rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. The `dynamic_analysis.html` file does not sanitize the received bundle value from Corellium and as a result, it is possible to break the HTML context and achieve Stored XSS. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MobSF
product: Mobile-Security-Framework-MobSF
Published: 2025-02-05T18:41:30.040Z
CVE-2025-24804 Partial Denial of Service (DoS) in MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. When the application parses the wrong characters in the bundle ID, it encounters an error. As a result, it will not display content and will throw a 500 error instead. The only way to make the pages work again is to manually remove the malicious application from the system. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-1287
description: CWE-1287: Improper Validation of Specified Type of Input
Affected products: vendor: MobSF
product: Mobile-Security-Framework-MobSF
Published: 2025-02-05T18:41:15.873Z
CVE-2025-24805 Local Privilege Escalation in MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: MobSF
product: Mobile-Security-Framework-MobSF
Published: 2025-02-05T18:41:02.991Z
CVE-2025-24806 Regulation applies separately to Username-based logins to Email-based logins in authelia
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's important to note that due to the effective operation of regulation where no user-facing sign of their regulation ban being visible either via timing or via API responses, it's effectively impossible to determine if a failure occurs due to a bad username password combination, or a effective ban blocking the attempt which heavily mitigates any form of brute-force. This occurs because the records and counting process for this system uses the method utilized for sign in rather than the effective username attribute. This has a minimal impact on account security, this impact is increased naturally in scenarios when there is no two-factor authentication required and weak passwords are used. This makes it a bit easier to brute-force a password. A patch for this issue has been applied to versions 4.38.19, and 4.39.0. Users are advised to upgrade. Users unable to upgrade should 1. Not heavily modify the default settings in a way that ends up with shorter or less frequent regulation bans. The default settings effectively mitigate any potential for this issue to be exploited. and 2. Disable the ability for users to login via an email address.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: authelia
product: authelia
Published: 2025-02-19T17:19:30.909Z
CVE-2025-24807 Fast DDS does not verify Permissions CA
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0, per design, PermissionsCA is not full chain validated, nor is the expiration date validated. Access control plugin validates only the S/MIME signature which causes an expired PermissionsCA to be taken as valid. Even though this issue is responsible for allowing `governance/permissions` from an expired PermissionsCA and having the system crash when PermissionsCA is not self-signed and contains the full-chain, the impact is low. Versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0 contain a fix for the issue.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: eProsima
product: Fast-DDS
Published: 2025-02-11T15:31:50.337Z
CVE-2025-24808 Discourse has race condition when adding users to a group DM
Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about to reach the limit of users in a group DM may send requests to add new users in parallel. The requests might all go through ignoring the limit due to a race condition. The patch in versions `3.3.4` and `3.4.0.beta5` uses the `lock` step in service to wrap part of the `add_users_to_channel` service inside a distributed lock/mutex in order to avoid the race condition.
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: discourse
product: discourse
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-03-26T14:08:38.915Z
CVE-2025-24810 
Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege and accessing the settings screen.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Rahe
product: Simple Image Sizes
Published: 2025-01-28T04:36:53.852Z
CVE-2025-24813 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


If all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to       perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
Problem types: cwe_id: CWE-44
description: CWE-44 Path Equivalence: 'file.name' (Internal Dot)
cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: COSCO Shipping Lines DIC
lang: en
value: sw0rd1ight (https://github.com/sw0rd1ight)
Published: 2025-03-10T16:44:03.715Z
CVE-2025-24814 Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files
Core creation allows users to replace "trusted" configset files with arbitrary configuration

Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.  These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.

This issue affects all Apache Solr versions up through Solr 9.7.  Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService").  Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "<lib>" tags by default.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: Apache Software Foundation
product: Apache Solr
default_status: unaffected
Credits: lang: en
value: pwn null
Published: 2025-01-27T08:58:08.768Z
CVE-2025-24817 An OS Command Injection vulnerability in Nokia MantaRay NM
Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Symptom Collector application.
Affected products: vendor: Nokia
product: MantaRay NM
default_status: affected
Published: 2026-04-07T15:09:47.125Z
CVE-2025-24818 An OS Command Injection vulnerability in Nokia MantaRay NM
Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to improper neutralization of special elements used in an OS command in Log Search application.
Affected products: vendor: Nokia
product: MantaRay NM
default_status: affected
Published: 2026-04-07T15:13:22.492Z
CVE-2025-24819 A Relative Path Traversal vulnerability in Nokia MantaRay NM
Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager application.
Affected products: vendor: Nokia
product: MantaRay NM
default_status: affected
Published: 2026-04-07T15:14:42.719Z
CVE-2025-24826 
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4625.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: Acronis
product: Acronis Snap Deploy
default_status: unaffected
Credits: lang: en
value: @wdormann (https://hackerone.com/wdormann)
Published: 2025-01-28T20:46:19.688Z
CVE-2025-24827 
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Problem types: cwe_id: CWE-426
description: CWE-426
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
Credits: lang: en
value: @cyberexplorer (https://hackerone.com/cyberexplorer)
Published: 2025-01-31T12:43:44.323Z
CVE-2025-24828 
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Problem types: cwe_id: CWE-426
description: CWE-426
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
Credits: lang: en
value: @cyberexplorer (https://hackerone.com/cyberexplorer)
Published: 2025-01-31T12:43:58.295Z
CVE-2025-24829 
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Problem types: cwe_id: CWE-426
description: CWE-426
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
Credits: lang: en
value: @cyberexplorer (https://hackerone.com/cyberexplorer)
Published: 2025-01-31T12:43:28.583Z
CVE-2025-24830 
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Problem types: cwe_id: CWE-426
description: CWE-426
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
Credits: lang: en
value: @cyberexplorer (https://hackerone.com/cyberexplorer)
Published: 2025-01-31T12:43:13.267Z
CVE-2025-24831 
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Problem types: cwe_id: CWE-428
description: CWE-428
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
Published: 2025-01-31T12:42:57.048Z
CVE-2025-24832 
Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.7.615.
Problem types: cwe_id: CWE-61
description: CWE-61
Affected products: vendor: Acronis
product: Acronis Backup plugin for cPanel & WHM
default_status: unaffected
vendor: Acronis
product: Acronis Backup plugin for cPanel & WHM
default_status: unaffected
vendor: Acronis
product: Acronis Backup extension for Plesk
default_status: unaffected
Published: 2025-02-27T23:00:16.679Z
CVE-2025-24833 
Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: NEOJAPAN Inc.
product: desknet's NEO
Published: 2025-10-16T10:03:07.930Z
CVE-2025-24834 
Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via adjacent access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Information Disclosure
cwe_id: CWE-693
description: Protection Mechanism Failure
Affected products: vendor: n/a
product: Intel(R) CIP software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
Published: 2025-11-11T16:49:54.195Z
CVE-2025-24835 
Protection mechanism failure in the Intel(R) Graphics Driver for the Intel(R) Arc(TM) B-Series graphics before version 32.0.101.6737 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
cwe_id: CWE-693
description: Protection Mechanism Failure
Affected products: vendor: n/a
product: Intel(R) Arc(TM) B-Series graphics
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2025-08-12T16:59:08.856Z
CVE-2025-24836 Qardio Heart Health IOS and Android Application and QardioARM A100 Uncaught Exception
With a specially crafted Python script, an attacker could send 
continuous startMeasurement commands over an unencrypted Bluetooth 
connection to the affected device. This would prevent the device from 
connecting to a clinician's app to take patient readings and ostensibly 
flood it with requests, resulting in a denial-of-service condition.
Problem types: cwe_id: CWE-248
description: CWE-248
Affected products: vendor: Qardio
product: Heart Health IOS Mobile Application
default_status: unaffected
vendor: Qardio
product: Heart Health Android Mobile Application
default_status: unaffected
vendor: Qardio
product: QardioARM
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Credits: lang: en
value: Bryan Riggins of Insulet Corporation reported these vulnerabilities to CISA.
Published: 2025-02-13T21:55:12.382Z
CVE-2025-24838 
Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-269
description: Improper Privilege Management
Affected products: vendor: n/a
product: Intel(R) CIP software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-11-11T16:49:55.796Z
CVE-2025-24839 Unauthorized AI bot activation via Wrangler plugin
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Juho Forsén
Published: 2025-04-16T07:44:20.844Z
CVE-2025-24840 
Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Problem types: description: Escalation of Privilege
cwe_id: CWE-284
description: Improper Access Control
Affected products: vendor: n/a
product: Edge Orchestrator software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
Published: 2025-08-12T16:59:10.515Z
CVE-2025-24841 
Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor and an arbitrary script may be executed on a logged-in user's web browser.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Six Apart Ltd.
product: Movable Type (8.4.x series)
vendor: Six Apart Ltd.
product: Movable Type (8.0.x series)
vendor: Six Apart Ltd.
product: Movable Type Advanced  (8.4.x series)
vendor: Six Apart Ltd.
product: Movable Type Advanced  (8.0.x series)
vendor: Six Apart Ltd.
product: Movable Type Premium (2.x series)
vendor: Six Apart Ltd.
product: Movable Type Premium (Advanced Edition) (2.x series)
vendor: Six Apart Ltd.
product: Movable Type Cloud Edition (8.x series)
vendor: Six Apart Ltd.
product: Movable Type Premium Cloud Edition (2.x series)
Published: 2025-02-19T05:52:15.125Z
CVE-2025-24842 
Uncontrolled search path for the Intel(R) System Support Utility before version 4.1.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: Intel(R) System Support Utility
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-11-11T16:49:57.391Z