en
value: Greg Knaddison
lang: en
value: Juraj Nemec
Published: 2025-03-31T21:41:01.996Z
CVE-2025-31684 OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013
Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: OAuth2 Client
default_status: unaffected
Credits: lang: en
value: Tobias Bähr
lang: en
value: Shawn Duncan
lang: en
value: Tobias Bähr
lang: en
value: cilefen
lang: en
value: Greg Knaddison
Published: 2025-03-31T21:43:06.076Z
CVE-2025-31685 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Drupal
product: Open Social
default_status: unaffected
Credits: lang: en
value: Robert Ragas (robertragas)
lang: en
value: zanvidmar
lang: en
value: Denis Kolmerschlag (uber_denis)
lang: en
value: zanvidmar
lang: en
value: Greg Knaddison (greggles)
Published: 2025-03-31T21:43:27.662Z
CVE-2025-31686 Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Drupal
product: Open Social
default_status: unaffected
Credits: lang: en
value: Robert Ragas (robertragas)
lang: en
value: zanvidmar
lang: en
value: Denis Kolmerschlag (uber_denis)
lang: en
value: zanvidmar
lang: en
value: Greg Knaddison (greggles)
Published: 2025-03-31T21:44:08.763Z
CVE-2025-31687 SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Drupal
product: SpamSpan filter
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: Julian Pustkuchen (anybody)
lang: en
value: Joshua Sedler (grevil)
lang: en
value: Adam Nagy (joevagyok)
lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: Greg Knaddison (greggles)
Published: 2025-03-31T21:44:50.483Z
CVE-2025-31688 Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Configuration Split
default_status: unaffected
Credits: lang: en
value: Eric Smith (ericgsmith)
lang: en
value: Fabian Bircher (bircher)
lang: en
value: Greg Knaddison (greggles)
Published: 2025-03-31T21:45:16.458Z
CVE-2025-31689 General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018
Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: General Data Protection Regulation
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: Peter PÃ³nya (pedrop)
lang: en
value: szato
lang: en
value: Greg Knaddison (greggles)
Published: 2025-03-31T21:45:37.759Z