rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-57773 Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability requires commons-collections 4.x and aspectjweaver-1.9.22.jar. The vulnerability has been fixed in version 2.10.12.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: dataease
product: dataease
Published: 2025-08-25T16:42:11.118Z
CVE-2025-57774 Out Of Bounds Write of invalid data when parsing a DSB file with Digilent DASYLab
There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
Problem types: cwe_id: CWE-1285
description: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
Affected products: vendor: Digilent
product: DASYLab
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya working with Trend Micro Zero Day Initiative
Published: 2025-09-02T18:15:10.516Z
CVE-2025-57775 Heap-based Buffer Overflow when parsing a DSB file with Digilent DASYLab
There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
Problem types: cwe_id: CWE-1285
description: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
Affected products: vendor: Digilent
product: DASYLab
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya working with Trend Micro Zero Day Initiative
Published: 2025-09-02T18:21:16.129Z
CVE-2025-57776 Out Of Bounds Write to invalid address when parsing a DSB file with Digilent DASYLab
There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
Problem types: cwe_id: CWE-1285
description: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
Affected products: vendor: Digilent
product: DASYLab
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya working with Trend Micro Zero Day Initiative
Published: 2025-09-02T18:16:01.400Z
CVE-2025-57777 Out Of Bounds Write in displ2.dll when parsing a DSB file with Digilent DASYLab
There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
Problem types: cwe_id: CWE-1285
description: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
Affected products: vendor: Digilent
product: DASYLab
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya working with Trend Micro Zero Day Initiative
Published: 2025-09-02T18:22:00.738Z
CVE-2025-57778 Out Of Bounds Write to invalid source address when parsing a DSB file with Digilent DASYLab
There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid source address when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
Problem types: cwe_id: CWE-1285
description: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
Affected products: vendor: Digilent
product: DASYLab
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya working with Trend Micro Zero Day Initiative
Published: 2025-09-02T18:16:54.772Z
CVE-2025-57780 F5OS Vulnerability
A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges.  A successful exploit may allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-250
description: CWE-250
Affected products: vendor: F5
product: F5OS - Appliance
default_status: unknown
vendor: F5
product: F5OS - Chassis
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-10-15T15:19:50.430Z
CVE-2025-57781 
The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
Problem types: cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: DENSO TEN Limited.
product: Multiple installers of DENSO TEN drive recorder viewer
Published: 2025-10-06T05:16:29.331Z
CVE-2025-57783 Improper header parsing may lead to request smuggling
Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to access restricted resources managed by Hiawatha webserver.
Problem types: description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected products: vendor: Hiawatha
product: Hiawatha Web server
Published: 2026-01-26T17:45:36.947Z
CVE-2025-57784 Tomahawk authentication timing attack due to usage of 'strcmp'
Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.
Problem types: description: CWE-208 Observable Timing Discrepancy
Affected products: vendor: Hiawatha
product: Hiawatha Web server
Published: 2026-01-26T17:47:19.382Z
CVE-2025-57785 Double free in XSLT in 'show_index'
A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code execution.
Problem types: description: CWE-415 Double Free
Affected products: vendor: Hiawatha
product: Hiawatha Web server
Published: 2026-01-26T17:46:09.707Z
CVE-2025-57786 
A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MedDream
product: MedDream PACS Premium
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos.
Published: 2026-01-20T14:49:41.119Z
CVE-2025-57787 
A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MedDream
product: MedDream PACS Premium
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos.
Published: 2026-01-20T14:49:46.909Z
CVE-2025-57788 Unauthorized API Access Risk
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.
Problem types: cwe_id: CWE-259
description: CWE-259: Use of Hard-coded Password
Affected products: vendor: Commvault
product: CommCell
default_status: unaffected
Credits: lang: en
value: Sonny and Piotr Bazydlo (@chudyPB) of watchTowr
Published: 2025-08-20T00:00:00.000Z
CVE-2025-57789 Vulnerability in Initial Administrator Login Process
During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.
Problem types: cwe_id: CWE-257
description: CWE-257: Storing Passwords in a Recoverable Format
Affected products: vendor: Commvault
product: CommCell
default_status: unaffected
Credits: lang: en
value: Sonny and Piotr Bazydlo (@chudyPB) of watchTowr
Published: 2025-08-20T03:22:08.764Z
CVE-2025-57790 Path Traversal Vulnerability
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution.
Problem types: cwe_id: CWE-36
description: CWE-36: Absolute Path Traversal
Affected products: vendor: Commvault
product: CommCell
default_status: unaffected
Credits: lang: en
value: Sonny and Piotr Bazydlo (@chudyPB) of watchTowr
Published: 2025-08-20T03:22:10.697Z
CVE-2025-57791 Argument Injection Vulnerability in CommServe
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role.
Problem types: cwe_id: CWE-88
description: CWE-88: Improper Neutralization of Argument Delimiters in a Command
Affected products: vendor: Commvault
product: CommCell
default_status: unaffected
Credits: lang: en
value: Sonny and Piotr Bazydlo (@chudyPB) of watchTowr
Published: 2025-08-20T03:22:12.633Z
CVE-2025-57792 SQL Injection Vulnerability in Explorance Blue
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue is exploitable without authentication, significantly raising the risk.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Explorance
product: Blue
default_status: unaffected
Credits: lang: en
value: Abdulrahman Nour, Mandiant
lang: en
value: Abdulrahman Nour, Mandiant
Published: 2026-01-28T17:26:51.559Z
CVE-2025-57793 SQL Injection Vulnerability in Explorance Blue
Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application component. Crafted input can be executed as part of backend database queries. The issue is exploitable without authentication, significantly elevating the risk.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Explorance
product: Blue
default_status: unaffected
Credits: lang: en
value: Abdulrahman Nour, Mandiant
lang: en
value: Abdulrahman Nour, Mandiant
Published: 2026-01-28T17:09:49.715Z
CVE-2025-57794 Unrestricted File Upload Vulnerability in Explorance Blue
Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restrict uploaded file types, allowing malicious files to be uploaded and executed by the server. This condition enables remote code execution under default configurations.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Explorance
product: Blue
default_status: unaffected
Credits: lang: en
value: Abdulrahman Nour, Mandiant
lang: en
value: Abdulrahman Nour, Mandiant
Published: 2026-01-28T17:33:43.151Z
CVE-2025-57795 Unauthenticated Remote File Download in Explorance Blue
Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to achieve remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Explorance
product: Blue
default_status: unaffected
Credits: lang: en
value: Abdulrahman Nour, Mandiant
lang: en
value: Abdulrahman Nour, Mandiant
Published: 2026-01-28T17:43:08.529Z
CVE-2025-57796 Use of a hardcoded static key to protect sensitive data in Explorance Blue
Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained.
Problem types: cwe_id: CWE-257
description: CWE-257:Storing Passwords in a Recoverable Format
Affected products: vendor: Explorance
product: Blue
default_status: unaffected
Credits: lang: en
value: Abdulrahman Nour, Mandiant
lang: en
value: Abdulrahman Nour, Mandiant
Published: 2026-01-28T17:47:56.607Z
CVE-2025-57797 
Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is exploited, an authenticated local attacker may escalate privileges and execute an arbitrary command.
Problem types: cwe_id: CWE-266
description: Incorrect privilege assignment
Affected products: vendor: PFU Limited
product: ScanSnap Manager installers
Published: 2025-08-27T05:43:18.734Z
CVE-2025-57798 Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerability in the title input functionality due to a lack of proper length validation. This flaw allows an attacker to cause an Out Of Memory (OOM) error and subsequent program termination by inserting an excessively long string into a note's title. This can be triggered either through direct user interface (UI) input or programmatically via the local web service API after compromising an authentication token. There are 2 primary methods of exploitation: via User Interface (UI) Input, and the Local Web Service API. A local user can directly type or paste an extremely long string into the title field when creating or editing a note Joplin runs a local web service (typically on port 41184) that allows programmatic interaction, such as creating or editing notes via HTTP API calls. If an attacker manages to exfiltrate or compromise the user's authentication token (e.g., through malware on the local system, or other local vulnerabilities), they can then send a crafted HTTP POST request to this local API. By including an excessively long string in the title parameter of this request, the application will attempt to allocate an unbounded amount of memory. This issue has been patched in version 3.7.1.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: laurent22
product: joplin
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-05-19T20:24:35.088Z
CVE-2025-57799 StreamVault can perform remote command execution
StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an attacker can modify certain system parameters, construct malicious commands, execute command injection attacks against the system, and ultimately gain server privileges. Users of all versions of the StreamVault system to date who have not modified their background passwords or use weak passwords are at risk of having their systems taken over via remote command execution. This issue has been patched in version 250822.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: lemon8866
product: StreamVault
Published: 2025-09-01T15:46:27.137Z
CVE-2025-57800 Audiobookshelf vulnerable to OIDC token exfiltration and account takeover
Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary callback in a cookie, which is later used to redirect the user after authentication. The server then issues a 302 redirect to the attacker-controlled URL, appending sensitive OIDC tokens as query parameters. This allows an attacker to obtain the victim's tokens and perform full account takeover, including creating persistent admin users if the victim is an administrator. Tokens are further leaked via browser history, Referer headers, and server logs. This vulnerability impacts all Audiobookshelf deployments using OIDC; no IdP misconfiguration is required. The issue is fixed in version 2.28.0. No known workarounds exist.
Problem types: cwe_id: CWE-523
description: CWE-523: Unprotected Transport of Credentials
cwe_id: CWE-598
description: CWE-598: Use of GET Request Method With Sensitive Query Strings
cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: advplyr
product: audiobookshelf
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-08-22T17:02:04.472Z
CVE-2025-57801 gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks
gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value from a signature without asserting that 0 ≤ S < order, leading to a signature malleability vulnerability. Because gnark’s native EdDSA and ECDSA circuits lack essential constraints, multiple distinct witnesses can satisfy the same public inputs. In protocols where nullifiers or anti-replay checks are derived from R and S, this enables signature malleability and may allow double spending. This issue has been addressed in version 0.14.0.
Problem types: cwe_id: CWE-347
description: CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: Consensys
product: gnark
Published: 2025-08-22T19:54:05.854Z
CVE-2025-57802 Airlink's Daemon Symlink Vulnerability
Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. In version 1.0.0, an attacker with access to the affected container can create symbolic links inside the mounted directory (/app/data). Because the container bind-mounts an arbitrary host path, these symlinks can point to sensitive locations on the host filesystem. When the application or other processes follow these symlinks, the attacker can gain unauthorized read access to host files outside the container. This issue has been patched in version 1.0.1.
Problem types: cwe_id: CWE-61
description: CWE-61: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: airlinklabs
product: daemon
Published: 2025-08-25T17:39:06.395Z
CVE-2025-57803 ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-08-26T17:25:59.148Z