rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-47888 
Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.
Affected products: vendor: Jenkins Project
product: Jenkins DingTalk Plugin
default_status: unknown
Published: 2025-05-14T20:35:57.422Z
CVE-2025-47889 
In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist.
Affected products: vendor: Jenkins Project
product: Jenkins WSO2 Oauth Plugin
default_status: unknown
Published: 2025-05-14T20:35:58.095Z
CVE-2025-47900 RCE on backup configuration password
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Microchip
product: Time Provider 4100
default_status: unaffected
Credits: lang: en
value: Dario Emilio Bertani
lang: en
value: Raffaele Bova
lang: en
value: Andrea Sindoni
lang: en
value: Simone Bossi
lang: en
value: Antonio Carriero
lang: en
value: Marco Manieri
lang: en
value: Vito Pistillo
lang: en
value: Davide Renna
lang: en
value: Manuel Leone
lang: en
value: Massimiliano Brolli
lang: en
value: TIM Security Red Team Research (TIM S.p.A)
Published: 2025-10-20T17:43:33.890Z
CVE-2025-47901 RCE on restore configuration password
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Microchip
product: Time Provider 4100
default_status: unaffected
Credits: lang: en
value: Dario Emilio Bertani
lang: en
value: Raffaele Bova
lang: en
value: Andrea Sindoni
lang: en
value: Simone Bossi
lang: en
value: Antonio Carriero
lang: en
value: Marco Manieri
lang: en
value: Vito Pistillo
lang: en
value: Davide Renna
lang: en
value: Manuel Leone
lang: en
value: Massimiliano Brolli
lang: en
value: TIM Security Red Team Research (TIM S.p.A)
Published: 2025-10-20T17:48:20.775Z
CVE-2025-47902 SQL Injection in web resource
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Microchip
product: Time Provider 4100
default_status: unaffected
Credits: lang: en
value: Dario Emilio Bertani
lang: en
value: Raffaele Bova
lang: en
value: Andrea Sindoni
lang: en
value: Simone Bossi
lang: en
value: Antonio Carriero
lang: en
value: Marco Manieri
lang: en
value: Vito Pistillo
lang: en
value: Davide Renna
lang: en
value: Manuel Leone
lang: en
value: Massimiliano Brolli
lang: en
value: TIM Security Red Team Research (TIM S.p.A)
Published: 2025-10-20T17:52:52.844Z
CVE-2025-47904 Unsigned upgrade package
Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: Microchip
product: Time Provider 4100
default_status: unaffected
Credits: lang: en
value: Dario Emilio Bertani
lang: en
value: Raffaele Bova
lang: en
value: Andrea Sindoni
lang: en
value: Simone Bossi
lang: en
value: Antonio Carriero
lang: en
value: Marco Manieri
lang: en
value: Vito Pistillo
lang: en
value: Davide Renna
lang: en
value: Manuel Leone
lang: en
value: Massimiliano Brolli
lang: en
value: TIM Security Red Team Research (TIM S.p.A)
Published: 2026-02-24T15:34:20.905Z
CVE-2025-47905 
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: varnish-software
product: Varnish Cache
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: 2025-05-13T00:00:00.000Z
CVE-2025-47906 Unexpected paths returned from LookPath in os/exec
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Problem types: description: CWE-115: Misinterpretation of Input
Affected products: vendor: Go standard library
product: os/exec
default_status: unaffected
Published: 2025-09-18T18:41:11.847Z
CVE-2025-47907 Incorrect results returned from Rows.Scan in database/sql
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
Problem types: description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Go standard library
product: database/sql
default_status: unaffected
Credits: lang: en
value: Spike Curtis from Coder
Published: 2025-08-07T15:25:30.704Z
CVE-2025-47908 Denial of service via malicious preflight requests in github.com/rs/cors
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
Problem types: description: CWE-1325: Improperly Controlled Sequential Memory Allocation
Affected products: vendor: github.com/rs/cors
product: github.com/rs/cors
default_status: unaffected
Credits: lang: en
value: @jub0bs
Published: 2025-08-06T20:41:31.311Z
CVE-2025-47909 Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf
Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.
Problem types: description: CWE-346: Origin Validation Error
Affected products: vendor: github.com/gorilla/csrf
product: github.com/gorilla/csrf
default_status: affected
Credits: lang: en
value: Filippo Valsorda
Published: 2025-08-29T15:55:08.936Z
CVE-2025-47910 CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Problem types: description: CWE-284: Improper Access Control
Affected products: vendor: Go standard library
product: net/http
default_status: unaffected
Published: 2025-09-22T21:01:55.440Z
CVE-2025-47911 Quadratic parsing complexity in golang.org/x/net/html
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Problem types: description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: golang.org/x/net
product: golang.org/x/net/html
default_status: unaffected
Credits: lang: en
value: Guido Vranken
lang: en
value: Jakub Ciolek
Published: 2026-02-05T17:48:44.562Z
CVE-2025-47912 Insufficient validation of bracketed IPv6 hostnames in net/url
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
Problem types: description: CWE-1286: Improper Validation of Syntactic Correctness of Input
Affected products: vendor: Go standard library
product: net/url
default_status: unaffected
Credits: lang: en
value: Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University
Published: 2025-10-29T22:10:13.435Z
CVE-2025-47913 Potential denial of service in golang.org/x/crypto/ssh/agent
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
Problem types: description: CWE-703: Improper Handling of Exceptional Conditions
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh/agent
default_status: unaffected
Credits: lang: en
value: Jakub Ciolek
lang: en
value: Nicola Murino
Published: 2025-11-13T21:29:39.907Z
CVE-2025-47914 Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
Problem types: description: CWE-237
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh/agent
default_status: unaffected
Credits: lang: en
value: Jakub Ciolek
Published: 2025-11-19T20:33:43.126Z
CVE-2025-47916 
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
Problem types: cwe_id: CWE-1336
description: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: invisioncommunity
product: Invision Power Board
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 10
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-05-16T00:00:00.000Z
CVE-2025-47917 
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Mbed
product: mbedtls
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.9
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
Published: 2025-07-20T00:00:00.000Z
CVE-2025-47928 Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`
Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and secrets `SPOTIPY_CLIENT_ID`,  `SPOTIPY_CLIENT_SECRET`. In particular `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content write privileges. The `pull_request_target` in GitHub Actions is a major security concern—especially in public repositories—because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue.
Problem types: cwe_id: CWE-488
description: CWE-488: Exposure of Data Element to Wrong Session
Affected products: vendor: spotipy-dev
product: spotipy
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-05-15T20:09:48.326Z
CVE-2025-47929 DumbDrop vulnerable to DOM XSS via file upload
DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file with a malicious payload. Commit db27b25372eb9071e63583d8faed2111a2b79f1b fixes the vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: DumbWareio
product: DumbDrop
Published: 2025-05-15T20:11:55.892Z
CVE-2025-47930 Zulip Server has access control bypass for restrictions on creation of specific channel types
Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanism can be circumvented by creating a private or web-public channel, and then changing the channel privacy to public. A similar technique works for creating private channels without permission, though such a process requires either the API or modifying the HTML, as we do mark the "private" radio button as disabled in such cases. Version 10.3 contains a patch.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: zulip
product: zulip
Published: 2025-05-15T23:17:29.829Z
CVE-2025-47931 LibreNMS stored Cross-site Scripting vulnerability in poller group name
LibreNMS is PHP/MySQL/SNMP based network monitoring software. LibreNMS v25.4.0 and prior suffers from a Stored Cross-Site Scripting (XSS) Vulnerability in the `group name` parameter of the `http://localhost/poller/groups` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. LibreNMS v25.5.0 contains a patch for the issue.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: librenms
product: librenms
Published: 2025-05-17T15:51:17.277Z
CVE-2025-47932 Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboard
Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting  when a dashboard is rendered via an AJAX call. Versions 2.7.13 and 3.2.2 sanitize the var responsible for the attack.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Combodo
product: iTop
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-11-10T19:20:24.114Z
CVE-2025-47933 Argo CD allows cross-site scripting on repositories page
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: argoproj
product: argo-cd
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-05-29T19:30:39.108Z
CVE-2025-47934 OpenPGP.js's message signature verification can be spoofed
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either `openpgp.verify` or `openpgp.decrypt`, causing these functions to return a valid signature verification result while returning data that was not actually signed. This flaw allows signature verifications of inline (non-detached) signed messages (using `openpgp.verify`) and signed-and-encrypted messages (using `openpgp.decrypt` with `verificationKeys`) to be spoofed, since both functions return extracted data that may not match the data that was originally signed. Detached signature verifications are not affected, as no signed data is returned in that case. In order to spoof a message, the attacker needs a single valid message signature (inline or detached) as well as the plaintext data that was legitimately signed, and can then construct an inline-signed message or signed-and-encrypted message with any data of the attacker's choice, which will appear as legitimately signed by affected versions of OpenPGP.js. In other words, any inline-signed message can be modified to return any other data (while still indicating that the signature was valid), and the same is true for signed+encrypted messages if the attacker can obtain a valid signature and encrypt a new message (of the attacker's choice) together with that signature. The issue has been patched in versions 5.11.3 and 6.1.1. Some workarounds are available. When verifying inline-signed messages, extract the message and signature(s) from the message returned by `openpgp.readMessage`, and verify the(/each) signature as a detached signature by passing the signature and a new message containing only the data (created using `openpgp.createMessage`) to `openpgp.verify`.  When decrypting and verifying signed+encrypted messages, decrypt and verify the message in two steps, by first calling `openpgp.decrypt` without `verificationKeys`, and then passing the returned signature(s) and a new message containing the decrypted data (created using `openpgp.createMessage`) to `openpgp.verify`.
Problem types: cwe_id: CWE-347
description: CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: openpgpjs
product: openpgpjs
Published: 2025-05-19T18:57:05.602Z
CVE-2025-47935 Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
Problem types: cwe_id: CWE-401
description: CWE-401: Missing Release of Memory after Effective Lifetime
Affected products: vendor: expressjs
product: multer
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-05-19T19:18:38.018Z
CVE-2025-47936 TYPO3 Vulnerable to Server Side Request Forgery via Webhooks
TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, Webhooks are inherently vulnerable to Cross-Site Request Forgery (CSRF), which can be exploited by adversaries to target internal resources (e.g., localhost or other services on the local network). While this is not a vulnerability in TYPO3 itself, it may enable attackers to blindly access systems that would otherwise be inaccessible. An administrator-level backend user account is required to exploit this vulnerability. Users should update to TYPO3 version 12.4.31 LTS or 13.4.12 LTS to fix the problem.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: TYPO3
product: typo3
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Published: 2025-05-20T13:23:52.952Z