rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-46789 Zoom Clients for Windows - Classic Buffer Overflow
Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Zoom Communications Inc.
product: Zoom Clients for Windows
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-10T15:50:54.986Z
CVE-2025-46801 
Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.
Problem types: cwe_id: CWE-305
description: Authentication bypass by primary weakness
Affected products: vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
Published: 2025-05-19T07:14:45.304Z
CVE-2025-46802 Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screen
For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session.
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Micro 5.3
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Micro 5.4
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Micro 5.5
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Module for Basesystem 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Desktop 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP Applications 15 SP6
default_status: unaffected
vendor: SUSE
product: SUSE Linux Enterprise High Performance Computing 15 SP6
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Matthias Gerstner, SUSE
Published: 2025-05-26T15:10:38.460Z
CVE-2025-46803 Screen creates by default world-writable PTYs
The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any Screen PTYs in the system.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Matthias Gerstner, SUSE
Published: 2025-05-26T15:06:04.339Z
CVE-2025-46804 Screen 5.0.0 and older versions allow file existence tests when installed setuid-root
A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available.


Affected are older Screen versions, as well as version 5.0.0.
Problem types: cwe_id: CWE-203
description: CWE-203: Observable Discrepancy
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Matthias Gerstner, SUSE
Published: 2025-05-26T13:31:17.792Z
CVE-2025-46805 Screen has a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root
Screen version 5.0.0 and older version 4 releases have  a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root.
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Matthias Gerstner, SUSE
Published: 2025-05-26T13:16:40.969Z
CVE-2025-46806 Misaligned Memory Accesses in `is_openvpn_protocol()`
A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2.2.4.
Problem types: cwe_id: CWE-823
description: CWE-823: Use of Out-of-range Pointer Offset
Affected products: vendor: https://github.com/yrutschle/sslh/releases/tag/v2.2.4
product: sslh
default_status: unaffected
Credits: lang: en
value: Matthias Gerstner, SUSE
Published: 2025-06-02T12:11:20.267Z
CVE-2025-46807 File Descriptor Exhaustion in sslh-select and sslh-ev triggers SEGFAULT
A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimate users service.This issue affects sslh before 2.2.4.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: https://github.com/yrutschle/sslh/releases/tag/v2.2.4
product: sslh
default_status: unaffected
Credits: lang: en
value: Matthias Gerstner, SUSE
Published: 2025-06-02T11:29:13.603Z
CVE-2025-46809 Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs
A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Proxy-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Proxy Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2.
Problem types: cwe_id: CWE-256
description: CWE-256: Plaintext Storage of a Password
Affected products: vendor: SUSE
product: Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1
default_status: unaffected
vendor: SUSE
product: Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1
default_status: unaffected
vendor: SUSE
product: Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Proxy-4-3-BYOS
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Server-4-3-BYOS
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE
default_status: unaffected
vendor: SUSE
product: SUSE Manager Proxy Module 4.3
default_status: unaffected
vendor: SUSE
product: SUSE Manager Server Module 4.3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Oscar Barrios of SUSE
Published: 2025-07-31T15:24:41.890Z
CVE-2025-46810 
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed: from ? before 2.11.29.
Problem types: cwe_id: CWE-61
description: CWE-61: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: openSUSE
product: Tumbleweed
default_status: unaffected
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2025-09-02T11:34:32.138Z
CVE-2025-46811 SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint
A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: SUSE
product: Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Server-4-3-BYOS
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2
default_status: unaffected
vendor: SUSE
product: Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE
default_status: unaffected
vendor: SUSE
product: SUSE Manager Server Module 4.3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Simon Holl (MindBytes)
Published: 2025-07-30T14:20:53.828Z
CVE-2025-46812 Trix vulnerable to Cross-site Scripting on copy & paste
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: basecamp
product: trix
Published: 2025-05-08T19:27:22.573Z
CVE-2025-46813 Private data leak on login-required Discourse sites
Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b. On login-required sites, the leak meant that some content on the site's homepage could be visible to unauthenticated users. Only login-required sites that got deployed during this timeframe are affected, roughly between April 30 2025 noon EDT and May 2 2025, noon EDT. Sites on the stable branch are unaffected. Private content on an instance's homepage could be visible to unauthenticated users on login-required sites. Versions of 3.5.0.beta4 after commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b are not vulnerable to the issue. No workarounds are available. Sites must upgrade to a non-vulnerable version of Discourse.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: discourse
product: discourse
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Published: 2025-05-05T20:03:46.289Z
CVE-2025-46814 FastAPI Guard Remote Header Injection via X-Forwarded-For Manipulation
FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. An HTTP header injection vulnerability has been identified in versions prior to 2.0.0. By manipulating the X-Forwarded-For header, an attacker can potentially inject arbitrary IP addresses into the request. This vulnerability can allow attackers to bypass IP-based access controls, mislead logging systems, and impersonate trusted clients. It is especially impactful when the application relies on the X-Forwarded-For header for IP-based authorization or authentication. Users should upgrade to FastAPI Guard version 2.0.0 to receive a fix.
Problem types: cwe_id: CWE-74
description: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: rennf93
product: fastapi-guard
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.4
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
version: 3.1
Published: 2025-05-06T14:55:48.766Z
CVE-2025-46815 ZITADEL Allows IdP Intent Token Reuse
The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it was possible to exploit this feature by repeatedly using intents. This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user. It's important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API. Versions 3.0.0, 2.71.9, and 2.70.10 contain a fix for the issue. No known workarounds other than upgrading are available.
Problem types: cwe_id: CWE-613
description: CWE-613: Insufficient Session Expiration
cwe_id: CWE-294
description: CWE-294: Authentication Bypass by Capture-replay
cwe_id: CWE-384
description: CWE-384: Session Fixation
Affected products: vendor: zitadel
product: zitadel
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2025-05-06T17:13:53.878Z
CVE-2025-46816 goshs route not protected, allows command execution
goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: patrickhener
product: goshs
Published: 2025-05-06T18:41:58.035Z
CVE-2025-46817 Lua library commands may lead to integer overflow and potential RCE
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: redis
product: redis
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-03T17:52:48.478Z
CVE-2025-46818 Redis: Authenticated users can execute LUA scripts as a different user
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: redis
product: redis
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-10-03T18:38:57.170Z
CVE-2025-46819 Redis is vulnerable to DoS via specially crafted LUA scripts
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: redis
product: redis
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
version: 3.1
Published: 2025-10-03T19:12:10.999Z
CVE-2025-46820 phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact
phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the GitHub API to push malicious code or rewrite release commits in your repository. Any downstream user of the repository may be affected, but the token should only be valid for the duration of the workflow run, limiting the time during which exploitation could occur. Version 4.1.8 fixes the issue.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
cwe_id: CWE-538
description: CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
Affected products: vendor: phpgt
product: Dom
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
version: 3.1
Published: 2025-05-06T18:48:52.176Z
CVE-2025-46821 Envoy vulnerable to bypass of RBAC uri_template permission
Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the `*` character from a set of valid characters in the URI path. As a result URI path containing the `*` character will not match a URI template expressions. This can result in bypass of RBAC rules when configured using the `uri_template` permissions. This vulnerability is fixed in Envoy versions v1.34.1, v1.33.3, v1.32.6, v1.31.8. As a workaround, configure additional RBAC permissions using `url_path` with `safe_regex` expression.
Problem types: cwe_id: CWE-186
description: CWE-186: Overly Restrictive Regular Expression
Affected products: vendor: envoyproxy
product: envoy
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-05-07T21:24:07.891Z
CVE-2025-46822 Unauthenticated Arbitrary File Read via Absolute Path
OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.
Problem types: cwe_id: CWE-36
description: CWE-36: Absolute Path Traversal
Affected products: vendor: OsamaTaher
product: Java-springboot-codebase
Published: 2025-05-21T17:23:37.087Z