rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-58379 Password Exposure in Brocade Fabric OS
Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may expose higher privilege sensitive information by a lower privileged user.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: Brocade
product: Fabric OS
default_status: unaffected
Published: 2026-02-03T01:55:09.736Z
CVE-2025-58380 Directory transversal vulnerability in Brocade Fabric OS before 9.2.1 using grep command
A vulnerability in Brocade Fabric OS before 9.2.1 could allow an authenticated attacker with admin privileges using the shell command “grep” to modify the path variables and move upwards in the directory structure or to traverse to different directories.
Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal
Affected products: vendor: Brocade
product: Fabric OS
default_status: unaffected
Published: 2026-02-03T05:05:49.111Z
CVE-2025-58381 Directory transversal vulnerability in Brocade Fabric OS before 9.2.1c2 and 9.2.2 through 9.2.2a using various shell commands
A
 vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an 
authenticated attacker with admin privileges using the shell commands 
“source, ping6, sleep, disown, wait to modify the path variables and 
move upwards in the directory structure or to traverse to different 
directories.
Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal
Affected products: vendor: Brocade
product: Fabric OS
default_status: unaffected
Published: 2026-02-03T05:40:14.240Z
CVE-2025-58382 Privilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2a
A vulnerability in the secure configuration of authentication and 
management services in Brocade Fabric OS before Fabric OS 9.2.1c2 could 
allow an authenticated, remote attacker with administrative credentials 
to execute arbitrary commands as root using “supportsave”, 
“seccertmgmt”, “configupload” command.
Problem types: cwe_id: CWE-305
description: CWE-305: Authentication Bypass by Primary Weakness
Affected products: vendor: Brocade
product: Fabric OS
default_status: unaffected
Published: 2026-02-03T01:39:55.349Z
CVE-2025-58383 Privilege escalation via bind command in Brocade Fabric OS
A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and bypass security controls allowing the execution of arbitrary commands.
Problem types: cwe_id: CWE-250
description: CWE-250: Execution with Unnecessary Privileges
Affected products: vendor: Brocade
product: Fabric OS
default_status: unaffected
Published: 2026-02-03T01:49:18.962Z
CVE-2025-58384 
In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc administration interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-26T00:00:00.000Z
CVE-2025-58385 
In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-26T00:00:00.000Z
CVE-2025-58386 
In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new lower-privileged account and escalate its privileges. While manipulating this request, the Power User can also change the target account's password, effectively taking full control of it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-58400 
RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
Problem types: cwe_id: CWE-428
description: Unquoted search path or element
Affected products: vendor: RATOC Systems, Inc.
product: RATOC RAID Monitoring Manager for Windows
Published: 2025-09-05T05:36:34.661Z
CVE-2025-58401 
Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account.
Problem types: cwe_id: CWE-312
description: Cleartext storage of sensitive information
Affected products: vendor: Pierre-Adrien Vasseur
product: Obsidian GitHub Copilot Plugin
Published: 2025-09-05T04:28:24.638Z
CVE-2025-58402 Insecure Direct Object Reference Message ID
The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Published: 2026-03-02T11:16:31.420Z
CVE-2025-58405 Lack of protection mechanisms against Clickjacking attacks
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Published: 2026-03-02T11:16:45.223Z
CVE-2025-58406 Lack of HTTP Response Headers
The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.
Problem types: cwe_id: CWE-693
description: CWE-693 Protection Mechanism Failure
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Published: 2026-03-02T11:16:56.975Z
CVE-2025-58407 GPU DDK - TOCTOU bug affecting psFWMemContext->uiPageCatBaseRegSet
Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine.
Problem types: cwe_id: CWE-367
description: CWE - CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition (4.18)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unaffected
Published: 2025-11-17T17:18:18.831Z
CVE-2025-58408 GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and write use-after-free.

The Use After Free common weakness enumeration was chosen as the stale data can include handles to resources in which the reference counts can become unbalanced. This can lead to the premature destruction of a resource while in use.
Problem types: cwe_id: CWE-416
description: CWE - CWE-416: Use After Free (4.18)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2025-12-01T11:16:24.598Z
CVE-2025-58409 GPU DDK - Disguised freelist buffers passed to RGXCreateHWRTDataSet can cause arbitrary physical memory writes corrupting memory
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.

Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.

This attack can lead the GPU to perform write operations on restricted internal GPU buffers that can lead to a second order affect of corrupted arbitrary physical memory.
Problem types: cwe_id: CWE-119
description: CWE - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer (4.18)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2026-01-13T16:37:46.020Z
CVE-2025-58410 GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only.

This is caused by improper handling of the memory protections for the buffer resource.
Problem types: cwe_id: CWE-280
description: CWE - CWE-280: Improper Handling of Insufficient Permissions or Privileges (4.18)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2025-11-17T16:57:05.418Z
CVE-2025-58411 GPU DDK - Reservation::psMappedPMR can change while used by a freelist -> UAF
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a potential use after free scenario.

Improper resource management and reference counting on an internal resource caused scenario where potential write use after free was present.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2026-01-13T16:41:51.276Z
CVE-2025-58412 
A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL.
Problem types: cwe_id: CWE-80
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiADC
cpes: cpe:2.3:h:fortinet:fortiadc:8.0.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.6.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.6.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.6.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.6.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.9:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.8:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.8:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C
Published: 2025-11-19T09:49:04.525Z
CVE-2025-58422 
RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middle attack, they may alter the values of HTTP requests, which could result in tampering with the operation history of the product’s management tool.
Problem types: cwe_id: CWE-348
description: Use of less trusted source
Affected products: vendor: Ricoh Company, Ltd.
product: RICOH Streamline NX
Published: 2025-09-08T04:43:01.703Z
CVE-2025-58423 Advantech DeviceOn/iEdge Path Traversal
Due to insufficient sanitization, an attacker can upload a specially 
crafted configuration file to cause a denial-of-service condition, 
traverse directories, or read/write files, within the context of the 
local system account.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: Advantech
product: DeviceOn/iEdge
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Alex Williams of Pellera Technologies reported this vulnerability to CISA.
Published: 2025-11-06T22:31:02.740Z
CVE-2025-58424 BIG-IP TMM vulnerability
On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-340
description: CWE-340: Generation of Predictable Numbers or Identifiers
Affected products: vendor: F5
product: BIG-IP
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Credits: lang: en
value: F5
Published: 2025-10-15T13:55:47.303Z
CVE-2025-58426 
desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.
Problem types: cwe_id: CWE-321
description: Use of hard-coded cryptographic key
Affected products: vendor: NEOJAPAN Inc.
product: desknet's NEO
Published: 2025-10-16T10:03:40.587Z
CVE-2025-58427 
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Canva
product: Affinity
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by KPC of Cisco Talos.
Published: 2026-03-17T18:52:38.539Z
CVE-2025-58428 Command Injection in Veeder-Root TLS4B Automatic Tank Gauge System
The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote command execution, full shell access, and potential lateral movement within the network.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Veeder-Root
product: TLS4B Automatic Tank Gauge System
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Pedro Umbelino of Bitsight reported these vulnerabilities to CISA.
Published: 2025-10-23T19:49:23.232Z
CVE-2025-58429 AutomationDirect Productivity Suite Relative Path Traversal
A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary files on the target machine.
Problem types: cwe_id: CWE-23
description: CWE-23
Affected products: vendor: AutomationDirect
product: Productivity Suite
default_status: unaffected
vendor: AutomationDirect
product: Productivity 3000 P3-622 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 3000 P3-550E CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 3000 P3-530 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 2000 P2-622 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 2000 P2-550 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 1000 P1-550 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 1000 P1-540 CPU
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Luca Borzacchiello of Nozomi Networks reported these vulnerabilities to AutomationDirect.
Published: 2025-10-23T22:12:13.384Z
CVE-2025-58430 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover
listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: knadh
product: listmonk
Published: 2025-09-09T19:37:45.468Z
CVE-2025-58431 ZimaOS reads arbitrary files using localhost calls to File API Download
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.
Problem types: cwe_id: CWE-250
description: CWE-250: Execution with Unnecessary Privileges
Affected products: vendor: IceWhaleTech
product: ZimaOS
Published: 2025-09-17T17:25:08.811Z
CVE-2025-58432 ZimaOS  Privilege Escalation using localhost calls to File API Upload
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.
Problem types: cwe_id: CWE-250
description: CWE-250: Execution with Unnecessary Privileges
cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: IceWhaleTech
product: ZimaOS
Published: 2025-09-17T17:31:20.968Z
CVE-2025-58434 Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: FlowiseAI
product: Flowise
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-09-12T17:37:08.190Z
CVE-2025-58435 Open OnDemand didn't rotate password for VNC batch_connect
Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop session and the other user would need to be authenticated to the portal. But obtaining the link would allow that user to perform any actions as the original user and access their data. Open OnDemand 3.1.15 and 4.0.7 have patched this vulnerability and correctly rotate passwords for any version of TurboVNC. As a workaround, downgrade TurboVNC to a version lower than 3.1.2.
Problem types: cwe_id: CWE-262
description: CWE-262: Not Using Password Aging
Affected products: vendor: OSC
product: ondemand
Published: 2025-09-09T19:43:47.379Z
CVE-2025-58436 OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: OpenPrinting
product: cups
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-11-29T02:15:53.252Z