Instruction: Please provide detailed information about CVE-2025-27149

CVE:CVE-2025-27149
Description:Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries (E.g., ZulipGitlabWebhook, okhttp, or PycURL) that have been used to access any organization on the server was incorrectly included in all three export types, regardless of if they were used to access the exported organization or not. The "public data" and "with consent" exports metadata including the titles of some topics in private channels which the administrator otherwise did not have access to, and none of the users consented to exporting and metadata for which users were in a group DM together. This vulnerability is fixed in 10.0.
published:2025-03-31T16:15:23.743


Instruction: Please provide detailed information about CVE-2025-29766

CVE:CVE-2025-29766
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. The vulnerability is fixed in Tuleap Community Edition 16.5.99.1741784483 and Tuleap Enterprise Edition 16.5-3 and 16.4-8.
published:2025-03-31T16:15:23.897


Instruction: Please provide detailed information about CVE-2025-29772

CVE:CVE-2025-29772
Description:OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcategory is output to the page without being properly processed. This leads to a reflected cross-site scripting (XSS) vul;nerability in CAMOS new.php. This vulnerability is fixed in 7.0.3.
published:2025-03-31T16:15:24.063


Instruction: Please provide detailed information about CVE-2025-29929

CVE:CVE-2025-29929
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742306712 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
published:2025-03-31T16:15:24.237


Instruction: Please provide detailed information about CVE-2025-30149

CVE:CVE-2025-30149
Description:OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting (XSS) in the AJAX Script interface\super\layout_listitems_ajax.php via the target parameter. This vulnerability is fixed in 7.0.3.
published:2025-03-31T16:15:25.040


Instruction: Please provide detailed information about CVE-2025-30155

CVE:CVE-2025-30155
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in the REST API. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742392651 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
published:2025-03-31T16:15:25.187


Instruction: Please provide detailed information about CVE-2025-30161

CVE:CVE-2025-30161
Description:OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form component of OpenEMR allows anyone who is able to edit a bronchitis form to steal credentials from administrators. This vulnerability is fixed in 7.0.3.
published:2025-03-31T16:15:25.333


Instruction: Please provide detailed information about CVE-2025-30203

CVE:CVE-2025-30203
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742562878 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
published:2025-03-31T16:15:25.473


Instruction: Please provide detailed information about CVE-2025-30209

CVE:CVE-2025-30209
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information via the FRS REST endpoints it should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742812323 and Tuleap Enterprise Edition 16.5-6 and 16.4-10.
published:2025-03-31T16:15:25.620


Instruction: Please provide detailed information about CVE-2025-3001

CVE:CVE-2025-3001
Description:A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
published:2025-03-31T16:15:27.277


Instruction: Please provide detailed information about CVE-2025-3002

CVE:CVE-2025-3002
Description:A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown processing of the file /usr/local/WWW/function/audit/newstatistics/mon_merge_stat_hist.php. The manipulation of the argument type_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-31T16:15:27.440


Instruction: Please provide detailed information about CVE-2025-3047

CVE:CVE-2025-3047
Description:When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A user could leverage the elevated permissions to access restricted files via symlinks and copy them to a more permissive location on the container.   Users should upgrade to v1.133.0 or newer and ensure any forked or derivative code is patched to incorporate the new fixes.
published:2025-03-31T16:15:27.683


Instruction: Please provide detailed information about CVE-2025-3048

CVE:CVE-2025-3048
Description:After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace.  Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.
published:2025-03-31T16:15:27.857


Instruction: Please provide detailed information about CVE-2025-2292

CVE:CVE-2025-2292
Description:Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35.
published:2025-03-31T17:15:40.740


Instruction: Please provide detailed information about CVE-2025-2794

CVE:CVE-2025-2794
Description:An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition.     This issue affects Xperience: through 13.0.180.
published:2025-03-31T17:15:41.333


Instruction: Please provide detailed information about CVE-2025-30004

CVE:CVE-2025-30004
Description:Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user.     This issue affects CompletePBX: all versions up to and prior to 5.2.35
published:2025-03-31T17:15:41.737


Instruction: Please provide detailed information about CVE-2025-30005

CVE:CVE-2025-30005
Description:Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete any retrieved file in place of the expected report.     This issue affects CompletePBX: all versions up to and prior to 5.2.35
published:2025-03-31T17:15:41.880


Instruction: Please provide detailed information about CVE-2025-30006

CVE:CVE-2025-30006
Description:Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel.     This issue affects CompletePBX: all versions up to and prior to 5.2.35
published:2025-03-31T17:15:42.020


Instruction: Please provide detailed information about CVE-2025-30223

CVE:CVE-2025-30223
Description:Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with user-provided data. Since it is a high-level function generating an entire form markup, many developers would assume it automatically escapes attributes (the way most frameworks do). This vulnerability is fixed in 2.3.6.
published:2025-03-31T17:15:42.147


Instruction: Please provide detailed information about CVE-2025-30368

CVE:CVE-2025-30368
Description:Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete an export of a different organization. This is fixed in Zulip Server 10.1.
published:2025-03-31T17:15:42.320


Instruction: Please provide detailed information about CVE-2025-30369

CVE:CVE-2025-30369
Description:Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed to delete custom profile fields belonging to a different organization. This is fixed in Zulip Server 10.1.
published:2025-03-31T17:15:42.497


Instruction: Please provide detailed information about CVE-2025-31116

CVE:CVE-2025-31116
Description:Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.
published:2025-03-31T17:15:42.663


Instruction: Please provide detailed information about CVE-2025-31117

CVE:CVE-2025-31117
Description:OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability was identified in OpenEMR, allowing an attacker to force the server to make unauthorized requests to external or internal resources. this attack does not return a direct response but can be exploited through DNS or HTTP interactions to exfiltrate sensitive information. This vulnerability is fixed in 7.0.3.1.
published:2025-03-31T17:15:42.833


Instruction: Please provide detailed information about CVE-2025-31122

CVE:CVE-2025-31122
Description:scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the username in the username field.
published:2025-03-31T17:15:42.997


Instruction: Please provide detailed information about CVE-2025-31125

CVE:CVE-2025-31125
Description:Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
published:2025-03-31T17:15:43.163


Instruction: Please provide detailed information about CVE-2025-3003

CVE:CVE-2025-3003
Description:A vulnerability, which was classified as critical, was found in ESAFENET CDG 3. Affected is an unknown function of the file /CDGServer3/UserAjax. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T17:15:43.557


Instruction: Please provide detailed information about CVE-2025-3004

CVE:CVE-2025-3004
Description:A vulnerability has been found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /search. The manipulation of the argument keywords leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T17:15:43.757


Instruction: Please provide detailed information about CVE-2025-3005

CVE:CVE-2025-3005
Description:A vulnerability was found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this issue is some unknown functionality of the component Friend Link Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T18:15:34.180


Instruction: Please provide detailed information about CVE-2025-3006

CVE:CVE-2025-3006
Description:A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /edit-category.php?id=8. The manipulation of the argument Category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T18:15:34.413


Instruction: Please provide detailed information about CVE-2025-29908

CVE:CVE-2025-29908
Description:Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This vulnerability is fixed in 0.0.71.Final.
published:2025-03-31T19:15:40.367


Instruction: Please provide detailed information about CVE-2025-31128

CVE:CVE-2025-31128
Description:gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 0.3.7.
published:2025-03-31T19:15:42.883


Instruction: Please provide detailed information about CVE-2025-31129

CVE:CVE-2025-31129
Description:Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).
published:2025-03-31T19:15:43.023


Instruction: Please provide detailed information about CVE-2025-3007

CVE:CVE-2025-3007
Description:A vulnerability was found in Novastar CX40 up to 2.44.0. It has been rated as critical. This issue affects the function getopt of the file /usr/nova/bin/netconfig of the component NetFilter Utility. The manipulation of the argument cmd/netmask/pipeout/nettask leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T19:15:43.860


Instruction: Please provide detailed information about CVE-2025-3008

CVE:CVE-2025-3008
Description:A vulnerability classified as critical has been found in Novastar CX40 up to 2.44.0. Affected is the function system/popen of the file /usr/nova/bin/netconfig of the component NetFilter Utility. The manipulation leads to command injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-31T19:15:44.060


Instruction: Please provide detailed information about CVE-2025-21893

CVE:CVE-2025-21893
Description:In the Linux kernel, the following vulnerability has been resolved:  keys: Fix UAF in key_put()  Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after that point.  The most key_put() is normally allowed to do is to touch key_gc_work as that's a static global variable.  However, in an effort to speed up the reclamation of quota, this is now done in key_put() once the key's usage is reduced to 0 - but now the code is looking at the key after the deadline, which is forbidden.  Fix this by using a flag to indicate that a key can be gc'd now rather than looking at the key's refcount in the garbage collector.
published:2025-03-31T20:15:14.613


Instruction: Please provide detailed information about CVE-2025-31123

CVE:CVE-2025-31123
Description:Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.
published:2025-03-31T20:15:15.547


Instruction: Please provide detailed information about CVE-2025-31124

CVE:CVE-2025-31124
Description:Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9.
published:2025-03-31T20:15:15.707


Instruction: Please provide detailed information about CVE-2025-3009

CVE:CVE-2025-3009
Description:A vulnerability classified as critical was found in Jinher Network OA C6. Affected by this vulnerability is an unknown functionality of the file /C6/JHSoft.Web.NetDisk/NetDiskProperty.aspx. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T20:15:15.850


Instruction: Please provide detailed information about CVE-2025-3010

CVE:CVE-2025-3010
Description:A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
published:2025-03-31T20:15:16.023


Instruction: Please provide detailed information about CVE-2025-3015

CVE:CVE-2025-3015
Description:A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0 is able to address this issue. The patch is named 7c705fde418d68cca4e8eff56be01b2617b0d6fe. It is recommended to apply a patch to fix this issue.
published:2025-03-31T21:15:53.757


Instruction: Please provide detailed information about CVE-2025-3016

CVE:CVE-2025-3016
Description:A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.
published:2025-03-31T21:15:53.940


Instruction: Please provide detailed information about CVE-2025-26683

CVE:CVE-2025-26683
Description:Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network.
published:2025-03-31T22:15:18.743


Instruction: Please provide detailed information about CVE-2025-31673

CVE:CVE-2025-31673
Description:Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
published:2025-03-31T22:15:19.773


Instruction: Please provide detailed information about CVE-2025-31674

CVE:CVE-2025-31674
Description:Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
published:2025-03-31T22:15:19.893


Instruction: Please provide detailed information about CVE-2025-31675

CVE:CVE-2025-31675
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5.
published:2025-03-31T22:15:20.003


Instruction: Please provide detailed information about CVE-2025-31676

CVE:CVE-2025-31676
Description:Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.
published:2025-03-31T22:15:20.113


Instruction: Please provide detailed information about CVE-2025-31677

CVE:CVE-2025-31677
Description:Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.
published:2025-03-31T22:15:20.227


Instruction: Please provide detailed information about CVE-2025-31678

CVE:CVE-2025-31678
Description:Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.
published:2025-03-31T22:15:20.330


Instruction: Please provide detailed information about CVE-2025-31679

CVE:CVE-2025-31679
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.
published:2025-03-31T22:15:20.440


Instruction: Please provide detailed information about CVE-2025-31680

CVE:CVE-2025-31680
Description:Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.
published:2025-03-31T22:15:20.550


Instruction: Please provide detailed information about CVE-2025-31681

CVE:CVE-2025-31681
Description:Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
published:2025-03-31T22:15:20.663


Instruction: Please provide detailed information about CVE-2025-31682

CVE:CVE-2025-31682
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
published:2025-03-31T22:15:20.767


Instruction: Please provide detailed information about CVE-2025-31683

CVE:CVE-2025-31683
Description:Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
published:2025-03-31T22:15:20.890


Instruction: Please provide detailed information about CVE-2025-31684

CVE:CVE-2025-31684
Description:Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.
published:2025-03-31T22:15:20.993


Instruction: Please provide detailed information about CVE-2025-31685

CVE:CVE-2025-31685
Description:Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
published:2025-03-31T22:15:21.103


Instruction: Please provide detailed information about CVE-2025-31686

CVE:CVE-2025-31686
Description:Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
published:2025-03-31T22:15:21.210


Instruction: Please provide detailed information about CVE-2025-31687

CVE:CVE-2025-31687
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.
published:2025-03-31T22:15:21.317


Instruction: Please provide detailed information about CVE-2025-31688

CVE:CVE-2025-31688
Description:Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.
published:2025-03-31T22:15:21.413


Instruction: Please provide detailed information about CVE-2025-31689

CVE:CVE-2025-31689
Description:Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.
published:2025-03-31T22:15:21.517


Instruction: Please provide detailed information about CVE-2025-31690

CVE:CVE-2025-31690
Description:Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.
published:2025-03-31T22:15:21.623


Instruction: Please provide detailed information about CVE-2025-31691

CVE:CVE-2025-31691
Description:Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.
published:2025-03-31T22:15:21.737


Instruction: Please provide detailed information about CVE-2025-31692

CVE:CVE-2025-31692
Description:Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.
published:2025-03-31T22:15:21.873


Instruction: Please provide detailed information about CVE-2025-31693

CVE:CVE-2025-31693
Description:Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.
published:2025-03-31T22:15:21.983


Instruction: Please provide detailed information about CVE-2025-31694

CVE:CVE-2025-31694
Description:Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.
published:2025-03-31T22:15:22.100


Instruction: Please provide detailed information about CVE-2025-31695

CVE:CVE-2025-31695
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.
published:2025-03-31T22:15:22.210


Instruction: Please provide detailed information about CVE-2025-31696

CVE:CVE-2025-31696
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.
published:2025-03-31T22:15:22.320


Instruction: Please provide detailed information about CVE-2025-31697

CVE:CVE-2025-31697
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.
published:2025-03-31T22:15:22.427


Instruction: Please provide detailed information about CVE-2025-3017

CVE:CVE-2025-3017
Description:A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of the file src/tools/ta_regtest/ta_test_func/test_minmax.c of the component ta_regtest. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5879180e9070ec35d52948f2f57519713256a0f1. It is recommended to apply a patch to fix this issue.
published:2025-03-31T22:15:22.807


Instruction: Please provide detailed information about CVE-2025-3018

CVE:CVE-2025-3018
Description:A vulnerability, which was classified as critical, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Users.php?f=delete. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T22:15:22.993


Instruction: Please provide detailed information about CVE-2025-3036

CVE:CVE-2025-3036
Description:A vulnerability, which was classified as problematic, was found in yzk2356911358 StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5/d4d7a0643f1dae908a4831206f2714b21820f991. This affects an unknown part of the component Student Management Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
published:2025-03-31T22:15:23.183


Instruction: Please provide detailed information about CVE-2025-3057

CVE:CVE-2025-3057
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
published:2025-03-31T22:15:23.363


Instruction: Please provide detailed information about CVE-2025-24095

CVE:CVE-2025-24095
Description:This issue was addressed with additional entitlement checks. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4. An app may be able to bypass Privacy preferences.
published:2025-03-31T23:15:16.117


Instruction: Please provide detailed information about CVE-2025-24097

CVE:CVE-2025-24097
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, tvOS 18.4, macOS Sequoia 15.4. An app may be able to read arbitrary file metadata.
published:2025-03-31T23:15:16.213


Instruction: Please provide detailed information about CVE-2025-24148

CVE:CVE-2025-24148
Description:This issue was addressed with improved handling of executable types. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious JAR file may bypass Gatekeeper checks.
published:2025-03-31T23:15:16.300


Instruction: Please provide detailed information about CVE-2025-24157

CVE:CVE-2025-24157
Description:A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to cause unexpected system termination or corrupt kernel memory.
published:2025-03-31T23:15:16.397


Instruction: Please provide detailed information about CVE-2025-24164

CVE:CVE-2025-24164
Description:A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to modify protected parts of the file system.
published:2025-03-31T23:15:16.487


Instruction: Please provide detailed information about CVE-2025-24167

CVE:CVE-2025-24167
Description:This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A download's origin may be incorrectly associated.
published:2025-03-31T23:15:16.583


Instruction: Please provide detailed information about CVE-2025-24170

CVE:CVE-2025-24170
Description:A logic issue was addressed with improved file handling. This issue is fixed in macOS Ventura 13.7.5, macOS Sonoma 14.7.5. An app may be able to gain root privileges.
published:2025-03-31T23:15:16.677


Instruction: Please provide detailed information about CVE-2025-24172

CVE:CVE-2025-24172
Description:A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. "Block All Remote Content" may not apply for all mail previews.
published:2025-03-31T23:15:16.773


Instruction: Please provide detailed information about CVE-2025-24173

CVE:CVE-2025-24173
Description:This issue was addressed with additional entitlement checks. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to break out of its sandbox.
published:2025-03-31T23:15:16.880


Instruction: Please provide detailed information about CVE-2025-24178

CVE:CVE-2025-24178
Description:This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to break out of its sandbox.
published:2025-03-31T23:15:16.983


Instruction: Please provide detailed information about CVE-2025-24180

CVE:CVE-2025-24180
Description:The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix.
published:2025-03-31T23:15:17.083


Instruction: Please provide detailed information about CVE-2025-24181

CVE:CVE-2025-24181
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access protected user data.
published:2025-03-31T23:15:17.173


Instruction: Please provide detailed information about CVE-2025-24182

CVE:CVE-2025-24182
Description:An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, tvOS 18.4, macOS Sequoia 15.4. Processing a maliciously crafted font may result in the disclosure of process memory.
published:2025-03-31T23:15:17.277


Instruction: Please provide detailed information about CVE-2025-24190

CVE:CVE-2025-24190
Description:The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
published:2025-03-31T23:15:17.370


Instruction: Please provide detailed information about CVE-2025-24191

CVE:CVE-2025-24191
Description:The issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15.4. An app may be able to modify protected parts of the file system.
published:2025-03-31T23:15:17.470


Instruction: Please provide detailed information about CVE-2025-24192

CVE:CVE-2025-24192
Description:A script imports issue was addressed with improved isolation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Visiting a website may leak sensitive data.
published:2025-03-31T23:15:17.567


Instruction: Please provide detailed information about CVE-2025-24193

CVE:CVE-2025-24193
Description:This issue was addressed with improved authentication. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker with a USB-C connection to an unlocked device may be able to programmatically access photos.
published:2025-03-31T23:15:17.703


Instruction: Please provide detailed information about CVE-2025-24194

CVE:CVE-2025-24194
Description:A logic issue was addressed with improved checks. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, tvOS 18.4, macOS Sequoia 15.4. Processing maliciously crafted web content may result in the disclosure of process memory.
published:2025-03-31T23:15:17.807


Instruction: Please provide detailed information about CVE-2025-24195

CVE:CVE-2025-24195
Description:An integer overflow was addressed with improved input validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A user may be able to elevate privileges.
published:2025-03-31T23:15:17.903


Instruction: Please provide detailed information about CVE-2025-24196

CVE:CVE-2025-24196
Description:A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker with user privileges may be able to read kernel memory.
published:2025-03-31T23:15:18.007


Instruction: Please provide detailed information about CVE-2025-24198

CVE:CVE-2025-24198
Description:This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Ventura 13.7.5, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker with physical access may be able to use Siri to access sensitive user data.
published:2025-03-31T23:15:18.103


Instruction: Please provide detailed information about CVE-2025-24199

CVE:CVE-2025-24199
Description:An uncontrolled format string issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to cause a denial-of-service.
published:2025-03-31T23:15:18.193


Instruction: Please provide detailed information about CVE-2025-24202

CVE:CVE-2025-24202
Description:A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.
published:2025-03-31T23:15:18.293


Instruction: Please provide detailed information about CVE-2025-24203

CVE:CVE-2025-24203
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to modify protected parts of the file system.
published:2025-03-31T23:15:18.383


Instruction: Please provide detailed information about CVE-2025-24204

CVE:CVE-2025-24204
Description:The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.
published:2025-03-31T23:15:18.483


Instruction: Please provide detailed information about CVE-2025-24205

CVE:CVE-2025-24205
Description:An authorization issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.5, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data.
published:2025-03-31T23:15:18.580


Instruction: Please provide detailed information about CVE-2025-24207

CVE:CVE-2025-24207
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to enable iCloud storage features without user consent.
published:2025-03-31T23:15:18.680


Instruction: Please provide detailed information about CVE-2025-24208

CVE:CVE-2025-24208
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.
published:2025-03-31T23:15:18.773


Instruction: Please provide detailed information about CVE-2025-24209

CVE:CVE-2025-24209
Description:A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 18.4, Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Processing maliciously crafted web content may lead to an unexpected process crash.
published:2025-03-31T23:15:18.870


Instruction: Please provide detailed information about CVE-2025-24210

CVE:CVE-2025-24210
Description:A logic error was addressed with improved error handling. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. Parsing an image may lead to disclosure of user information.
published:2025-03-31T23:15:18.963


Instruction: Please provide detailed information about CVE-2025-24211

CVE:CVE-2025-24211
Description:This issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
published:2025-03-31T23:15:19.087


Instruction: Please provide detailed information about CVE-2025-24212

CVE:CVE-2025-24212
Description:This issue was addressed with improved checks. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to break out of its sandbox.
published:2025-03-31T23:15:19.203


Instruction: Please provide detailed information about CVE-2025-24213

CVE:CVE-2025-24213
Description:This issue was addressed with improved handling of floats. This issue is fixed in tvOS 18.4, Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A type confusion issue could lead to memory corruption.
published:2025-03-31T23:15:19.300


Instruction: Please provide detailed information about CVE-2025-24214

CVE:CVE-2025-24214
Description:A privacy issue was addressed by not logging contents of text fields. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, tvOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.
published:2025-03-31T23:15:19.400


Instruction: Please provide detailed information about CVE-2025-24215

CVE:CVE-2025-24215
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to access private information.
published:2025-03-31T23:15:19.490


Instruction: Please provide detailed information about CVE-2025-24216

CVE:CVE-2025-24216
Description:The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.
published:2025-03-31T23:15:19.593


Instruction: Please provide detailed information about CVE-2025-24217

CVE:CVE-2025-24217
Description:This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.4 and iPadOS 18.4, tvOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.
published:2025-03-31T23:15:19.697


Instruction: Please provide detailed information about CVE-2025-24218

CVE:CVE-2025-24218
Description:A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. An app may be able to access information about a user's contacts.
published:2025-03-31T23:15:19.793


Instruction: Please provide detailed information about CVE-2025-24221

CVE:CVE-2025-24221
Description:This issue was addressed with improved data access restriction. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6. Sensitive keychain data may be accessible from an iOS backup.
published:2025-03-31T23:15:19.893


Instruction: Please provide detailed information about CVE-2025-24226

CVE:CVE-2025-24226
Description:The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information.
published:2025-03-31T23:15:19.990


Instruction: Please provide detailed information about CVE-2025-24228

CVE:CVE-2025-24228
Description:A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to execute arbitrary code with kernel privileges.
published:2025-03-31T23:15:20.080


Instruction: Please provide detailed information about CVE-2025-24229

CVE:CVE-2025-24229
Description:A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A sandboxed app may be able to access sensitive user data.
published:2025-03-31T23:15:20.180


Instruction: Please provide detailed information about CVE-2025-24230

CVE:CVE-2025-24230
Description:An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. Playing a malicious audio file may lead to an unexpected app termination.
published:2025-03-31T23:15:20.273


Instruction: Please provide detailed information about CVE-2025-24231

CVE:CVE-2025-24231
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to modify protected parts of the file system.
published:2025-03-31T23:15:20.387


Instruction: Please provide detailed information about CVE-2025-24232

CVE:CVE-2025-24232
Description:This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to access arbitrary files.
published:2025-03-31T23:15:20.480


Instruction: Please provide detailed information about CVE-2025-24233

CVE:CVE-2025-24233
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to read or write to protected files.
published:2025-03-31T23:15:20.583


Instruction: Please provide detailed information about CVE-2025-24234

CVE:CVE-2025-24234
Description:This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to gain root privileges.
published:2025-03-31T23:15:20.673


Instruction: Please provide detailed information about CVE-2025-24235

CVE:CVE-2025-24235
Description:A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A remote attacker may be able to cause unexpected app termination or heap corruption.
published:2025-03-31T23:15:20.770


Instruction: Please provide detailed information about CVE-2025-24236

CVE:CVE-2025-24236
Description:An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access sensitive user data.
published:2025-03-31T23:15:20.867


Instruction: Please provide detailed information about CVE-2025-24237

CVE:CVE-2025-24237
Description:A buffer overflow was addressed with improved bounds checking. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to cause unexpected system termination.
published:2025-03-31T23:15:20.957


Instruction: Please provide detailed information about CVE-2025-24238

CVE:CVE-2025-24238
Description:A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, tvOS 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to gain elevated privileges.
published:2025-03-31T23:15:21.060


Instruction: Please provide detailed information about CVE-2025-24239

CVE:CVE-2025-24239
Description:A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.
published:2025-03-31T23:15:21.157


Instruction: Please provide detailed information about CVE-2025-24240

CVE:CVE-2025-24240
Description:A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data.
published:2025-03-31T23:15:21.247


Instruction: Please provide detailed information about CVE-2025-24241

CVE:CVE-2025-24241
Description:A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to trick a user into copying sensitive data to the pasteboard.
published:2025-03-31T23:15:21.337


Instruction: Please provide detailed information about CVE-2025-24242

CVE:CVE-2025-24242
Description:This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app with root privileges may be able to access private information.
published:2025-03-31T23:15:21.433


Instruction: Please provide detailed information about CVE-2025-24243

CVE:CVE-2025-24243
Description:The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. Processing a maliciously crafted file may lead to arbitrary code execution.
published:2025-03-31T23:15:21.520


Instruction: Please provide detailed information about CVE-2025-24244

CVE:CVE-2025-24244
Description:The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. Processing a maliciously crafted font may result in the disclosure of process memory.
published:2025-03-31T23:15:21.620


Instruction: Please provide detailed information about CVE-2025-24245

CVE:CVE-2025-24245
Description:This issue was addressed by adding a delay between verification code attempts. This issue is fixed in macOS Sequoia 15.4. A malicious app may be able to access a user's saved passwords.
published:2025-03-31T23:15:21.720


Instruction: Please provide detailed information about CVE-2025-24246

CVE:CVE-2025-24246
Description:An injection issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data.
published:2025-03-31T23:15:21.820


Instruction: Please provide detailed information about CVE-2025-24247

CVE:CVE-2025-24247
Description:A type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker may be able to cause unexpected app termination.
published:2025-03-31T23:15:21.917


Instruction: Please provide detailed information about CVE-2025-24248

CVE:CVE-2025-24248
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have signed into the user's Apple Account.
published:2025-03-31T23:15:21.993


Instruction: Please provide detailed information about CVE-2025-24249

CVE:CVE-2025-24249
Description:A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to check the existence of an arbitrary path on the file system.
published:2025-03-31T23:15:22.090


Instruction: Please provide detailed information about CVE-2025-24250

CVE:CVE-2025-24250
Description:This issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app acting as a HTTPS proxy could get access to sensitive user data.
published:2025-03-31T23:15:22.187


Instruction: Please provide detailed information about CVE-2025-24253

CVE:CVE-2025-24253
Description:This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access protected user data.
published:2025-03-31T23:15:22.283


Instruction: Please provide detailed information about CVE-2025-24254

CVE:CVE-2025-24254
Description:This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A user may be able to elevate privileges.
published:2025-03-31T23:15:22.380


Instruction: Please provide detailed information about CVE-2025-24255

CVE:CVE-2025-24255
Description:A file access issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to break out of its sandbox.
published:2025-03-31T23:15:22.477


Instruction: Please provide detailed information about CVE-2025-24256

CVE:CVE-2025-24256
Description:The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to disclose kernel memory.
published:2025-03-31T23:15:22.570


Instruction: Please provide detailed information about CVE-2025-24257

CVE:CVE-2025-24257
Description:An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to cause unexpected system termination or write kernel memory.
published:2025-03-31T23:15:22.673


Instruction: Please provide detailed information about CVE-2025-24259

CVE:CVE-2025-24259
Description:This issue was addressed with additional entitlement checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to retrieve Safari bookmarks without an entitlement check.
published:2025-03-31T23:15:22.820


Instruction: Please provide detailed information about CVE-2025-24260

CVE:CVE-2025-24260
Description:The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker in a privileged position may be able to perform a denial-of-service.
published:2025-03-31T23:15:22.960


Instruction: Please provide detailed information about CVE-2025-24261

CVE:CVE-2025-24261
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to modify protected parts of the file system.
published:2025-03-31T23:15:23.060


Instruction: Please provide detailed information about CVE-2025-24262

CVE:CVE-2025-24262
Description:A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. A sandboxed app may be able to access sensitive user data in system logs.
published:2025-03-31T23:15:23.150


Instruction: Please provide detailed information about CVE-2025-24263

CVE:CVE-2025-24263
Description:A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15.4. An app may be able to observe unprotected user data.
published:2025-03-31T23:15:23.247


Instruction: Please provide detailed information about CVE-2025-24264

CVE:CVE-2025-24264
Description:The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.
published:2025-03-31T23:15:23.337


Instruction: Please provide detailed information about CVE-2025-24265

CVE:CVE-2025-24265
Description:An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to cause unexpected system termination.
published:2025-03-31T23:15:23.437


Instruction: Please provide detailed information about CVE-2025-24266

CVE:CVE-2025-24266
Description:A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to cause unexpected system termination.
published:2025-03-31T23:15:23.530


Instruction: Please provide detailed information about CVE-2025-24267

CVE:CVE-2025-24267
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to gain root privileges.
published:2025-03-31T23:15:23.623


Instruction: Please provide detailed information about CVE-2025-24269

CVE:CVE-2025-24269
Description:The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to cause unexpected system termination.
published:2025-03-31T23:15:23.717


Instruction: Please provide detailed information about CVE-2025-24272

CVE:CVE-2025-24272
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to modify protected parts of the file system.
published:2025-03-31T23:15:23.807


Instruction: Please provide detailed information about CVE-2025-24273

CVE:CVE-2025-24273
Description:An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to cause unexpected system termination or corrupt kernel memory.
published:2025-03-31T23:15:23.910


Instruction: Please provide detailed information about CVE-2025-24276

CVE:CVE-2025-24276
Description:This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to access private information.
published:2025-03-31T23:15:24.003


Instruction: Please provide detailed information about CVE-2025-24277

CVE:CVE-2025-24277
Description:A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to gain root privileges.
published:2025-03-31T23:15:24.103


Instruction: Please provide detailed information about CVE-2025-24278

CVE:CVE-2025-24278
Description:This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access protected user data.
published:2025-03-31T23:15:24.197


Instruction: Please provide detailed information about CVE-2025-24279

CVE:CVE-2025-24279
Description:This issue was addressed with improved file handling. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access contacts.
published:2025-03-31T23:15:24.293


Instruction: Please provide detailed information about CVE-2025-24280

CVE:CVE-2025-24280
Description:An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data.
published:2025-03-31T23:15:24.383


Instruction: Please provide detailed information about CVE-2025-24281

CVE:CVE-2025-24281
Description:This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data.
published:2025-03-31T23:15:24.477


Instruction: Please provide detailed information about CVE-2025-24282

CVE:CVE-2025-24282
Description:A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to modify protected parts of the file system.
published:2025-03-31T23:15:24.577


Instruction: Please provide detailed information about CVE-2025-24283

CVE:CVE-2025-24283
Description:A logging issue was addressed with improved data redaction. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.
published:2025-03-31T23:15:24.663


Instruction: Please provide detailed information about CVE-2025-30424

CVE:CVE-2025-30424
Description:A logging issue was addressed with improved data redaction. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. Deleting a conversation in Messages may expose user contact information in system logging.
published:2025-03-31T23:15:24.757


Instruction: Please provide detailed information about CVE-2025-30425

CVE:CVE-2025-30425
Description:This issue was addressed through improved state management. This issue is fixed in tvOS 18.4, Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to track users in Safari private browsing mode.
published:2025-03-31T23:15:24.847


Instruction: Please provide detailed information about CVE-2025-30426

CVE:CVE-2025-30426
Description:This issue was addressed with additional entitlement checks. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to enumerate a user's installed apps.
published:2025-03-31T23:15:24.940


Instruction: Please provide detailed information about CVE-2025-30427

CVE:CVE-2025-30427
Description:A use-after-free issue was addressed with improved memory management. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.
published:2025-03-31T23:15:25.037


Instruction: Please provide detailed information about CVE-2025-30428

CVE:CVE-2025-30428
Description:This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6. Photos in the Hidden Photos Album may be viewed without authentication.
published:2025-03-31T23:15:25.133


Instruction: Please provide detailed information about CVE-2025-30429

CVE:CVE-2025-30429
Description:A path handling issue was addressed with improved validation. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to break out of its sandbox.
published:2025-03-31T23:15:25.220


Instruction: Please provide detailed information about CVE-2025-30430

CVE:CVE-2025-30430
Description:This issue was addressed through improved state management. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Password autofill may fill in passwords after failing authentication.
published:2025-03-31T23:15:25.313


Instruction: Please provide detailed information about CVE-2025-30432

CVE:CVE-2025-30432
Description:A logic issue was addressed with improved state management. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sonoma 14.7.5. A malicious app may be able to attempt passcode entries on a locked device and thereby cause escalating time delays after 4 failures.
published:2025-03-31T23:15:25.400


Instruction: Please provide detailed information about CVE-2025-30433

CVE:CVE-2025-30433
Description:This issue was addressed with improved access restrictions. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A shortcut may be able to access files that are normally inaccessible to the Shortcuts app.
published:2025-03-31T23:15:25.503


Instruction: Please provide detailed information about CVE-2025-30434

CVE:CVE-2025-30434
Description:The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.4 and iPadOS 18.4. Processing a maliciously crafted file may lead to a cross site scripting attack.
published:2025-03-31T23:15:25.600


Instruction: Please provide detailed information about CVE-2025-30435

CVE:CVE-2025-30435
Description:This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.4. A sandboxed app may be able to access sensitive user data in system logs.
published:2025-03-31T23:15:25.687


Instruction: Please provide detailed information about CVE-2025-30437

CVE:CVE-2025-30437
Description:The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory.
published:2025-03-31T23:15:25.783


Instruction: Please provide detailed information about CVE-2025-30438

CVE:CVE-2025-30438
Description:This issue was addressed with improved access restrictions. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to dismiss the system notification on the Lock Screen that a recording was started.
published:2025-03-31T23:15:25.887


Instruction: Please provide detailed information about CVE-2025-30439

CVE:CVE-2025-30439
Description:The issue was addressed with improved checks. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An attacker with physical access to a locked device may be able to view sensitive user information.
published:2025-03-31T23:15:25.987


Instruction: Please provide detailed information about CVE-2025-30441

CVE:CVE-2025-30441
Description:This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.
published:2025-03-31T23:15:26.083


Instruction: Please provide detailed information about CVE-2025-30443

CVE:CVE-2025-30443
Description:A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access user-sensitive data.
published:2025-03-31T23:15:26.173


Instruction: Please provide detailed information about CVE-2025-30444

CVE:CVE-2025-30444
Description:A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. Mounting a maliciously crafted SMB network share may lead to system termination.
published:2025-03-31T23:15:26.260


Instruction: Please provide detailed information about CVE-2025-30446

CVE:CVE-2025-30446
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app with root privileges may be able to modify the contents of system files.
published:2025-03-31T23:15:26.360


Instruction: Please provide detailed information about CVE-2025-30447

CVE:CVE-2025-30447
Description:The issue was resolved by sanitizing logging This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access sensitive user data.
published:2025-03-31T23:15:26.450


Instruction: Please provide detailed information about CVE-2025-30449

CVE:CVE-2025-30449
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to gain root privileges.
published:2025-03-31T23:15:26.553


Instruction: Please provide detailed information about CVE-2025-30450

CVE:CVE-2025-30450
Description:This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access sensitive user data.
published:2025-03-31T23:15:26.643


Instruction: Please provide detailed information about CVE-2025-30451

CVE:CVE-2025-30451
Description:This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data.
published:2025-03-31T23:15:26.743


Instruction: Please provide detailed information about CVE-2025-30452

CVE:CVE-2025-30452
Description:The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An input validation issue was addressed.
published:2025-03-31T23:15:26.830


Instruction: Please provide detailed information about CVE-2025-30454

CVE:CVE-2025-30454
Description:A path handling issue was addressed with improved validation. This issue is fixed in macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, tvOS 18.4, macOS Sequoia 15.4. A malicious app may be able to access private information.
published:2025-03-31T23:15:26.930


Instruction: Please provide detailed information about CVE-2025-30455

CVE:CVE-2025-30455
Description:The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to access private information.
published:2025-03-31T23:15:27.033


Instruction: Please provide detailed information about CVE-2025-30456

CVE:CVE-2025-30456
Description:A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Ventura 13.7.5, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to gain root privileges.
published:2025-03-31T23:15:27.120


Instruction: Please provide detailed information about CVE-2025-30457

CVE:CVE-2025-30457
Description:This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to create symlinks to protected regions of the disk.
published:2025-03-31T23:15:27.213


Instruction: Please provide detailed information about CVE-2025-30458

CVE:CVE-2025-30458
Description:A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read files outside of its sandbox.
published:2025-03-31T23:15:27.300


Instruction: Please provide detailed information about CVE-2025-30460

CVE:CVE-2025-30460
Description:A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access protected user data.
published:2025-03-31T23:15:27.397


Instruction: Please provide detailed information about CVE-2025-30461

CVE:CVE-2025-30461
Description:An access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.
published:2025-03-31T23:15:27.493


Instruction: Please provide detailed information about CVE-2025-30462

CVE:CVE-2025-30462
Description:A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. Apps that appear to use App Sandbox may be able to launch without restrictions.
published:2025-03-31T23:15:27.583


Instruction: Please provide detailed information about CVE-2025-30463

CVE:CVE-2025-30463
Description:The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.
published:2025-03-31T23:15:27.687


Instruction: Please provide detailed information about CVE-2025-30464

CVE:CVE-2025-30464
Description:An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to cause unexpected system termination or corrupt kernel memory.
published:2025-03-31T23:15:27.777


Instruction: Please provide detailed information about CVE-2025-30465

CVE:CVE-2025-30465
Description:A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A shortcut may be able to access files that are normally inaccessible to the Shortcuts app.
published:2025-03-31T23:15:27.873


Instruction: Please provide detailed information about CVE-2025-30467

CVE:CVE-2025-30467
Description:The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Visiting a malicious website may lead to address bar spoofing.
published:2025-03-31T23:15:27.967


Instruction: Please provide detailed information about CVE-2025-30469

CVE:CVE-2025-30469
Description:This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4. A person with physical access to an iOS device may be able to access photos from the lock screen.
published:2025-03-31T23:15:28.107


Instruction: Please provide detailed information about CVE-2025-30470

CVE:CVE-2025-30470
Description:A path handling issue was addressed with improved logic. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to read sensitive location information.
published:2025-03-31T23:15:28.247


Instruction: Please provide detailed information about CVE-2025-30471

CVE:CVE-2025-30471
Description:A validation issue was addressed with improved logic. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A remote user may be able to cause a denial-of-service.
published:2025-03-31T23:15:28.347


Instruction: Please provide detailed information about CVE-2025-31182

CVE:CVE-2025-31182
Description:This issue was addressed with improved handling of symlinks. This issue is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to delete files for which it does not have permission.
published:2025-03-31T23:15:28.650


Instruction: Please provide detailed information about CVE-2025-31183

CVE:CVE-2025-31183
Description:The issue was addressed with improved restriction of data container access. This issue is fixed in macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, tvOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.
published:2025-03-31T23:15:28.740


Instruction: Please provide detailed information about CVE-2025-31184

CVE:CVE-2025-31184
Description:This issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may gain unauthorized access to Local Network.
published:2025-03-31T23:15:28.847


Instruction: Please provide detailed information about CVE-2025-31187

CVE:CVE-2025-31187
Description:This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to modify protected parts of the file system.
published:2025-03-31T23:15:28.943


Instruction: Please provide detailed information about CVE-2025-31188

CVE:CVE-2025-31188
Description:A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to bypass Privacy preferences.
published:2025-03-31T23:15:29.037


Instruction: Please provide detailed information about CVE-2025-31191

CVE:CVE-2025-31191
Description:This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.7.5, tvOS 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access sensitive user data.
published:2025-03-31T23:15:29.130


Instruction: Please provide detailed information about CVE-2025-31192

CVE:CVE-2025-31192
Description:The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website may be able to access sensor information without user consent.
published:2025-03-31T23:15:29.230


Instruction: Please provide detailed information about CVE-2025-31194

CVE:CVE-2025-31194
Description:An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A Shortcut may run with admin privileges without authentication.
published:2025-03-31T23:15:29.350


Instruction: Please provide detailed information about CVE-2025-3037

CVE:CVE-2025-3037
Description:A vulnerability has been found in yzk2356911358 StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5/d4d7a0643f1dae908a4831206f2714b21820f991 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
published:2025-03-31T23:15:29.607


Instruction: Please provide detailed information about CVE-2025-3038

CVE:CVE-2025-3038
Description:A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /view_account.php. The manipulation of the argument salary_rate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T23:15:29.787


Instruction: Please provide detailed information about CVE-2025-3039

CVE:CVE-2025-3039
Description:A vulnerability was found in code-projects Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /add_employee.php. The manipulation of the argument lname/fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-31T23:15:29.967


Instruction: Please provide detailed information about CVE-2025-3040

CVE:CVE-2025-3040
Description:A vulnerability was found in Project Worlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_student.php. The manipulation of the argument pic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-31T23:15:30.143


Instruction: Please provide detailed information about CVE-2025-3059

CVE:CVE-2025-3059
Description:Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*.
published:2025-03-31T23:15:30.330


Instruction: Please provide detailed information about CVE-2025-3060

CVE:CVE-2025-3060
Description:Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile: *.*.
published:2025-03-31T23:15:30.440


Instruction: Please provide detailed information about CVE-2025-3061

CVE:CVE-2025-3061
Description:Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.
published:2025-03-31T23:15:30.537


Instruction: Please provide detailed information about CVE-2025-3062

CVE:CVE-2025-3062
Description:Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*.
published:2025-03-31T23:15:30.630


Instruction: Please provide detailed information about CVE-2025-3041

CVE:CVE-2025-3041
Description:A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. This affects an unknown part of the file /admin/updatestudent.php. The manipulation of the argument pic leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-01T00:15:15.200


Instruction: Please provide detailed information about CVE-2025-21384

CVE:CVE-2025-21384
Description:An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
published:2025-04-01T01:15:17.127


Instruction: Please provide detailed information about CVE-2025-3042

CVE:CVE-2025-3042
Description:A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. This vulnerability affects unknown code of the file /student/updateprofile.php. The manipulation of the argument pic leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-01T01:15:20.890


Instruction: Please provide detailed information about CVE-2025-3043

CVE:CVE-2025-3043
Description:A vulnerability, which was classified as critical, has been found in GuoMinJim PersonManage 1.0. This issue affects the function preHandle of the file /login/. The manipulation of the argument Request leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
published:2025-04-01T01:15:21.073


Instruction: Please provide detailed information about CVE-2025-3045

CVE:CVE-2025-3045
Description:A vulnerability, which was classified as critical, was found in oretnom23/SourceCodester Apartment Visitor Management System 1.0. Affected is an unknown function of the file /remove-apartment.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-01T01:15:21.253


Instruction: Please provide detailed information about CVE-2025-30672

CVE:CVE-2025-30672
Description:Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238.  If an attacker can place a malicious file in current working directory, it may be  loaded instead of the intended file, potentially leading to arbitrary  code execution.  This affects the Mite distribution itself, and other distributions that contain code generated by Mite.
published:2025-04-01T02:15:16.390


Instruction: Please provide detailed information about CVE-2025-30673

CVE:CVE-2025-30673
Description:Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.  If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution.  Sub::HandlesVia uses Mite to produce the affected code section due to CVE-2025-30672
published:2025-04-01T03:15:16.777


Instruction: Please provide detailed information about CVE-2025-31515

CVE:CVE-2025-31515
Description:Rejected reason: Not used
published:2025-04-01T03:15:17.700


Instruction: Please provide detailed information about CVE-2025-31516

CVE:CVE-2025-31516
Description:Rejected reason: Not used
published:2025-04-01T03:15:18.140


Instruction: Please provide detailed information about CVE-2025-31517

CVE:CVE-2025-31517
Description:Rejected reason: Not used
published:2025-04-01T03:15:18.210


Instruction: Please provide detailed information about CVE-2025-31518

CVE:CVE-2025-31518
Description:Rejected reason: Not used
published:2025-04-01T03:15:18.283


Instruction: Please provide detailed information about CVE-2025-31519

CVE:CVE-2025-31519
Description:Rejected reason: Not used
published:2025-04-01T03:15:18.350


Instruction: Please provide detailed information about CVE-2025-31520

CVE:CVE-2025-31520
Description:Rejected reason: Not used
published:2025-04-01T03:15:18.420


Instruction: Please provide detailed information about CVE-2025-31521

CVE:CVE-2025-31521
Description:Rejected reason: Not used
published:2025-04-01T03:15:18.490


Instruction: Please provide detailed information about CVE-2025-31522

CVE:CVE-2025-31522
Description:Rejected reason: Not used
published:2025-04-01T03:15:18.557


Instruction: Please provide detailed information about CVE-2025-31523

CVE:CVE-2025-31523
Description:Rejected reason: Not used
published:2025-04-01T03:15:18.630


Instruction: Please provide detailed information about CVE-2025-3051

CVE:CVE-2025-3051
Description:Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.  If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution.  Linux::Statm::Tiny uses Mite to produce the affected code section due to CVE-2025-30672
published:2025-04-01T03:15:18.693


Instruction: Please provide detailed information about CVE-2025-0416

CVE:CVE-2025-0416
Description:Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering has permissions that allow it to run commands as a user with the SeImpersonatePrivilege privilege. The SeImpersonatePrivilege privilege is a Windows permission that allows a process to impersonate another user. An attacker can use this vulnerability to escalate their privileges and take complete control of the system.
published:2025-04-01T04:15:37.727


Instruction: Please provide detailed information about CVE-2025-0417

CVE:CVE-2025-0417
Description:Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then performing switching operations.
published:2025-04-01T04:15:38.363


Instruction: Please provide detailed information about CVE-2025-0418

CVE:CVE-2025-0418
Description:Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords.
published:2025-04-01T04:15:39.550


Instruction: Please provide detailed information about CVE-2025-1534

CVE:CVE-2025-1534
Description:CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919.1 before 4.1.2.191.51, from 5.20.0 before 5.68.0, from 6.0.0 before 6.23.0, from 6.2022.1 before 6.2025.2.
published:2025-04-01T04:15:44.170


Instruction: Please provide detailed information about CVE-2025-2007

CVE:CVE-2025-2007
Description:The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
published:2025-04-01T05:15:47.110


Instruction: Please provide detailed information about CVE-2025-2008

CVE:CVE-2025-2008
Description:The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
published:2025-04-01T05:15:47.320


Instruction: Please provide detailed information about CVE-2025-1665

CVE:CVE-2025-1665
Description:The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 3.11.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-04-01T06:15:47.853


Instruction: Please provide detailed information about CVE-2025-1986

CVE:CVE-2025-1986
Description:The Gutentor  WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
published:2025-04-01T06:15:48.047


Instruction: Please provide detailed information about CVE-2025-22277

CVE:CVE-2025-22277
Description:Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos allows Authentication Abuse. This issue affects Vitepos: from n/a through 3.1.4.
published:2025-04-01T06:15:48.170


Instruction: Please provide detailed information about CVE-2025-2048

CVE:CVE-2025-2048
Description:The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server
published:2025-04-01T06:15:48.350


Instruction: Please provide detailed information about CVE-2025-30520

CVE:CVE-2025-30520
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crosstec Breezing Forms allows Reflected XSS. This issue affects Breezing Forms: from n/a through 1.2.8.11.
published:2025-04-01T06:15:48.443


Instruction: Please provide detailed information about CVE-2025-30544

CVE:CVE-2025-30544
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound OK Poster Group allows Reflected XSS. This issue affects OK Poster Group: from n/a through 1.1.
published:2025-04-01T06:15:48.620


Instruction: Please provide detailed information about CVE-2025-30547

CVE:CVE-2025-30547
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Tufts WP Cards allows Reflected XSS. This issue affects WP Cards: from n/a through 1.5.1.
published:2025-04-01T06:15:48.770


Instruction: Please provide detailed information about CVE-2025-30548

CVE:CVE-2025-30548
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VarDump s.r.l. Advanced Post Search allows Reflected XSS. This issue affects Advanced Post Search: from n/a through 1.1.0.
published:2025-04-01T06:15:48.940


Instruction: Please provide detailed information about CVE-2025-30559

CVE:CVE-2025-30559
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Kento WordPress Stats allows Stored XSS. This issue affects Kento WordPress Stats: from n/a through 1.1.
published:2025-04-01T06:15:49.110


Instruction: Please provide detailed information about CVE-2025-30563

CVE:CVE-2025-30563
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Tidekey allows Reflected XSS. This issue affects Tidekey: from n/a through 1.1.
published:2025-04-01T06:15:49.277


Instruction: Please provide detailed information about CVE-2025-30579

CVE:CVE-2025-30579
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakeii Pesapal Gateway for Woocommerce allows Reflected XSS. This issue affects Pesapal Gateway for Woocommerce: from n/a through 2.1.0.
published:2025-04-01T06:15:49.433


Instruction: Please provide detailed information about CVE-2025-30589

CVE:CVE-2025-30589
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Flickr set slideshows allows SQL Injection. This issue affects Flickr set slideshows: from n/a through 0.9.
published:2025-04-01T06:15:49.607


Instruction: Please provide detailed information about CVE-2025-30594

CVE:CVE-2025-30594
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Include URL allows Path Traversal. This issue affects Include URL: from n/a through 0.3.5.
published:2025-04-01T06:15:49.773


Instruction: Please provide detailed information about CVE-2025-30607

CVE:CVE-2025-30607
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Name.ly Quick Localization allows Reflected XSS. This issue affects Quick Localization: from n/a through 0.1.0.
published:2025-04-01T06:15:49.940


Instruction: Please provide detailed information about CVE-2025-30613

CVE:CVE-2025-30613
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N-Media Nmedia MailChimp allows Stored XSS. This issue affects Nmedia MailChimp: from n/a through 5.4.
published:2025-04-01T06:15:50.120


Instruction: Please provide detailed information about CVE-2025-30614

CVE:CVE-2025-30614
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haozhe Xie Google Font Fix allows Reflected XSS. This issue affects Google Font Fix: from n/a through 2.3.1.
published:2025-04-01T06:15:50.290


Instruction: Please provide detailed information about CVE-2025-30622

CVE:CVE-2025-30622
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in torsteino PostMash allows SQL Injection. This issue affects PostMash: from n/a through 1.0.3.
published:2025-04-01T06:15:50.457


Instruction: Please provide detailed information about CVE-2025-30774

CVE:CVE-2025-30774
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Quiz Maker allows SQL Injection. This issue affects Quiz Maker: from n/a through 6.6.8.7.
published:2025-04-01T06:15:50.623


Instruction: Please provide detailed information about CVE-2025-30782

CVE:CVE-2025-30782
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite allows PHP Local File Inclusion. This issue affects Subscribe to Download Lite: from n/a through 1.2.9.
published:2025-04-01T06:15:50.797


Instruction: Please provide detailed information about CVE-2025-30793

CVE:CVE-2025-30793
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Property Hive Houzez Property Feed allows Path Traversal. This issue affects Houzez Property Feed: from n/a through 2.5.4.
published:2025-04-01T06:15:51.007


Instruction: Please provide detailed information about CVE-2025-30794

CVE:CVE-2025-30794
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Events Calendar Event Tickets allows Reflected XSS. This issue affects Event Tickets: from n/a through 5.20.0.
published:2025-04-01T06:15:51.210