rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-66590 Out-of-bounds Write vulnerability in AzeoTech DAQFactory
In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnerability can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution or a system crash.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: AzeoTech
product: DAQFactory
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Michael Heinzl
lang: en
value: Rocco Calvi (@TecR0c) with TecSecurity of Trend Zero Day Initiative
lang: en
value: Andrea Micalizzi (@rgod777) of Trend Zero Day Initiative
Published: 2025-12-11T20:45:55.130Z
CVE-2025-66592 
An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
Problem types: cwe_id: CWE-346
description: Origin Validation Error
Affected products: vendor: Synology
product: Synology Active Backup for Business Agent
default_status: affected
CVSS v3.1: baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
version: 3.1
Credits: lang: en
value: Sheikh Rishad (https://x.com/sheikhrishad0)
Published: 2026-05-27T08:43:05.069Z
CVE-2025-66593 
An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
Problem types: cwe_id: CWE-346
description: Origin Validation Error
Affected products: vendor: Synology
product: Synology Assistant
default_status: affected
CVSS v3.1: baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
version: 3.1
Credits: lang: en
value: Sheikh Rishad (https://x.com/sheikhrishad0)
Published: 2026-05-27T08:43:51.162Z
CVE-2025-66594 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.

Detailed messages are displayed on the error
page. This information could be exploited by an attacker for other attacks.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:37:30.800Z
CVE-2025-66595 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



This product is
vulnerable to Cross-Site Request Forgery (CSRF). When a user accesses a link
crafted by an attacker, the user’s account could be compromised.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:36:38.506Z
CVE-2025-66596 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



This product does not
properly validate request headers. When an attacker inserts an invalid host
header, users could be redirected to malicious sites.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:35:28.896Z
CVE-2025-66597 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



This product supports
weak cryptographic algorithms, potentially allowing an attacker to decrypt
communications with the web server.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:31:24.991Z
CVE-2025-66598 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



This product supports
old SSL/TLS versions, potentially allowing an attacker to decrypt
communications with the web server.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:26:46.511Z
CVE-2025-66599 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



Physical paths could
be displayed on web pages. This information could be exploited by an attacker
for other attacks.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-497
description: CWE-497
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:25:39.213Z
CVE-2025-66600 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



This product lacks
HSTS (HTTP Strict Transport Security) configuration. When an attacker performs
a Man in the middle (MITM) attack, communications with the web server could be
sniffed.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-358
description: CWE-358
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:24:33.044Z
CVE-2025-66601 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



This product does not
specify MIME types. When an attacker performs a content sniffing attack,
malicious scripts could be executed.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-358
description: CWE-358
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:17:59.547Z
CVE-2025-66602 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



The web server accepts
access by IP address. When a worm that randomly searches for IP addresses
intrudes into the network, it could potentially be attacked by the worm.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-291
description: CWE-291
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:16:47.620Z
CVE-2025-66603 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



The web server accepts
the OPTIONS method. An attacker could potentially use this information to carry
out other attacks.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-358
description: CWE-358
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:15:41.396Z
CVE-2025-66604 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



The library version
could be displayed on the web page. This information could be exploited by an
attacker for other attacks.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:14:10.253Z
CVE-2025-66605 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



Since there are input
fields on this webpage with the autocomplete attribute enabled, the input
content could be saved in the browser the user is using.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-359
description: CWE-359
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:13:02.297Z
CVE-2025-66606 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



This product does not
properly encode URLs. An attacker could tamper with web pages or execute
malicious scripts.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-86
description: CWE-86
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:06:00.996Z
CVE-2025-66607 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



The response header
contains an insecure setting. Users could be redirected to malicious sites by
an attacker.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-358
description: CWE-358
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:09:05.605Z
CVE-2025-66608 
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.



This product does not
properly validate URLs. An attacker could send specially crafted requests to
steal files from the web server.



The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04
Problem types: cwe_id: CWE-29
description: CWE-29
Affected products: vendor: Yokogawa Electric Corporation
product: FAST/TOOLS
default_status: unknown
Published: 2026-02-09T03:11:56.893Z
CVE-2025-66614 Apache Tomcat: Client certificate verification bypass due to virtual host mapping
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.
Tomcat did not validate that the host name provided via the SNI 
extension was the same as the host name provided in the HTTP host header 
field. If Tomcat was configured with more than one virtual host and the 
TLS configuration for one of those hosts did not require client 
certificate authentication but another one did, it was possible for a 
client to bypass the client certificate authentication by sending 
different host names in the SNI extension and the HTTP host header field.



The vulnerability only applies if client certificate authentication is 
only enforced at the Connector. It does not apply if client certificate 
authentication is enforced at the web application.


Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: Sven Hebrok, Willi Hensch, Felix Cramer, Tim Leonhard Storm, Maximilian Radoy, and Juraj Somorovsky from Paderborn University
Published: 2026-02-17T18:48:30.577Z
CVE-2025-66617 
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Canva
product: Affinity
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by KPC of Cisco Talos.
Published: 2026-03-17T18:52:36.982Z
CVE-2025-66620 Columbia Weather Systems MicroServer Command Shell in Externally Accessible Directory
An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited shell access, enabling persistence through reverse shells, and the ability to modify or remove data stored in the file system.
Problem types: cwe_id: CWE-553
description: CWE-553 Command Shell in Externally Accessible Directory
Affected products: vendor: Columbia Weather Systems
product: MicroServer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: UsrPacific/Columbia Weather Systems reported these vulnerabilities to CISA.
Published: 2026-01-07T20:08:33.137Z
CVE-2025-66622 matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condition, if a user is invited to a room with non-standard join rules, the crate's sync process will stall, preventing further processing for all rooms. This is fixed in version 0.16.0.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: matrix-org
product: matrix-rust-sdk
Published: 2025-12-09T02:07:18.831Z
CVE-2025-66623 Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: strimzi
product: strimzi-kafka-operator
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-12-05T18:31:30.635Z
CVE-2025-66624 BACnet-stack MS/TP reply matcher OOB read
BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. Prior to 1.5.0.rc2, The npdu_is_expected_reply function in src/bacnet/npdu.c indexes request_pdu[offset+2/3/5] and reply_pdu[offset+1/2/4] without verifying that those APDU bytes exist. bacnet_npdu_decode() can return offset == 2 for a 2-byte NPDU, so tiny PDUs pass the version check and then get read out of bounds. On ASan/MPU/strict builds this is an immediate crash (DoS). On unprotected builds it is undefined behavior and can mis-route replies; RCE is unlikely because only reads occur, but DoS is reliable.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: bacnet-stack
product: bacnet-stack
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-12-05T18:36:26.280Z
CVE-2025-66625 Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality
Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of arbitrary files on the server’s filesystem. This vulnerability does not allow reading or writing file contents. In certain configurations, incomplete clean-up of temporary upload files may additionally expose the NTLM hash of the Windows account running the Umbraco application. This issue is fixed in version 13.12.1.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-377
description: CWE-377: Insecure Temporary File
cwe_id: CWE-552
description: CWE-552: Files or Directories Accessible to External Parties
Affected products: vendor: umbraco
product: Umbraco-CMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-12-09T20:09:27.054Z
CVE-2025-66626 argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the subsequent check are flawed. An attacker can overwrite the file /var/run/argo/argoexec with a script of their choice, which would be executed at the pod's start. The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. This issue is fixed in versions 3.6.14 and 3.7.5.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: argoproj
product: argo-workflows
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2025-12-09T20:19:14.680Z
CVE-2025-66627 Wasmi's Linear Memory has a Critical Use After Free Vulnerability
Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory growth conditions. This issue potentially leads to memory corruption, information disclosure, or code execution. This issue is fixed in versions 0.41.2, 0.47.1, 0.51.3 and 1.0.1. To workaround this issue, consider limiting the maximum linear memory sizes where feasible.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: wasmi-labs
product: wasmi
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-12-09T02:52:46.938Z
CVE-2025-66628 ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)
ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version 7.1.2-10.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-12-10T22:04:49.639Z
CVE-2025-66629 HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: hedgedoc
product: hedgedoc
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2025-12-05T22:47:44.994Z