Instruction: Please provide detailed information about CVE-2025-23529

CVE:CVE-2025-23529
Description:Missing Authorization vulnerability in Blokhaus Minterpress allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Minterpress: from n/a through 1.0.5.
published:2025-01-27T15:15:11.813


Instruction: Please provide detailed information about CVE-2025-23531

CVE:CVE-2025-23531
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David F. Carr RSVPMaker Volunteer Roles allows Reflected XSS. This issue affects RSVPMaker Volunteer Roles: from n/a through 1.5.1.
published:2025-01-27T15:15:11.963


Instruction: Please provide detailed information about CVE-2025-23574

CVE:CVE-2025-23574
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Lau CubePM allows Reflected XSS. This issue affects CubePM: from n/a through 1.0.
published:2025-01-27T15:15:12.123


Instruction: Please provide detailed information about CVE-2025-23656

CVE:CVE-2025-23656
Description:Missing Authorization vulnerability in Saul Morales Pacheco Donate visa allows Stored XSS. This issue affects Donate visa: from n/a through 1.0.0.
published:2025-01-27T15:15:12.267


Instruction: Please provide detailed information about CVE-2025-23669

CVE:CVE-2025-23669
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nurul Amin, Mohammad Saiful Islam WP Smart Tooltip allows Stored XSS. This issue affects WP Smart Tooltip: from n/a through 1.0.0.
published:2025-01-27T15:15:12.423


Instruction: Please provide detailed information about CVE-2025-23752

CVE:CVE-2025-23752
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound CGD Arrange Terms allows Reflected XSS. This issue affects CGD Arrange Terms: from n/a through 1.1.3.
published:2025-01-27T15:15:12.570


Instruction: Please provide detailed information about CVE-2025-23754

CVE:CVE-2025-23754
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ulrich Sossou The Loops allows Reflected XSS. This issue affects The Loops: from n/a through 1.0.2.
published:2025-01-27T15:15:12.727


Instruction: Please provide detailed information about CVE-2025-23756

CVE:CVE-2025-23756
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ivan Chernyakov LawPress – Law Firm Website Management allows Reflected XSS. This issue affects LawPress – Law Firm Website Management: from n/a through 1.4.5.
published:2025-01-27T15:15:12.877


Instruction: Please provide detailed information about CVE-2025-23849

CVE:CVE-2025-23849
Description:Missing Authorization vulnerability in Benjamin Piwowarski PAPERCITE allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PAPERCITE: from n/a through 0.5.18.
published:2025-01-27T15:15:13.087


Instruction: Please provide detailed information about CVE-2025-23982

CVE:CVE-2025-23982
Description:Missing Authorization vulnerability in Marian Kanev Cab fare calculator allows Stored XSS. This issue affects Cab fare calculator: from n/a through 1.1.
published:2025-01-27T15:15:13.247


Instruction: Please provide detailed information about CVE-2025-24537

CVE:CVE-2025-24537
Description:Cross-Site Request Forgery (CSRF) vulnerability in The Events Calendar The Events Calendar allows Cross Site Request Forgery. This issue affects The Events Calendar: from n/a through 6.7.0.
published:2025-01-27T15:15:13.440


Instruction: Please provide detailed information about CVE-2025-24538

CVE:CVE-2025-24538
Description:Cross-Site Request Forgery (CSRF) vulnerability in slaFFik BuddyPress Groups Extras allows Cross Site Request Forgery. This issue affects BuddyPress Groups Extras: from n/a through 3.6.10.
published:2025-01-27T15:15:13.607


Instruction: Please provide detailed information about CVE-2025-24540

CVE:CVE-2025-24540
Description:Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd allows Cross Site Request Forgery. This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through 6.18.9.
published:2025-01-27T15:15:13.753


Instruction: Please provide detailed information about CVE-2025-24590

CVE:CVE-2025-24590
Description:Missing Authorization vulnerability in Haptiq picu – Online Photo Proofing Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects picu – Online Photo Proofing Gallery: from n/a through 2.4.0.
published:2025-01-27T15:15:13.947


Instruction: Please provide detailed information about CVE-2025-24593

CVE:CVE-2025-24593
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge allows Reflected XSS. This issue affects Edwiser Bridge: from n/a through 3.0.8.
published:2025-01-27T15:15:14.090


Instruction: Please provide detailed information about CVE-2025-24600

CVE:CVE-2025-24600
Description:Missing Authorization vulnerability in David F. Carr RSVPMarker . This issue affects RSVPMarker : from n/a through 11.4.5.
published:2025-01-27T15:15:14.233


Instruction: Please provide detailed information about CVE-2025-24603

CVE:CVE-2025-24603
Description:Missing Authorization vulnerability in UkrSolution Print Barcode Labels for your WooCommerce products/orders. This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through 3.4.10.
published:2025-01-27T15:15:14.437


Instruction: Please provide detailed information about CVE-2025-24606

CVE:CVE-2025-24606
Description:Missing Authorization vulnerability in Sprout Invoices Client Invoicing by Sprout Invoices allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Client Invoicing by Sprout Invoices: from n/a through 20.8.1.
published:2025-01-27T15:15:14.587


Instruction: Please provide detailed information about CVE-2025-24626

CVE:CVE-2025-24626
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Music Store allows Reflected XSS. This issue affects Music Store: from n/a through 1.1.19.
published:2025-01-27T15:15:14.777


Instruction: Please provide detailed information about CVE-2025-24628

CVE:CVE-2025-24628
Description:Authentication Bypass by Spoofing vulnerability in BestWebSoft Google Captcha allows Identity Spoofing. This issue affects Google Captcha: from n/a through 1.78.
published:2025-01-27T15:15:14.923


Instruction: Please provide detailed information about CVE-2025-24653

CVE:CVE-2025-24653
Description:Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.
published:2025-01-27T15:15:15.070


Instruction: Please provide detailed information about CVE-2025-24662

CVE:CVE-2025-24662
Description:Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnDash LMS: from n/a through 4.20.0.1.
published:2025-01-27T15:15:15.227


Instruction: Please provide detailed information about CVE-2025-24665

CVE:CVE-2025-24665
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology Small Package Quotes – Unishippers Edition allows SQL Injection. This issue affects Small Package Quotes – Unishippers Edition: from n/a through 2.4.8.
published:2025-01-27T15:15:15.427


Instruction: Please provide detailed information about CVE-2025-24667

CVE:CVE-2025-24667
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology Small Package Quotes – Worldwide Express Edition allows SQL Injection. This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through 5.2.17.
published:2025-01-27T15:15:15.563


Instruction: Please provide detailed information about CVE-2025-24671

CVE:CVE-2025-24671
Description:Deserialization of Untrusted Data vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Object Injection. This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 4.4.0.
published:2025-01-27T15:15:15.703


Instruction: Please provide detailed information about CVE-2025-24680

CVE:CVE-2025-24680
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WpMultiStoreLocator WP Multi Store Locator allows Reflected XSS. This issue affects WP Multi Store Locator: from n/a through 2.4.7.
published:2025-01-27T15:15:15.863


Instruction: Please provide detailed information about CVE-2025-24689

CVE:CVE-2025-24689
Description:Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in codection Import and export users and customers allows Retrieve Embedded Sensitive Data. This issue affects Import and export users and customers: from n/a through 1.27.12.
published:2025-01-27T15:15:16.073


Instruction: Please provide detailed information about CVE-2025-24708

CVE:CVE-2025-24708
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms allows Reflected XSS. This issue affects WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through 1.1.6.
published:2025-01-27T15:15:16.230


Instruction: Please provide detailed information about CVE-2025-24734

CVE:CVE-2025-24734
Description:Missing Authorization vulnerability in CodeSolz Better Find and Replace allows Privilege Escalation. This issue affects Better Find and Replace: from n/a through 1.6.7.
published:2025-01-27T15:15:16.390


Instruction: Please provide detailed information about CVE-2025-24740

CVE:CVE-2025-24740
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress. This issue affects LearnPress: from n/a through 4.2.7.1.
published:2025-01-27T15:15:16.537


Instruction: Please provide detailed information about CVE-2025-24741

CVE:CVE-2025-24741
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KB Support KB Support. This issue affects KB Support: from n/a through 1.6.7.
published:2025-01-27T15:15:16.680


Instruction: Please provide detailed information about CVE-2025-24742

CVE:CVE-2025-24742
Description:Cross-Site Request Forgery (CSRF) vulnerability in WP Go Maps (formerly WP Google Maps) WP Go Maps. This issue affects WP Go Maps: from n/a through 9.0.40.
published:2025-01-27T15:15:16.830


Instruction: Please provide detailed information about CVE-2025-24743

CVE:CVE-2025-24743
Description:Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor. This issue affects RomethemeKit For Elementor: from n/a through 1.5.2.
published:2025-01-27T15:15:16.977


Instruction: Please provide detailed information about CVE-2025-24744

CVE:CVE-2025-24744
Description:Missing Authorization vulnerability in NotFound Bridge Core. This issue affects Bridge Core: from n/a through 3.3.
published:2025-01-27T15:15:17.117


Instruction: Please provide detailed information about CVE-2025-24747

CVE:CVE-2025-24747
Description:Missing Authorization vulnerability in Houzez.co Houzez. This issue affects Houzez: from n/a through 3.4.0.
published:2025-01-27T15:15:17.253


Instruction: Please provide detailed information about CVE-2025-24782

CVE:CVE-2025-24782
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate allows PHP Local File Inclusion. This issue affects Post Grid, Slider & Carousel Ultimate: from n/a through 1.6.10.
published:2025-01-27T15:15:17.450


Instruction: Please provide detailed information about CVE-2025-24783

CVE:CVE-2025-24783
Description:** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon.  This issue affects Apache Cocoon: all versions.  When a continuation is created, it gets a random identifier. Because the random number generator used to generate these identifiers was seeded with the startup time, it may not have been sufficiently unpredictable, and an attacker could use this to guess continuation ids and look up continuations they should not have had access to.  As a mitigation, you may enable the "session-bound-continuations" option to make sure continuations are not shared across sessions.   As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.  NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-01-27T15:15:17.610


Instruction: Please provide detailed information about CVE-2025-0729

CVE:CVE-2025-0729
Description:A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to clickjacking. The attack may be initiated remotely. Upgrading to version 1.0.0 Build 20250124 Rel. 54920(Beta) is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early. They reacted very professional and provided a pre-fix version for their customers.
published:2025-01-27T17:15:16.917


Instruction: Please provide detailed information about CVE-2025-0730

CVE:CVE-2025-0730
Description:A vulnerability classified as problematic has been found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. Affected is an unknown function of the file /usr_account_set.cgi of the component HTTP GET Request Handler. The manipulation of the argument username/password leads to use of get request method with sensitive query strings. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.0 Build 20250124 Rel. 54920(Beta) is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early. They reacted very professional and provided a pre-fix version for their customers.
published:2025-01-27T17:15:17.133


Instruction: Please provide detailed information about CVE-2025-22604

CVE:CVE-2025-22604
Description:Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.
published:2025-01-27T17:15:17.307


Instruction: Please provide detailed information about CVE-2025-0732

CVE:CVE-2025-0732
Description:A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-27T18:15:40.550


Instruction: Please provide detailed information about CVE-2025-0733

CVE:CVE-2025-0733
Description:A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-27T18:15:40.760


Instruction: Please provide detailed information about CVE-2025-23197

CVE:CVE-2025-23197
Description:matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.
published:2025-01-27T18:15:41.037


Instruction: Please provide detailed information about CVE-2025-24354

CVE:CVE-2025-24354
Description:imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.
published:2025-01-27T18:15:41.197


Instruction: Please provide detailed information about CVE-2025-24356

CVE:CVE-2025-24356
Description:fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast reconnect" avoids having to wait for a session timeout (up to ~90s) until a new connection is established. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake packet (~150 bytes of UDP payload). Including IPv4 and UDP headers, the resulting amplification factor is roughly 12-13. By sending data packets with a spoofed source address to fastd instances reachable on the internet, this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack. This vulnerability is fixed in v23.
published:2025-01-27T18:15:41.347


Instruction: Please provide detailed information about CVE-2025-24357

CVE:CVE-2025-24357
Description:vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When torch.load loads malicious pickle data, it will execute arbitrary code during unpickling. This vulnerability is fixed in v0.7.0.
published:2025-01-27T18:15:41.523


Instruction: Please provide detailed information about CVE-2025-24364

CVE:CVE-2025-24364
Description:vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker with authenticated access to the vaultwarden admin panel can execute arbitrary code in the system. The attacker could then change some settings to use sendmail as mail agent but adjust the settings in such a way that it would use a shell command. It then also needed to craft a special favicon image which would have the commands embedded to run during for example sending a test email. This vulnerability is fixed in 1.33.0.
published:2025-01-27T18:15:41.690


Instruction: Please provide detailed information about CVE-2025-24365

CVE:CVE-2025-24365
Description:vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.
published:2025-01-27T18:15:41.847


Instruction: Please provide detailed information about CVE-2025-24367

CVE:CVE-2025-24367
Description:Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
published:2025-01-27T18:15:42.003


Instruction: Please provide detailed information about CVE-2025-24368

CVE:CVE-2025-24368
Description:Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
published:2025-01-27T18:15:42.157


Instruction: Please provide detailed information about CVE-2025-0734

CVE:CVE-2025-0734
Description:A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-27T19:15:19.130


Instruction: Please provide detailed information about CVE-2025-0751

CVE:CVE-2025-0751
Description:A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0. This affects the function AP4_BitReader::ReadBits of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-27T20:15:34.587


Instruction: Please provide detailed information about CVE-2025-0753

CVE:CVE-2025-0753
Description:A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0. This vulnerability affects the function AP4_StdcFileByteStream::ReadPartial of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-27T21:15:13.653


Instruction: Please provide detailed information about CVE-2025-24085

CVE:CVE-2025-24085
Description:A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 17.2.
published:2025-01-27T22:15:14.990


Instruction: Please provide detailed information about CVE-2025-24086

CVE:CVE-2025-24086
Description:The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.4, macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing an image may lead to a denial-of-service.
published:2025-01-27T22:15:15.080


Instruction: Please provide detailed information about CVE-2025-24087

CVE:CVE-2025-24087
Description:The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protected user data.
published:2025-01-27T22:15:15.180


Instruction: Please provide detailed information about CVE-2025-24092

CVE:CVE-2025-24092
Description:This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to read sensitive location information.
published:2025-01-27T22:15:15.267


Instruction: Please provide detailed information about CVE-2025-24093

CVE:CVE-2025-24093
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sonoma 14.7.3. An app may be able to access removable volumes without user consent.
published:2025-01-27T22:15:15.350


Instruction: Please provide detailed information about CVE-2025-24094

CVE:CVE-2025-24094
Description:A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to access user-sensitive data.
published:2025-01-27T22:15:15.450


Instruction: Please provide detailed information about CVE-2025-24096

CVE:CVE-2025-24096
Description:This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. A malicious app may be able to access arbitrary files.
published:2025-01-27T22:15:15.533


Instruction: Please provide detailed information about CVE-2025-24100

CVE:CVE-2025-24100
Description:A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to access information about a user's contacts.
published:2025-01-27T22:15:15.627


Instruction: Please provide detailed information about CVE-2025-24101

CVE:CVE-2025-24101
Description:This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data.
published:2025-01-27T22:15:15.717


Instruction: Please provide detailed information about CVE-2025-24102

CVE:CVE-2025-24102
Description:The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to determine a user’s current location.
published:2025-01-27T22:15:15.807


Instruction: Please provide detailed information about CVE-2025-24103

CVE:CVE-2025-24103
Description:This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to access protected user data.
published:2025-01-27T22:15:15.900


Instruction: Please provide detailed information about CVE-2025-24104

CVE:CVE-2025-24104
Description:This issue was addressed with improved handling of symlinks. This issue is fixed in iPadOS 17.7.4, iOS 18.3 and iPadOS 18.3. Restoring a maliciously crafted backup file may lead to modification of protected system files.
published:2025-01-27T22:15:15.983


Instruction: Please provide detailed information about CVE-2025-24106

CVE:CVE-2025-24106
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. Parsing a file may lead to an unexpected app termination.
published:2025-01-27T22:15:16.070


Instruction: Please provide detailed information about CVE-2025-24107

CVE:CVE-2025-24107
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.3, tvOS 18.3, watchOS 11.3, iOS 18.3 and iPadOS 18.3. A malicious app may be able to gain root privileges.
published:2025-01-27T22:15:16.170


Instruction: Please provide detailed information about CVE-2025-24108

CVE:CVE-2025-24108
Description:An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protected user data.
published:2025-01-27T22:15:16.263


Instruction: Please provide detailed information about CVE-2025-24109

CVE:CVE-2025-24109
Description:A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to access sensitive user data.
published:2025-01-27T22:15:16.347


Instruction: Please provide detailed information about CVE-2025-24112

CVE:CVE-2025-24112
Description:The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3. Parsing a file may lead to an unexpected app termination.
published:2025-01-27T22:15:16.433


Instruction: Please provide detailed information about CVE-2025-24113

CVE:CVE-2025-24113
Description:The issue was addressed with improved UI. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. Visiting a malicious website may lead to user interface spoofing.
published:2025-01-27T22:15:16.530


Instruction: Please provide detailed information about CVE-2025-24114

CVE:CVE-2025-24114
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to modify protected parts of the file system.
published:2025-01-27T22:15:16.620


Instruction: Please provide detailed information about CVE-2025-24115

CVE:CVE-2025-24115
Description:A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to read files outside of its sandbox.
published:2025-01-27T22:15:16.713


Instruction: Please provide detailed information about CVE-2025-24116

CVE:CVE-2025-24116
Description:An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to bypass Privacy preferences.
published:2025-01-27T22:15:16.803


Instruction: Please provide detailed information about CVE-2025-24117

CVE:CVE-2025-24117
Description:This issue was addressed with improved redaction of sensitive information. This issue is fixed in iPadOS 17.7.4, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3. An app may be able to fingerprint the user.
published:2025-01-27T22:15:16.900


Instruction: Please provide detailed information about CVE-2025-24118

CVE:CVE-2025-24118
Description:The issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to cause unexpected system termination or write kernel memory.
published:2025-01-27T22:15:17.033


Instruction: Please provide detailed information about CVE-2025-24120

CVE:CVE-2025-24120
Description:This issue was addressed by improved management of object lifetimes. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An attacker may be able to cause unexpected app termination.
published:2025-01-27T22:15:17.140


Instruction: Please provide detailed information about CVE-2025-24121

CVE:CVE-2025-24121
Description:A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to modify protected parts of the file system.
published:2025-01-27T22:15:17.230


Instruction: Please provide detailed information about CVE-2025-24122

CVE:CVE-2025-24122
Description:A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to modify protected parts of the file system.
published:2025-01-27T22:15:17.323


Instruction: Please provide detailed information about CVE-2025-24123

CVE:CVE-2025-24123
Description:The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Parsing a file may lead to an unexpected app termination.
published:2025-01-27T22:15:17.413


Instruction: Please provide detailed information about CVE-2025-24124

CVE:CVE-2025-24124
Description:The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Parsing a file may lead to an unexpected app termination.
published:2025-01-27T22:15:17.510


Instruction: Please provide detailed information about CVE-2025-24126

CVE:CVE-2025-24126
Description:An input validation issue was addressed. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. An attacker on the local network may be able to cause unexpected system termination or corrupt process memory.
published:2025-01-27T22:15:17.603


Instruction: Please provide detailed information about CVE-2025-24127

CVE:CVE-2025-24127
Description:The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3. Parsing a file may lead to an unexpected app termination.
published:2025-01-27T22:15:17.703


Instruction: Please provide detailed information about CVE-2025-24128

CVE:CVE-2025-24128
Description:The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3. Visiting a malicious website may lead to address bar spoofing.
published:2025-01-27T22:15:17.793


Instruction: Please provide detailed information about CVE-2025-24129

CVE:CVE-2025-24129
Description:A type confusion issue was addressed with improved checks. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A remote attacker may cause an unexpected app termination.
published:2025-01-27T22:15:17.887


Instruction: Please provide detailed information about CVE-2025-24130

CVE:CVE-2025-24130
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to modify protected parts of the file system.
published:2025-01-27T22:15:17.977


Instruction: Please provide detailed information about CVE-2025-24131

CVE:CVE-2025-24131
Description:The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. An attacker in a privileged position may be able to perform a denial-of-service.
published:2025-01-27T22:15:18.070


Instruction: Please provide detailed information about CVE-2025-24134

CVE:CVE-2025-24134
Description:An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data.
published:2025-01-27T22:15:18.153


Instruction: Please provide detailed information about CVE-2025-24135

CVE:CVE-2025-24135
Description:This issue was addressed with improved message validation. This issue is fixed in macOS Sequoia 15.3. An app may be able to gain elevated privileges.
published:2025-01-27T22:15:18.247


Instruction: Please provide detailed information about CVE-2025-24136

CVE:CVE-2025-24136
Description:This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. A malicious app may be able to create symlinks to protected regions of the disk.
published:2025-01-27T22:15:18.340


Instruction: Please provide detailed information about CVE-2025-24137

CVE:CVE-2025-24137
Description:A type confusion issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A remote attacker may cause an unexpected application termination or arbitrary code execution.
published:2025-01-27T22:15:18.433


Instruction: Please provide detailed information about CVE-2025-24138

CVE:CVE-2025-24138
Description:This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. A malicious application may be able to leak sensitive user information.
published:2025-01-27T22:15:18.530


Instruction: Please provide detailed information about CVE-2025-24139

CVE:CVE-2025-24139
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. Parsing a maliciously crafted file may lead to an unexpected app termination.
published:2025-01-27T22:15:18.627


Instruction: Please provide detailed information about CVE-2025-24140

CVE:CVE-2025-24140
Description:This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. Files downloaded from the internet may not have the quarantine flag applied.
published:2025-01-27T22:15:18.710


Instruction: Please provide detailed information about CVE-2025-24141

CVE:CVE-2025-24141
Description:An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3. An attacker with physical access to an unlocked device may be able to access Photos while the app is locked.
published:2025-01-27T22:15:18.800


Instruction: Please provide detailed information about CVE-2025-24143

CVE:CVE-2025-24143
Description:The issue was addressed with improved access restrictions to the file system. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. A maliciously crafted webpage may be able to fingerprint the user.
published:2025-01-27T22:15:18.893


Instruction: Please provide detailed information about CVE-2025-24145

CVE:CVE-2025-24145
Description:A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.3, iOS 18.3 and iPadOS 18.3. An app may be able to view a contact's phone number in system logs.
published:2025-01-27T22:15:18.990


Instruction: Please provide detailed information about CVE-2025-24146

CVE:CVE-2025-24146
Description:This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. Deleting a conversation in Messages may expose user contact information in system logging.
published:2025-01-27T22:15:19.077


Instruction: Please provide detailed information about CVE-2025-24149

CVE:CVE-2025-24149
Description:An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iPadOS 17.7.4, macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Parsing a file may lead to disclosure of user information.
published:2025-01-27T22:15:19.173


Instruction: Please provide detailed information about CVE-2025-24150

CVE:CVE-2025-24150
Description:A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3. Copying a URL from Web Inspector may lead to command injection.
published:2025-01-27T22:15:19.270


Instruction: Please provide detailed information about CVE-2025-24151

CVE:CVE-2025-24151
Description:The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to cause unexpected system termination or corrupt kernel memory.
published:2025-01-27T22:15:19.360


Instruction: Please provide detailed information about CVE-2025-24152

CVE:CVE-2025-24152
Description:The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3. An app may be able to cause unexpected system termination or corrupt kernel memory.
published:2025-01-27T22:15:19.443


Instruction: Please provide detailed information about CVE-2025-24153

CVE:CVE-2025-24153
Description:A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3. An app with root privileges may be able to execute arbitrary code with kernel privileges.
published:2025-01-27T22:15:19.537


Instruction: Please provide detailed information about CVE-2025-24154

CVE:CVE-2025-24154
Description:An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. An attacker may be able to cause unexpected system termination or corrupt kernel memory.
published:2025-01-27T22:15:19.620


Instruction: Please provide detailed information about CVE-2025-24156

CVE:CVE-2025-24156
Description:An integer overflow was addressed through improved input validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to elevate privileges.
published:2025-01-27T22:15:19.710


Instruction: Please provide detailed information about CVE-2025-24158

CVE:CVE-2025-24158
Description:The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing web content may lead to a denial-of-service.
published:2025-01-27T22:15:19.800


Instruction: Please provide detailed information about CVE-2025-24159

CVE:CVE-2025-24159
Description:A validation issue was addressed with improved logic. This issue is fixed in iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. An app may be able to execute arbitrary code with kernel privileges.
published:2025-01-27T22:15:19.897


Instruction: Please provide detailed information about CVE-2025-24160

CVE:CVE-2025-24160
Description:The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Parsing a file may lead to an unexpected app termination.
published:2025-01-27T22:15:19.987


Instruction: Please provide detailed information about CVE-2025-24161

CVE:CVE-2025-24161
Description:The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Parsing a file may lead to an unexpected app termination.
published:2025-01-27T22:15:20.083


Instruction: Please provide detailed information about CVE-2025-24162

CVE:CVE-2025-24162
Description:This issue was addressed through improved state management. This issue is fixed in visionOS 2.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing maliciously crafted web content may lead to an unexpected process crash.
published:2025-01-27T22:15:20.167


Instruction: Please provide detailed information about CVE-2025-24163

CVE:CVE-2025-24163
Description:The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Parsing a file may lead to an unexpected app termination.
published:2025-01-27T22:15:20.267


Instruction: Please provide detailed information about CVE-2025-24166

CVE:CVE-2025-24166
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-01-27T22:15:20.357


Instruction: Please provide detailed information about CVE-2025-24169

CVE:CVE-2025-24169
Description:A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.3, Safari 18.3. A malicious app may be able to bypass browser extension authentication.
published:2025-01-27T22:15:20.460


Instruction: Please provide detailed information about CVE-2025-24174

CVE:CVE-2025-24174
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to bypass Privacy preferences.
published:2025-01-27T22:15:20.547


Instruction: Please provide detailed information about CVE-2025-24176

CVE:CVE-2025-24176
Description:A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. A local attacker may be able to elevate their privileges.
published:2025-01-27T22:15:20.643


Instruction: Please provide detailed information about CVE-2025-24177

CVE:CVE-2025-24177
Description:A null pointer dereference was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.3, iOS 18.3 and iPadOS 18.3. A remote attacker may be able to cause a denial-of-service.
published:2025-01-27T22:15:20.750


Instruction: Please provide detailed information about CVE-2025-24369

CVE:CVE-2025-24369
Description:Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scraping from multiple IP addresses. Anubis allows attackers to bypass the bot protection by requesting a challenge, formulates any nonce (such as 42069), and then passes the challenge with difficulty zero. Commit e09d0226a628f04b1d80fd83bee777894a45cd02 fixes this behavior by not using a client-specified difficulty value.
published:2025-01-27T23:15:11.310


Instruction: Please provide detailed information about CVE-2025-22865

CVE:CVE-2025-22865
Description:Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
published:2025-01-28T02:15:29.243


Instruction: Please provide detailed information about CVE-2025-23084

CVE:CVE-2025-23084
Description:A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.

 On Windows, a path that does not start with the file separator is treated as relative to the current directory.

 This vulnerability affects Windows users of `path.join` API.
published:2025-01-28T05:15:11.267


Instruction: Please provide detailed information about CVE-2025-24810

CVE:CVE-2025-24810
Description:Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege and accessing the settings screen.
published:2025-01-28T05:15:11.413


Instruction: Please provide detailed information about CVE-2025-0321

CVE:CVE-2025-0321
Description:The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-01-28T08:15:29.810


Instruction: Please provide detailed information about CVE-2025-0290

CVE:CVE-2025-0290
Description:An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 prior to 17.5.5, from 17.6 prior to 17.6.3, and from 17.7 prior to 17.7.1. Under certain conditions, processing of CI artifacts metadata could cause background jobs to become unresponsive.
published:2025-01-28T09:15:09.363


Instruction: Please provide detailed information about CVE-2025-0736

CVE:CVE-2025-0736
Description:A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure can lead to unauthorized access and exploitation by malicious actors.
published:2025-01-28T09:15:09.543


Instruction: Please provide detailed information about CVE-2025-0750

CVE:CVE-2025-0750
Description:A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
published:2025-01-28T10:15:09.317


Instruction: Please provide detailed information about CVE-2025-0752

CVE:CVE-2025-0752
Description:A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.
published:2025-01-28T10:15:09.493


Instruction: Please provide detailed information about CVE-2025-0754

CVE:CVE-2025-0754
Description:The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to log injection and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries or execute reflected cross-site scripting (XSS) attacks.
published:2025-01-28T10:15:09.697


Instruction: Please provide detailed information about CVE-2025-0065

CVE:CVE-2025-0065
Description:Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker with local unprivileged access on a Windows system to elevate privileges via argument injection.
published:2025-01-28T11:15:07.413


Instruction: Please provide detailed information about CVE-2025-0432

CVE:CVE-2025-0432
Description:EWON Flexy 202 transmits user credentials in clear text with no encryption when a user is added, or user credentials are changed via its webpage.
published:2025-01-28T16:15:40.183


Instruction: Please provide detailed information about CVE-2025-0659

CVE:CVE-2025-0659
Description:A path traversal vulnerability exists in the Rockwell Automation DataEdge Platform DataMosaix Private Cloud. By specifying the character sequence in the body of the vulnerable endpoint, it is possible to overwrite files outside of the intended directory. A threat actor with admin privileges could leverage this vulnerability to overwrite reports including user projects.
published:2025-01-28T16:15:40.360


Instruction: Please provide detailed information about CVE-2025-23045

CVE:CVE-2025-23045
Description:Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run any of the serverless functions of type tracker from the CVAT Git repository, namely TransT and SiamMask. Deployments with custom functions of type tracker may also be affected, depending on how they handle state serialization. If a function uses an unsafe serialization library such as pickle or jsonpickle, it's likely to be vulnerable. Upgrade to CVAT 2.26.0 or later. If you are unable to upgrade, shut down any instances of the TransT or SiamMask functions you're running.
published:2025-01-28T16:15:40.690


Instruction: Please provide detailed information about CVE-2025-23211

CVE:CVE-2025-23211
Description:Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
published:2025-01-28T16:15:40.937


Instruction: Please provide detailed information about CVE-2025-23212

CVE:CVE-2025-23212
Description:Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28.
published:2025-01-28T16:15:41.080


Instruction: Please provide detailed information about CVE-2025-23213

CVE:CVE-2025-23213
Description:Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.
published:2025-01-28T16:15:41.217


Instruction: Please provide detailed information about CVE-2025-23385

CVE:CVE-2025-23385
Description:In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible
published:2025-01-28T16:15:41.377


Instruction: Please provide detailed information about CVE-2025-24800

CVE:CVE-2025-24800
Description:Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. This could be used to steal funds or compromise other kinds of cross-chain applications. This vulnerability is fixed in 15.0.1.
published:2025-01-28T16:15:45.063


Instruction: Please provide detailed information about CVE-2025-0781

CVE:CVE-2025-0781
Description:An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level.
published:2025-01-28T17:15:25.947


Instruction: Please provide detailed information about CVE-2025-23053

CVE:CVE-2025-23053
Description:A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.
published:2025-01-28T18:15:38.987


Instruction: Please provide detailed information about CVE-2025-23054

CVE:CVE-2025-23054
Description:A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations.
published:2025-01-28T18:15:39.147


Instruction: Please provide detailed information about CVE-2025-23055

CVE:CVE-2025-23055
Description:A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.
published:2025-01-28T18:15:39.317


Instruction: Please provide detailed information about CVE-2025-23056

CVE:CVE-2025-23056
Description:A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.
published:2025-01-28T18:15:39.500


Instruction: Please provide detailed information about CVE-2025-23057

CVE:CVE-2025-23057
Description:A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface.
published:2025-01-28T18:15:39.677


Instruction: Please provide detailed information about CVE-2025-0631

CVE:CVE-2025-0631
Description:A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being sent in clear text.
published:2025-01-28T19:15:14.270


Instruction: Please provide detailed information about CVE-2025-0783

CVE:CVE-2025-0783
Description:A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpoint. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
published:2025-01-28T19:15:14.410


Instruction: Please provide detailed information about CVE-2025-22217

CVE:CVE-2025-22217
Description:Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products.   A malicious user with network access may be able to use specially crafted SQL queries to gain database access.
published:2025-01-28T19:15:14.640


Instruction: Please provide detailed information about CVE-2025-24478

CVE:CVE-2025-24478
Description:A denial-of-service vulnerability exists in the affected products. The vulnerability could allow a remote, non-privileged user to send malicious requests resulting in a major nonrecoverable fault causing a denial-of-service.
published:2025-01-28T19:15:14.777


Instruction: Please provide detailed information about CVE-2025-24479

CVE:CVE-2025-24479
Description:A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access to the Command Prompt as a higher privileged user.
published:2025-01-28T19:15:14.910


Instruction: Please provide detailed information about CVE-2025-24480

CVE:CVE-2025-24480
Description:A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation and could allow a remote attacker to run commands or code as a high privileged user.
published:2025-01-28T19:15:15.033


Instruction: Please provide detailed information about CVE-2025-0784

CVE:CVE-2025-0784
Description:A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic. This vulnerability affects unknown code of the file /v1/usuario/ of the component Registered User Handler. The manipulation leads to cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.59 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-01-28T20:15:56.230


Instruction: Please provide detailed information about CVE-2025-24481

CVE:CVE-2025-24481
Description:An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permissions being assigned to the remote debugger port and can allow for unauthenticated access to the system configuration.
published:2025-01-28T21:15:18.520


Instruction: Please provide detailed information about CVE-2025-24482

CVE:CVE-2025-24482
Description:A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions.
published:2025-01-28T21:15:18.687


Instruction: Please provide detailed information about CVE-2025-24826

CVE:CVE-2025-24826
Description:Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4625.
published:2025-01-28T21:15:18.817


Instruction: Please provide detailed information about CVE-2025-0785

CVE:CVE-2025-0785
Description:A vulnerability was found in ESAFENET CDG V5 and classified as problematic. This issue affects some unknown processing of the file /SysConfig.jsp. The manipulation of the argument help leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-28T22:15:16.227


Instruction: Please provide detailed information about CVE-2025-0786

CVE:CVE-2025-0786
Description:A vulnerability was found in ESAFENET CDG V5. It has been classified as critical. Affected is an unknown function of the file /appDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-28T22:15:16.423


Instruction: Please provide detailed information about CVE-2025-0787

CVE:CVE-2025-0787
Description:A vulnerability was found in ESAFENET CDG V5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /appDetail.jsp. The manipulation of the argument curpage leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-28T22:15:16.600


Instruction: Please provide detailed information about CVE-2025-22917

CVE:CVE-2025-22917
Description:A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payload in the web browser of a user by including a malicious payload into the 'type' parameter of list.php.
published:2025-01-28T22:15:16.770


Instruction: Please provide detailed information about CVE-2025-0788

CVE:CVE-2025-0788
Description:A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /content_top.jsp. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-28T23:15:08.427


Instruction: Please provide detailed information about CVE-2025-0789

CVE:CVE-2025-0789
Description:A vulnerability classified as critical has been found in ESAFENET CDG V5. This affects an unknown part of the file /doneDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-28T23:15:08.610


Instruction: Please provide detailed information about CVE-2025-0790

CVE:CVE-2025-0790
Description:A vulnerability classified as problematic was found in ESAFENET CDG V5. This vulnerability affects unknown code of the file /doneDetail.jsp. The manipulation of the argument curpage leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-29T00:15:08.280


Instruction: Please provide detailed information about CVE-2025-0791

CVE:CVE-2025-0791
Description:A vulnerability, which was classified as critical, has been found in ESAFENET CDG V5. This issue affects some unknown processing of the file /sdDoneDetail.jsp. The manipulation of the argument flowId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-29T00:15:08.480


Instruction: Please provide detailed information about CVE-2025-0792

CVE:CVE-2025-0792
Description:A vulnerability, which was classified as critical, was found in ESAFENET CDG V5. Affected is an unknown function of the file /sdTodoDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-29T00:15:08.653


Instruction: Please provide detailed information about CVE-2025-0793

CVE:CVE-2025-0793
Description:A vulnerability has been found in ESAFENET CDG V5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /todoDetail.jsp. The manipulation of the argument flowId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-29T01:15:07.780


Instruction: Please provide detailed information about CVE-2025-0794

CVE:CVE-2025-0794
Description:A vulnerability was found in ESAFENET CDG V5 and classified as problematic. Affected by this issue is some unknown functionality of the file /todoDetail.jsp. The manipulation of the argument curpage leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-29T01:15:07.943


Instruction: Please provide detailed information about CVE-2025-0795

CVE:CVE-2025-0795
Description:A vulnerability was found in ESAFENET CDG V5. It has been classified as problematic. This affects an unknown part of the file /todolistjump.jsp. The manipulation of the argument flowId leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-29T02:15:26.830


Instruction: Please provide detailed information about CVE-2025-0797

CVE:CVE-2025-0797
Description:A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects unknown code of the file /var/Microworld/ of the component Quarantine Handler. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-29T02:15:27.010


Instruction: Please provide detailed information about CVE-2025-0798

CVE:CVE-2025-0798
Description:A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file rtscanner of the component Quarantine Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-29T02:15:27.190


Instruction: Please provide detailed information about CVE-2025-0800

CVE:CVE-2025-0800
Description:A vulnerability classified as problematic has been found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file /pcci/admin/saveeditt.php of the component Edit Teacher. The manipulation of the argument fname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-29T02:15:27.373


Instruction: Please provide detailed information about CVE-2025-0802

CVE:CVE-2025-0802
Description:A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/View_user.php of the component Administrative Endpoint. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-29T02:15:27.550


Instruction: Please provide detailed information about CVE-2025-0803

CVE:CVE-2025-0803
Description:A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/submit_plan_new.php. The manipulation of the argument planid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-29T02:15:27.723


Instruction: Please provide detailed information about CVE-2025-23362

CVE:CVE-2025-23362
Description:The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXIF meta data. When an image is rendered and crafted EXIF meta data is processed, an arbitrary script may be executed on the web browser. Versions 2.3.2 and 2.4.0 were reported as vulnerable. According to the vendor, the product has been refactored after those old versions and the version 3.0.1 is not vulnerable.
published:2025-01-29T02:15:27.910


Instruction: Please provide detailed information about CVE-2025-0806

CVE:CVE-2025-0806
Description:A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as problematic. This issue affects some unknown processing of the file _call_job_search_ajax.php. The manipulation of the argument job_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-29T03:15:06.900


Instruction: Please provide detailed information about CVE-2025-0804

CVE:CVE-2025-0804
Description:The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via link titles in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-01-29T04:15:07.193


Instruction: Please provide detailed information about CVE-2025-0617

CVE:CVE-2025-0617
Description:An attacker with access to an HX 10.0.0  and previous versions, may send specially-crafted data to the HX console.  The malicious detection would then trigger file parsing containing exponential entity expansions in the consumer process thus causing a Denial of Service.
published:2025-01-29T11:15:09.330


Instruction: Please provide detailed information about CVE-2025-0762

CVE:CVE-2025-0762
Description:Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
published:2025-01-29T11:15:09.593


Instruction: Please provide detailed information about CVE-2025-0353

CVE:CVE-2025-0353
Description:The Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-01-29T12:15:29.477


Instruction: Please provide detailed information about CVE-2025-24374

CVE:CVE-2025-24374
Description:Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
published:2025-01-29T16:15:44.090


Instruction: Please provide detailed information about CVE-2025-24792

CVE:CVE-2025-24792
Description:Snowflake PHP PDO Driver is a driver that uses the PHP Data Objects (PDO) extension to connect to the Snowflake database. Snowflake discovered and remediated a vulnerability in the Snowflake PHP PDO Driver where executing unsupported queries like PUT or GET on stages causes a signed-to-unsigned conversion error that crashes the application using the Driver. This vulnerability affects versions 0.2.0 through 3.0.3. Snowflake fixed the issue in version 3.1.0.
published:2025-01-29T16:15:44.273


Instruction: Please provide detailed information about CVE-2025-24527

CVE:CVE-2025-24527
Description:An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connector GUID, they can execute debug commands on that connector.
published:2025-01-29T17:15:29.873


Instruction: Please provide detailed information about CVE-2025-24791

CVE:CVE-2025-24791
Description:snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2.
published:2025-01-29T17:15:30.020


Instruction: Please provide detailed information about CVE-2025-24789

CVE:CVE-2025-24789
Description:Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write access to a directory in the %PATH% can escalate their privileges to the user that runs the vulnerable JDBC Driver version. This vulnerability affects versions 3.2.3 through 3.21.0 on Windows. Snowflake fixed the issue in version 3.22.0.
published:2025-01-29T18:15:47.030


Instruction: Please provide detailed information about CVE-2025-24790

CVE:CVE-2025-24790
Description:Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporary credential caching is enabled, the Snowflake JDBC Driver will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 3.6.8 through 3.21.0. Snowflake fixed the issue in version 3.22.0.
published:2025-01-29T18:15:47.207


Instruction: Please provide detailed information about CVE-2025-24882

CVE:CVE-2025-24882
Description:regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1.
published:2025-01-29T18:15:47.570


Instruction: Please provide detailed information about CVE-2025-0840

CVE:CVE-2025-0840
Description:A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.
published:2025-01-29T20:15:35.007


Instruction: Please provide detailed information about CVE-2025-20014

CVE:CVE-2025-20014
Description:mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.
published:2025-01-29T20:15:35.207


Instruction: Please provide detailed information about CVE-2025-20061

CVE:CVE-2025-20061
Description:mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.
published:2025-01-29T20:15:35.363


Instruction: Please provide detailed information about CVE-2025-0841

CVE:CVE-2025-0841
Description:A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
published:2025-01-29T21:15:20.973


Instruction: Please provide detailed information about CVE-2025-24788

CVE:CVE-2025-24788
Description:snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them accessible to unauthorized users on the same machine. This vulnerability affects versions 2.0.12 through 4.2.0 on Linux and macOS. Snowflake fixed the issue in version 4.3.0.
published:2025-01-29T21:15:21.140


Instruction: Please provide detailed information about CVE-2025-24793

CVE:CVE-2025-24793
Description:The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
published:2025-01-29T21:15:21.270


Instruction: Please provide detailed information about CVE-2025-24794

CVE:CVE-2025-24794
Description:The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
published:2025-01-29T21:15:21.397


Instruction: Please provide detailed information about CVE-2025-24795

CVE:CVE-2025-24795
Description:The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
published:2025-01-29T21:15:21.533


Instruction: Please provide detailed information about CVE-2025-24884

CVE:CVE-2025-24884
Description:kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.
published:2025-01-29T21:15:21.667


Instruction: Please provide detailed information about CVE-2025-0842

CVE:CVE-2025-0842
Description:A vulnerability was found in needyamin Library Card System 1.0 and classified as critical. This issue affects some unknown processing of the file admin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-29T22:15:30.283


Instruction: Please provide detailed information about CVE-2025-0851

CVE:CVE-2025-0851
Description:A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
published:2025-01-29T22:15:30.463


Instruction: Please provide detailed information about CVE-2025-0843

CVE:CVE-2025-0843
Description:A vulnerability was found in needyamin Library Card System 1.0. It has been classified as critical. Affected is an unknown function of the file admindashboard.php of the component Admin Panel. The manipulation of the argument email/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-29T23:15:23.110


Instruction: Please provide detailed information about CVE-2025-21396

CVE:CVE-2025-21396
Description:Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network.
published:2025-01-29T23:15:32.640


Instruction: Please provide detailed information about CVE-2025-21415

CVE:CVE-2025-21415
Description:Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.
published:2025-01-29T23:15:33.190


Instruction: Please provide detailed information about CVE-2025-0844

CVE:CVE-2025-0844
Description:A vulnerability was found in needyamin Library Card System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file signup.php of the component Registration Page. The manipulation of the argument firstname/lastname/email/borrow/user_address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-01-30T00:15:41.920


Instruction: Please provide detailed information about CVE-2025-0846

CVE:CVE-2025-0846
Description:A vulnerability was found in 1000 Projects Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/AdminLogin.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-30T01:15:13.993


Instruction: Please provide detailed information about CVE-2025-0847

CVE:CVE-2025-0847
Description:A vulnerability was found in 1000 Projects Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-30T02:15:25.403


Instruction: Please provide detailed information about CVE-2025-0848

CVE:CVE-2025-0848
Description:A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapsk_crypto5g leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-30T02:15:25.597


Instruction: Please provide detailed information about CVE-2025-0849

CVE:CVE-2025-0849
Description:A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of the component Staff Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-30T02:15:25.783


Instruction: Please provide detailed information about CVE-2025-0373

CVE:CVE-2025-0373
Description:On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buffer overflow.  A NFS server that exports a cd9660, tarfs, or ext2fs file system can be made to panic by mounting and accessing the export with an NFS client.  Further exploitation (e.g., bypassing file permission checking or remote kernel code execution) is potentially possible, though this has not been demonstrated.  In particular, release kernels are compiled with stack protection enabled, and some instances of the overflow are caught by this mechanism, causing a panic.
published:2025-01-30T05:15:09.590


Instruction: Please provide detailed information about CVE-2025-0374

CVE:CVE-2025-0374
Description:When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts.  This version does not preserve the mode of the input file, and is world-readable.  This applies to files that would normally have restricted visibility, such as /etc/master.passwd.  An unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts.  This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved.
published:2025-01-30T05:15:10.527


Instruction: Please provide detailed information about CVE-2025-0662

CVE:CVE-2025-0662
Description:In some cases, the ktrace facility will log the contents of kernel structures to userspace.  In one such case, ktrace dumps a variable-sized sockaddr to userspace.  There, the full sockaddr is copied, even when it is shorter than the full size.  This can result in up to 14 uninitialized bytes of kernel memory being copied out to userspace.  It is possible for an unprivileged userspace program to leak 14 bytes of a kernel heap allocation to userspace.
published:2025-01-30T05:15:10.653


Instruction: Please provide detailed information about CVE-2025-23374

CVE:CVE-2025-23374
Description:Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
published:2025-01-30T05:15:10.787


Instruction: Please provide detailed information about CVE-2025-0834

CVE:CVE-2025-0834
Description:Privilege escalation vulnerability has been found in Wondershare Dr.Fone version 13.5.21. This vulnerability could allow an attacker to escalate privileges by replacing the binary ‘C:\ProgramData\Wondershare\wsServices\ElevationService.exe’ with a malicious binary. This binary will be executed by SYSTEM automatically.
published:2025-01-30T09:15:09.703


Instruction: Please provide detailed information about CVE-2025-0860

CVE:CVE-2025-0860
Description:The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-01-30T10:15:08.723


Instruction: Please provide detailed information about CVE-2025-0861

CVE:CVE-2025-0861
Description:The VR-Frases (collect & share quotes) plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 3.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-01-30T10:15:08.907


Instruction: Please provide detailed information about CVE-2025-21107

CVE:CVE-2025-21107
Description:Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
published:2025-01-30T10:15:09.100


Instruction: Please provide detailed information about CVE-2025-23007

CVE:CVE-2025-23007
Description:A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentially leading to privilege escalation.
published:2025-01-30T10:15:09.283


Instruction: Please provide detailed information about CVE-2025-0739

CVE:CVE-2025-0739
Description:An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's information of others users by changing the "SUSCBRIPTION_ID" param of the endpoint "/demos/embedai/subscriptions/show/<SUSCBRIPTION_ID>".
published:2025-01-30T11:15:11.607


Instruction: Please provide detailed information about CVE-2025-0740

CVE:CVE-2025-0740
Description:An Improper Access Control vulnerability has been found in EmbedAI   2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages belonging to other users by changing the “CHAT_ID” of the endpoint "/embedai/chats/load_messages?chat_id=<CHAT_ID>".
published:2025-01-30T11:15:11.763


Instruction: Please provide detailed information about CVE-2025-0741

CVE:CVE-2025-0741
Description:An Improper Access Control vulnerability has been found in EmbedAI   2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chat_id" of the POST request "/embedai/chats/send_message".
published:2025-01-30T11:15:11.910


Instruction: Please provide detailed information about CVE-2025-0742

CVE:CVE-2025-0742
Description:An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by others users by changing the "FILE_ID" of the endpoint "/embedai/files/show/<FILE_ID>".
published:2025-01-30T12:15:27.560


Instruction: Please provide detailed information about CVE-2025-0743

CVE:CVE-2025-0743
Description:An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint "/embedai/visits/show/<VISIT_ID>" to obtain information about the visits made by other users. The information provided by this endpoint includes IP address, userAgent and location of the user that visited the web page.
published:2025-01-30T12:15:27.707


Instruction: Please provide detailed information about CVE-2025-0744

CVE:CVE-2025-0744
Description:an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmt_cash_on_delivery/pay" endpoint.
published:2025-01-30T12:15:27.843


Instruction: Please provide detailed information about CVE-2025-0745

CVE:CVE-2025-0745
Description:An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of the database by requesting the "/embedai/app/uploads/database/<SQL_FILE>" endpoint.
published:2025-01-30T12:15:27.973


Instruction: Please provide detailed information about CVE-2025-0746

CVE:CVE-2025-0746
Description:A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a malicious URL leveraging the"/embedai/users/show/<SCRIPT>" endpoint to inject the malicious JavaScript code. This JavaScript code will be executed when a user opens the malicious URL.
published:2025-01-30T12:15:28.113


Instruction: Please provide detailed information about CVE-2025-0747

CVE:CVE-2025-0747
Description:A Stored Cross-Site Scripting vulnerability has been found in EmbedAI. This vulnerability allows an authenticated attacker to inject a malicious JavaScript code into a message that will be executed when a user opens the chat.
published:2025-01-30T12:15:28.253


Instruction: Please provide detailed information about CVE-2025-0869

CVE:CVE-2025-0869
Description:A vulnerability was found in Cianet ONU GW24AC up to 20250127. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Login. The manipulation of the argument browserLang leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-30T13:15:10.273


Instruction: Please provide detailed information about CVE-2025-0870

CVE:CVE-2025-0870
Description:A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in the library Ap4DataBuffer.h. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
published:2025-01-30T13:15:10.483


Instruction: Please provide detailed information about CVE-2025-0871

CVE:CVE-2025-0871
Description:A vulnerability classified as problematic has been found in Maybecms 1.2. This affects an unknown part of the file /mb/admin/index.php?u=article-edit of the component Add Article. The manipulation of the argument data_info[content] leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-30T15:15:18.253


Instruction: Please provide detailed information about CVE-2025-22218

CVE:CVE-2025-22218
Description:VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria Operations for Logs
published:2025-01-30T15:15:18.487


Instruction: Please provide detailed information about CVE-2025-23367

CVE:CVE-2025-23367
Description:A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server.  The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.
published:2025-01-30T15:15:18.610


Instruction: Please provide detailed information about CVE-2025-0872

CVE:CVE-2025-0872
Description:A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /addpayment.php. The manipulation of the argument id/amount/desc/inccat leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-30T16:15:30.737


Instruction: Please provide detailed information about CVE-2025-22219

CVE:CVE-2025-22219
Description:VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to inject a malicious script that  (can perform stored cross-site scripting) may lead to arbitrary operations as admin user.
published:2025-01-30T16:15:31.013


Instruction: Please provide detailed information about CVE-2025-22220

CVE:CVE-2025-22220
Description:VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user.
published:2025-01-30T16:15:31.143


Instruction: Please provide detailed information about CVE-2025-22221

CVE:CVE-2025-22221
Description:VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to inject a malicious script that could be executed in a victim's browser when performing a delete action in the Agent Configuration.
published:2025-01-30T16:15:31.257


Instruction: Please provide detailed information about CVE-2025-22222

CVE:CVE-2025-22222
Description:VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid service credential ID is known.
published:2025-01-30T16:15:31.367