Instruction: Please provide detailed information about CVE-2025-21866

CVE:CVE-2025-21866
Description:In the Linux kernel, the following vulnerability has been resolved:  powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC  Erhard reported the following KASAN hit while booting his PowerMac G4 with a KASAN-enabled kernel 6.13-rc6:    BUG: KASAN: vmalloc-out-of-bounds in copy_to_kernel_nofault+0xd8/0x1c8   Write of size 8 at addr f1000000 by task chronyd/1293    CPU: 0 UID: 123 PID: 1293 Comm: chronyd Tainted: G        W          6.13.0-rc6-PMacG4 #2   Tainted: [W]=WARN   Hardware name: PowerMac3,6 7455 0x80010303 PowerMac   Call Trace:   [c2437590] [c1631a84] dump_stack_lvl+0x70/0x8c (unreliable)   [c24375b0] [c0504998] print_report+0xdc/0x504   [c2437610] [c050475c] kasan_report+0xf8/0x108   [c2437690] [c0505a3c] kasan_check_range+0x24/0x18c   [c24376a0] [c03fb5e4] copy_to_kernel_nofault+0xd8/0x1c8   [c24376c0] [c004c014] patch_instructions+0x15c/0x16c   [c2437710] [c00731a8] bpf_arch_text_copy+0x60/0x7c   [c2437730] [c0281168] bpf_jit_binary_pack_finalize+0x50/0xac   [c2437750] [c0073cf4] bpf_int_jit_compile+0xb30/0xdec   [c2437880] [c0280394] bpf_prog_select_runtime+0x15c/0x478   [c24378d0] [c1263428] bpf_prepare_filter+0xbf8/0xc14   [c2437990] [c12677ec] bpf_prog_create_from_user+0x258/0x2b4   [c24379d0] [c027111c] do_seccomp+0x3dc/0x1890   [c2437ac0] [c001d8e0] system_call_exception+0x2dc/0x420   [c2437f30] [c00281ac] ret_from_syscall+0x0/0x2c   --- interrupt: c00 at 0x5a1274   NIP:  005a1274 LR: 006a3b3c CTR: 005296c8   REGS: c2437f40 TRAP: 0c00   Tainted: G        W           (6.13.0-rc6-PMacG4)   MSR:  0200f932 <VEC,EE,PR,FP,ME,IR,DR,RI>  CR: 24004422  XER: 00000000    GPR00: 00000166 af8f3fa0 a7ee3540 00000001 00000000 013b6500 005a5858 0200f932   GPR08: 00000000 00001fe9 013d5fc8 005296c8 2822244c 00b2fcd8 00000000 af8f4b57   GPR16: 00000000 00000001 00000000 00000000 00000000 00000001 00000000 00000002   GPR24: 00afdbb0 00000000 00000000 00000000 006e0004 013ce060 006e7c1c 00000001   NIP [005a1274] 0x5a1274   LR [006a3b3c] 0x6a3b3c   --- interrupt: c00    The buggy address belongs to the virtual mapping at    [f1000000, f1002000) created by:    text_area_cpu_up+0x20/0x190    The buggy address belongs to the physical page:   page: refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x76e30   flags: 0x80000000(zone=2)   raw: 80000000 00000000 00000122 00000000 00000000 00000000 ffffffff 00000001   raw: 00000000   page dumped because: kasan: bad access detected    Memory state around the buggy address:    f0ffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    f0ffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   >f1000000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8              ^    f1000080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8    f1000100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8   ==================================================================  f8 corresponds to KASAN_VMALLOC_INVALID which means the area is not initialised hence not supposed to be used yet.  Powerpc text patching infrastructure allocates a virtual memory area using get_vm_area() and flags it as VM_ALLOC. But that flag is meant to be used for vmalloc() and vmalloc() allocated memory is not supposed to be used before a call to __vmalloc_node_range() which is never called for that area.  That went undetected until commit e4137f08816b ("mm, kasan, kmsan: instrument copy_from/to_kernel_nofault")  The area allocated by text_area_cpu_up() is not vmalloc memory, it is mapped directly on demand when needed by map_kernel_page(). There is no VM flag corresponding to such usage, so just pass no flag. That way the area will be unpoisonned and usable immediately.
published:2025-03-12T10:15:19.800


Instruction: Please provide detailed information about CVE-2025-2239

CVE:CVE-2025-2239
Description:Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23.
published:2025-03-12T10:15:19.940


Instruction: Please provide detailed information about CVE-2025-1527

CVE:CVE-2025-1527
Description:The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to a Stored DOM-Based Cross-Site Scripting via the plugin's Flash Sale Countdown module in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-12T12:15:14.473


Instruction: Please provide detailed information about CVE-2025-29903

CVE:CVE-2025-29903
Description:In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible
published:2025-03-12T13:15:37.823


Instruction: Please provide detailed information about CVE-2025-29904

CVE:CVE-2025-29904
Description:In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible
published:2025-03-12T13:15:38.050


Instruction: Please provide detailed information about CVE-2025-21590

CVE:CVE-2025-21590
Description:An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.  A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS:       *  All versions before 21.2R3-S9,   *  21.4 versions before 21.4R3-S10,    *  22.2 versions before 22.2R3-S6,    *  22.4 versions before 22.4R3-S6,    *  23.2 versions before 23.2R2-S3,    *  23.4 versions before 23.4R2-S4,   *  24.2 versions before 24.2R1-S2, 24.2R2.
published:2025-03-12T14:15:15.447


Instruction: Please provide detailed information about CVE-2025-25709

CVE:CVE-2025-25709
Description:An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the addUser and updateUser endpoints
published:2025-03-12T14:15:16.077


Instruction: Please provide detailed information about CVE-2025-27788

CVE:CVE-2025-27788
Description:JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.
published:2025-03-12T14:15:16.770


Instruction: Please provide detailed information about CVE-2025-27794

CVE:CVE-2025-27794
Description:Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser's security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue.
published:2025-03-12T14:15:17.033


Instruction: Please provide detailed information about CVE-2025-22954

CVE:CVE-2025-22954
Description:GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.
published:2025-03-12T15:15:39.700


Instruction: Please provide detailed information about CVE-2025-27914

CVE:CVE-2025-27914
Description:An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token and involves a crafted URL with manipulated query parameters that triggers XSS when accessed by a victim.
published:2025-03-12T15:15:39.800


Instruction: Please provide detailed information about CVE-2025-27915

CVE:CVE-2025-27915
Description:An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
published:2025-03-12T15:15:39.900


Instruction: Please provide detailed information about CVE-2025-29891

CVE:CVE-2025-29891
Description:Bypass/Injection vulnerability in Apache Camel.  This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4.  Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.  This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, or the camel-exec component.  If you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include parameters in the HTTP requests that are sent to the Camel application that get translated into headers.   The headers could be both provided as request parameters for an HTTP methods invocation or as part of the payload of the HTTP methods invocation.  All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box.  This CVE is related to the CVE-2025-27636: while they have the same root cause and are fixed with the same fix, CVE-2025-27636 was assumed to only be exploitable if an attacker could add malicious HTTP headers, while we have now determined that it is also exploitable via HTTP parameters. Like in CVE-2025-27636, exploitation is only possible if the Camel route uses particular vulnerable components.
published:2025-03-12T15:15:40.997


Instruction: Please provide detailed information about CVE-2025-2240

CVE:CVE-2025-2240
Description:A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
published:2025-03-12T15:15:42.273


Instruction: Please provide detailed information about CVE-2025-0813

CVE:CVE-2025-0813
Description:CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to reboot the workstation and interrupt the normal boot process.
published:2025-03-12T16:15:20.183


Instruction: Please provide detailed information about CVE-2025-0883

CVE:CVE-2025-0883
Description:Improper Neutralization of Script in an Error Message Web Page vulnerability in OpenText™ Service Manager.   The vulnerability could reveal sensitive information retained by the browser.  This issue affects Service Manager: 9.70, 9.71, 9.72, 9.80.
published:2025-03-12T16:15:20.353


Instruction: Please provide detailed information about CVE-2025-0884

CVE:CVE-2025-0884
Description:Unquoted Search Path or Element vulnerability in OpenText™ Service Manager.   The vulnerability could allow a user to gain SYSTEM privileges through Privilege Escalation.  This issue affects Service Manager: 9.70, 9.71, 9.72.
published:2025-03-12T16:15:20.523


Instruction: Please provide detailed information about CVE-2025-1683

CVE:CVE-2025-1683
Description:Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged access on a Windows system to delete arbitrary files on the device by exploiting symbolic links.
published:2025-03-12T16:15:20.660


Instruction: Please provide detailed information about CVE-2025-1960

CVE:CVE-2025-1960
Description:CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interface.
published:2025-03-12T16:15:20.797


Instruction: Please provide detailed information about CVE-2025-1984

CVE:CVE-2025-1984
Description:Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.
published:2025-03-12T16:15:20.963


Instruction: Please provide detailed information about CVE-2025-20115

CVE:CVE-2025-20115
Description:A vulnerability in confederation implementation for the Border Gateway Protocol (BGP) in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

 This vulnerability is due to a memory corruption that occurs when a BGP update is created with an AS_CONFED_SEQUENCE attribute that has 255 autonomous system numbers (AS numbers). An attacker could exploit this vulnerability by sending a crafted BGP update message, or the network could be designed in such a manner that the AS_CONFED_SEQUENCE attribute grows to 255 AS numbers or more. A successful exploit could allow the attacker to cause memory corruption, which may cause the BGP process to restart, resulting in a DoS condition. To exploit this vulnerability, an attacker must control a BGP confederation speaker within the same autonomous system as the victim, or the network must be designed in such a manner that the AS_CONFED_SEQUENCE attribute grows to 255 AS numbers or more.
published:2025-03-12T16:15:21.090


Instruction: Please provide detailed information about CVE-2025-20138

CVE:CVE-2025-20138
Description:A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device.

 This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root and execute arbitrary commands.
published:2025-03-12T16:15:21.260


Instruction: Please provide detailed information about CVE-2025-20141

CVE:CVE-2025-20141
Description:A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an unauthenticated, adjacent attacker to cause control plane traffic to stop working on multiple Cisco IOS XR platforms.

 This vulnerability is due to incorrect handling of packets that are punted to the route processor. An attacker could exploit this vulnerability by sending traffic, which must be handled by the Linux stack on the route processor, to an affected device. A successful exploit could allow the attacker to cause control plane traffic to stop working, resulting in a denial of service (DoS) condition.
published:2025-03-12T16:15:21.420


Instruction: Please provide detailed information about CVE-2025-20142

CVE:CVE-2025-20142
Description:A vulnerability in the IPv4 access control list (ACL) feature and quality of service (QoS) policy feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause a line card to reset, resulting in a denial of service (DoS) condition.

 This vulnerability is due to the incorrect handling of malformed IPv4 packets that are received on line cards where the interface has either an IPv4 ACL or QoS policy applied. An attacker could exploit this vulnerability by sending crafted IPv4 packets through an affected device. A successful exploit could allow the attacker to cause network processor errors, resulting in a reset or shutdown of the network process. Traffic over that line card would be lost while the line card reloads.
 Note: This vulnerability has predominantly been observed in Layer 2 VPN (L2VPN) environments where an IPv4 ACL or QoS policy has been applied to the bridge virtual interface. Layer 3 configurations where the interface has either an IPv4 ACL or QoS policy applied are also affected, though the vulnerability has not been observed.
published:2025-03-12T16:15:21.573


Instruction: Please provide detailed information about CVE-2025-20143

CVE:CVE-2025-20143
Description:A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Secure Boot functionality and load unverified software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges on the affected device.

 This vulnerability is due to insufficient verification of modules in the software load process. An attacker could exploit this vulnerability by manipulating the loaded binaries to bypass some of the integrity checks that are performed during the booting process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass the requirement to run Cisco-signed images or alter the security properties of the running system.
 Note: This vulnerability affects Cisco IOS XR Software, not the Secure Boot feature.
 Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
published:2025-03-12T16:15:21.733


Instruction: Please provide detailed information about CVE-2025-20144

CVE:CVE-2025-20144
Description:A vulnerability in the hybrid access control list (ACL) processing of IPv4 packets in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.

 This vulnerability is due to incorrect handling of packets when a specific configuration of the hybrid ACL exists. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass a configured ACL on the affected device.
 For more information, see the  section of this advisory.
 Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
published:2025-03-12T16:15:21.890


Instruction: Please provide detailed information about CVE-2025-20145

CVE:CVE-2025-20145
Description:A vulnerability in the access control list (ACL) processing in the egress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.

 This vulnerability exists because certain packets are handled incorrectly when they are received on an ingress interface on one line card and destined out of an egress interface on another line card where the egress ACL is configured. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an egress ACL on the affected device.
 For more information about this vulnerability, see the  section of this advisory.
 Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
published:2025-03-12T16:15:22.040


Instruction: Please provide detailed information about CVE-2025-20146

CVE:CVE-2025-20146
Description:A vulnerability in the Layer 3 multicast feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause a line card to reset, resulting in a denial of service (DoS) condition.

 This vulnerability is due to the incorrect handling of malformed IPv4 multicast packets that are received on line cards where the interface has either an IPv4 access control list (ACL) or a QoS policy applied. An attacker could exploit this vulnerability by sending crafted IPv4 multicast packets through an affected device. A successful exploit could allow the attacker to cause line card exceptions or a hard reset. Traffic over that line card would be lost while the line card reloads.
published:2025-03-12T16:15:22.197


Instruction: Please provide detailed information about CVE-2025-20177

CVE:CVE-2025-20177
Description:A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR image signature verification and load unverified software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges on the affected device.

 This vulnerability is due to incomplete validation of files in the boot verification process. An attacker could exploit this vulnerability by manipulating the system configuration options to bypass some of the integrity checks that are performed during the boot process. A successful exploit could allow the attacker to control the boot configuration, which could enable them to bypass the requirement to run Cisco-signed images or alter the security properties of the running system.
 Note: Because exploitation of this vulnerability could result in the attacker bypassing Cisco image verification, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
published:2025-03-12T16:15:22.347


Instruction: Please provide detailed information about CVE-2025-20209

CVE:CVE-2025-20209
Description:A vulnerability in the Internet Key Exchange version 2 (IKEv2) function of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent an affected device from processing any control plane UDP packets.

 This vulnerability is due to improper handling of malformed IKEv2 packets. An attacker could exploit this vulnerability by sending malformed IKEv2 packets to an affected device. A successful exploit could allow the attacker to prevent the affected device from processing any control plane UDP packets, resulting in a denial of service (DoS) condition.
 Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
published:2025-03-12T16:15:22.507


Instruction: Please provide detailed information about CVE-2025-25565

CVE:CVE-2025-25565
Description:SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions.
published:2025-03-12T16:15:22.660


Instruction: Please provide detailed information about CVE-2025-25566

CVE:CVE-2025-25566
Description:Memory Leak vulnerability in SoftEtherVPN 5.02.5187 allows an attacker to cause a denial of service via the UnixMemoryAlloc function.
published:2025-03-12T16:15:22.750


Instruction: Please provide detailed information about CVE-2025-25567

CVE:CVE-2025-25567
Description:SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function.
published:2025-03-12T16:15:22.840


Instruction: Please provide detailed information about CVE-2025-25568

CVE:CVE-2025-25568
Description:SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function.
published:2025-03-12T16:15:22.930


Instruction: Please provide detailed information about CVE-2025-25711

CVE:CVE-2025-25711
Description:An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the [/tnexus/rest/admin/updateUser] API endpoint
published:2025-03-12T16:15:23.023


Instruction: Please provide detailed information about CVE-2025-26260

CVE:CVE-2025-26260
Description:Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.
published:2025-03-12T16:15:23.907


Instruction: Please provide detailed information about CVE-2025-27867

CVE:CVE-2025-27867
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin.  This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0.  Users are recommended to upgrade to version 1.2.2, which fixes the issue.
published:2025-03-12T16:15:24.127


Instruction: Please provide detailed information about CVE-2025-2002

CVE:CVE-2025-2002
Description:CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an administrative user and the debug files are exported from the device.
published:2025-03-12T16:15:24.980


Instruction: Please provide detailed information about CVE-2025-25683

CVE:CVE-2025-25683
Description:AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1.
published:2025-03-12T17:15:49.587


Instruction: Please provide detailed information about CVE-2025-25774

CVE:CVE-2025-25774
Description:An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal state machine, leading to an AMF crash and resulting in a Denial of Service (DoS).
published:2025-03-12T17:15:49.997


Instruction: Please provide detailed information about CVE-2025-27017

CVE:CVE-2025-27017
Description:Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records.
published:2025-03-12T17:15:50.327


Instruction: Please provide detailed information about CVE-2025-0114

CVE:CVE-2025-0114
Description:A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a period of time. This issue affects both the GlobalProtect portal and the GlobalProtect gateway.  This issue does not apply to Cloud NGFWs or Prisma Access software.
published:2025-03-12T19:15:37.363


Instruction: Please provide detailed information about CVE-2025-0115

CVE:CVE-2025-0115
Description:A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files.  The attacker must have network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. You can greatly reduce the risk of this issue by restricting access to the management interface to only trusted users and internal IP addresses according to our recommended  critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .  This issue does not affect Cloud NGFW or Prisma Access.
published:2025-03-12T19:15:37.567


Instruction: Please provide detailed information about CVE-2025-0116

CVE:CVE-2025-0116
Description:A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a specially crafted LLDP frame sent by an unauthenticated adjacent attacker. Repeated attempts to initiate this condition causes the firewall to enter maintenance mode.  This issue does not apply to Cloud NGFWs or Prisma Access software.
published:2025-03-12T19:15:37.727


Instruction: Please provide detailed information about CVE-2025-0117

CVE:CVE-2025-0117
Description:A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM.  GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected.
published:2025-03-12T19:15:37.883


Instruction: Please provide detailed information about CVE-2025-0118

CVE:CVE-2025-0118
Description:A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated user. However, to exploit this vulnerability, the authenticated user must navigate to a malicious page during the GlobalProtect SAML login process on a Windows device.  This issue does not apply to the GlobalProtect app on other (non-Windows) platforms.
published:2025-03-12T19:15:38.040


Instruction: Please provide detailed information about CVE-2025-22870

CVE:CVE-2025-22870
Description:Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
published:2025-03-12T19:15:38.310


Instruction: Please provide detailed information about CVE-2025-25975

CVE:CVE-2025-25975
Description:An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function
published:2025-03-12T19:15:40.147


Instruction: Please provide detailed information about CVE-2025-27407

CVE:CVE-2025-27407
Description:graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.
published:2025-03-12T19:15:40.597


Instruction: Please provide detailed information about CVE-2025-25291

CVE:CVE-2025-25291
Description:ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
published:2025-03-12T21:15:42.000


Instruction: Please provide detailed information about CVE-2025-25292

CVE:CVE-2025-25292
Description:ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.
published:2025-03-12T21:15:42.177


Instruction: Please provide detailed information about CVE-2025-25293

CVE:CVE-2025-25293
Description:ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
published:2025-03-12T21:15:42.363


Instruction: Please provide detailed information about CVE-2025-1559

CVE:CVE-2025-1559
Description:The CC-IMG-Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'img' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-13T02:15:12.917


Instruction: Please provide detailed information about CVE-2025-2106

CVE:CVE-2025-2106
Description:The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'text' and 'id' parameters of the limpia() function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only appears to be exploitable on very old versions of WordPress.
published:2025-03-13T02:15:13.097


Instruction: Please provide detailed information about CVE-2025-2107

CVE:CVE-2025-2107
Description:The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the printResultAndDie() function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only appears to be exploitable on very old versions of WordPress.
published:2025-03-13T02:15:13.250


Instruction: Please provide detailed information about CVE-2025-2250

CVE:CVE-2025-2250
Description:The WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-13T04:15:23.137


Instruction: Please provide detailed information about CVE-2025-1503

CVE:CVE-2025-1503
Description:The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Roundup Recipe Name field in all versions up to, and including, 9.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-13T05:15:24.917


Instruction: Please provide detailed information about CVE-2025-1561

CVE:CVE-2025-1561
Description:The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when logging is enabled that will execute whenever a user accesses an injected page.
published:2025-03-13T05:15:27.890


Instruction: Please provide detailed information about CVE-2025-2104

CVE:CVE-2025-2104
Description:The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation on the pagelayer_save_content() function in all versions up to, and including, 1.9.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to bypass post moderation and publish posts to the site.
published:2025-03-13T05:15:28.303


Instruction: Please provide detailed information about CVE-2025-0652

CVE:CVE-2025-0652
Description:An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only.
published:2025-03-13T06:15:36.643


Instruction: Please provide detailed information about CVE-2025-1257

CVE:CVE-2025-1257
Description:An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipulating specific API inputs.
published:2025-03-13T06:15:36.810


Instruction: Please provide detailed information about CVE-2025-1401

CVE:CVE-2025-1401
Description:The WP Click Info WordPress plugin through 2.7.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
published:2025-03-13T06:15:36.970


Instruction: Please provide detailed information about CVE-2025-1436

CVE:CVE-2025-1436
Description:The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
published:2025-03-13T06:15:37.077


Instruction: Please provide detailed information about CVE-2025-1486

CVE:CVE-2025-1486
Description:The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
published:2025-03-13T06:15:37.173


Instruction: Please provide detailed information about CVE-2025-1487

CVE:CVE-2025-1487
Description:The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
published:2025-03-13T06:15:37.280


Instruction: Please provide detailed information about CVE-2025-1119

CVE:CVE-2025-1119
Description:The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
published:2025-03-13T07:15:36.517


Instruction: Please provide detailed information about CVE-2025-2271

CVE:CVE-2025-2271
Description:A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct Object Reference (IDOR) vulnerability in the Issuetrak audit component. The vulnerability enables unauthorized access to sensitive information, including user details, network and hardware information, installed programs, running processes, drives, and printers. Due to improper access controls, an attacker can retrieve audit data belonging to other users, potentially leading to unauthorized data exposure, privacy violations, and security risks.
published:2025-03-13T07:15:37.133


Instruction: Please provide detailed information about CVE-2025-1785

CVE:CVE-2025-1785
Description:The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite select file types outside of the originally intended directory, which may cause a denial of service.
published:2025-03-13T08:15:10.950


Instruction: Please provide detailed information about CVE-2025-25175

CVE:CVE-2025-25175
Description:A vulnerability has been identified in Simcenter Femap V2401 (All versions < V2401.0003), Simcenter Femap V2406 (All versions < V2406.0002). The affected application contains a memory corruption vulnerability while  parsing specially crafted .NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-25443)
published:2025-03-13T09:15:14.123


Instruction: Please provide detailed information about CVE-2025-2275

CVE:CVE-2025-2275
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-13T11:15:36.233


Instruction: Please provide detailed information about CVE-2025-21104

CVE:CVE-2025-21104
Description:Dell NetWorker, 19.11.0.3 and below versions, contain(s) an Open Redirect Vulnerability in NMC. An unauthenticated attacker with remoter access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.
published:2025-03-13T12:15:12.510


Instruction: Please provide detailed information about CVE-2025-29994

CVE:CVE-2025-29994
Description:This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with a valid login ID could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to other user accounts.
published:2025-03-13T12:15:13.660


Instruction: Please provide detailed information about CVE-2025-29995

CVE:CVE-2025-29995
Description:This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable API endpoint which could lead to account takeover of targeted users.
published:2025-03-13T12:15:13.830


Instruction: Please provide detailed information about CVE-2025-29996

CVE:CVE-2025-29996
Description:This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.
published:2025-03-13T12:15:13.980


Instruction: Please provide detailed information about CVE-2025-29997

CVE:CVE-2025-29997
Description:This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API request URL to gain unauthorized access to other user accounts.
published:2025-03-13T12:15:14.127


Instruction: Please provide detailed information about CVE-2025-29998

CVE:CVE-2025-29998
Description:This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.
published:2025-03-13T12:15:14.277


Instruction: Please provide detailed information about CVE-2025-1635

CVE:CVE-2025-1635
Description:Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in the export due to faulty business logic.
published:2025-03-13T13:15:46.820


Instruction: Please provide detailed information about CVE-2025-1636

CVE:CVE-2025-1636
Description:Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.
published:2025-03-13T13:15:46.970


Instruction: Please provide detailed information about CVE-2025-2277

CVE:CVE-2025-2277
Description:Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.
published:2025-03-13T13:15:58.320


Instruction: Please provide detailed information about CVE-2025-2278

CVE:CVE-2025-2278
Description:Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID.
published:2025-03-13T13:15:58.430


Instruction: Please provide detailed information about CVE-2025-2280

CVE:CVE-2025-2280
Description:Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0   and earlier allows an authenticated user to bypass the browser extension restriction feature.
published:2025-03-13T13:15:58.533


Instruction: Please provide detailed information about CVE-2025-29357

CVE:CVE-2025-29357
Description:Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the startIp and endIp parameters at /goform/SetPptpServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
published:2025-03-13T14:15:36.253


Instruction: Please provide detailed information about CVE-2025-29358

CVE:CVE-2025-29358
Description:Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the firewallEn parameter at /goform/SetFirewallCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
published:2025-03-13T14:15:36.407


Instruction: Please provide detailed information about CVE-2025-29359

CVE:CVE-2025-29359
Description:Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the deviceId parameter at /goform/saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
published:2025-03-13T14:15:36.547


Instruction: Please provide detailed information about CVE-2025-29360

CVE:CVE-2025-29360
Description:Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the time and timeZone parameters at /goform/SetSysTimeCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
published:2025-03-13T14:15:36.690


Instruction: Please provide detailed information about CVE-2025-29361

CVE:CVE-2025-29361
Description:Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/SetVirtualServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
published:2025-03-13T14:15:36.833


Instruction: Please provide detailed information about CVE-2025-29362

CVE:CVE-2025-29362
Description:Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/setPptpUserList. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
published:2025-03-13T14:15:36.963


Instruction: Please provide detailed information about CVE-2025-29363

CVE:CVE-2025-29363
Description:Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to buffer overflow via the schedStartTime and schedEndTime parameters at /goform/saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
published:2025-03-13T14:15:37.103


Instruction: Please provide detailed information about CVE-2025-25625

CVE:CVE-2025-25625
Description:A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and web firmware v2.2.2, which allows an authenticated web interface user to bypass input filtering on user names, and stores un-sanitized HTML and Javascript on the device. Pages which then present the user name without encoding special characters will then cause the injected code to be parsed by the browsers of other users accessing the web interface.
published:2025-03-13T15:15:53.650


Instruction: Please provide detailed information about CVE-2025-28010

CVE:CVE-2025-28010
Description:A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.
published:2025-03-13T16:15:27.690


Instruction: Please provide detailed information about CVE-2025-28015

CVE:CVE-2025-28015
Description:A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary HTML code via the fname, lname, and contact parameters.
published:2025-03-13T16:15:27.810


Instruction: Please provide detailed information about CVE-2024-12858

CVE:CVE-2024-12858
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. *** Duplicate of  CVE-2025-22880  ***
published:2025-03-13T17:15:25.653


Instruction: Please provide detailed information about CVE-2025-1427

CVE:CVE-2025-1427
Description:A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:34.743


Instruction: Please provide detailed information about CVE-2025-1428

CVE:CVE-2025-1428
Description:A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:34.900


Instruction: Please provide detailed information about CVE-2025-1429

CVE:CVE-2025-1429
Description:A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:35.053


Instruction: Please provide detailed information about CVE-2025-1430

CVE:CVE-2025-1430
Description:A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:35.217


Instruction: Please provide detailed information about CVE-2025-1431

CVE:CVE-2025-1431
Description:A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:35.377


Instruction: Please provide detailed information about CVE-2025-1432

CVE:CVE-2025-1432
Description:A maliciously crafted 3DM file, when parsed through Autodesk AutoCAD, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:35.533


Instruction: Please provide detailed information about CVE-2025-1433

CVE:CVE-2025-1433
Description:A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:35.683


Instruction: Please provide detailed information about CVE-2025-1649

CVE:CVE-2025-1649
Description:A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:35.837


Instruction: Please provide detailed information about CVE-2025-1650

CVE:CVE-2025-1650
Description:A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:35.990


Instruction: Please provide detailed information about CVE-2025-1651

CVE:CVE-2025-1651
Description:A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:36.153


Instruction: Please provide detailed information about CVE-2025-1652

CVE:CVE-2025-1652
Description:A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-03-13T17:15:36.297


Instruction: Please provide detailed information about CVE-2025-1767

CVE:CVE-2025-1767
Description:This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.
published:2025-03-13T17:15:36.437


Instruction: Please provide detailed information about CVE-2025-24974

CVE:CVE-2025-24974
Description:DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
published:2025-03-13T17:15:36.777


Instruction: Please provide detailed information about CVE-2025-27103

CVE:CVE-2025-27103
Description:DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
published:2025-03-13T17:15:36.930


Instruction: Please provide detailed information about CVE-2025-27107

CVE:CVE-2025-27107
Description:Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary Java methods. This vulnerability allows for execution of arbitrary Java methods, and by extension arbitrary native code e.g. from `java.lang.Runtime.exec`, on the Minecraft server by any player with the ability to create and use an IntegratedScripting Variable Card. Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 fix the issue.
published:2025-03-13T17:15:37.073


Instruction: Please provide detailed information about CVE-2025-27138

CVE:CVE-2025-27138
Description:DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
published:2025-03-13T17:15:37.253


Instruction: Please provide detailed information about CVE-2025-28011

CVE:CVE-2025-28011
Description:A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to execute arbitrary code via the currentpassword POST request parameter.
published:2025-03-13T17:15:37.530


Instruction: Please provide detailed information about CVE-2025-29768

CVE:CVE-2025-29768
Description:Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198.
published:2025-03-13T17:15:37.623


Instruction: Please provide detailed information about CVE-2025-29773

CVE:CVE-2025-29773
Description:Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accounts with the same email address as an existing account. This creates potential issues with account identification and security. This vulnerability can be exploited by authenticated users (e.g., reseller, customer) who can create accounts with the same email address that has already been used by another account, such as the admin. The attack vector is email-based, as the system does not prevent multiple accounts from registering the same email address, leading to possible conflicts and security issues. Version 2.2.6 fixes the issue.
published:2025-03-13T17:15:37.833


Instruction: Please provide detailed information about CVE-2025-2079

CVE:CVE-2025-2079
Description:Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.
published:2025-03-13T17:15:38.080


Instruction: Please provide detailed information about CVE-2025-2080

CVE:CVE-2025-2080
Description:Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
published:2025-03-13T17:15:38.253


Instruction: Please provide detailed information about CVE-2025-2081

CVE:CVE-2025-2081
Description:Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.
published:2025-03-13T17:15:38.420


Instruction: Please provide detailed information about CVE-2025-2263

CVE:CVE-2025-2263
Description:During login to the web server in "Sante PACS Server.exe", OpenSSL function EVP_DecryptUpdate is called to decrypt the username and password. A fixed 0x80-byte stack-based buffer is passed to the function as the output buffer. A stack-based buffer overflow exists if a long encrypted username or password is supplied by an unauthenticated remote attacker.
published:2025-03-13T17:15:38.617


Instruction: Please provide detailed information about CVE-2025-2264

CVE:CVE-2025-2264
Description:A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe". An unauthenticated remote attacker can exploit it to download arbitrary files on the disk drive where the application is installed.
published:2025-03-13T17:15:38.787


Instruction: Please provide detailed information about CVE-2025-2265

CVE:CVE-2025-2265
Description:The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite database HTTP.db. However, the number of hash bytes encoded and stored is truncated if the hash contains a zero byte
published:2025-03-13T17:15:38.967


Instruction: Please provide detailed information about CVE-2025-2284

CVE:CVE-2025-2284
Description:A denial-of-service vulnerability exists in the "GetWebLoginCredentials" function in "Sante PACS Server.exe".
published:2025-03-13T17:15:39.150


Instruction: Please provide detailed information about CVE-2025-24053

CVE:CVE-2025-24053
Description:Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.
published:2025-03-13T18:15:47.597


Instruction: Please provide detailed information about CVE-2025-25363

CVE:CVE-2025-25363
Description:An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc allows attackers with Administrator privileges to execute arbitrary Javascript in context of a user's browser via injecting a crafted payload into the HTML field of a template.
published:2025-03-13T18:15:50.733


Instruction: Please provide detailed information about CVE-2025-25598

CVE:CVE-2025-25598
Description:Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers to escalate privileges via placing a crafted executable into a scheduled task.
published:2025-03-13T18:15:50.857


Instruction: Please provide detailed information about CVE-2025-27496

CVE:CVE-2025-27496
Description:Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versions 3.0.13 through 3.23.0 of the driver. When the logging level was set to DEBUG, the Driver would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations,  and is not logged server-side by Snowflake. Snowflake fixed the issue in version 3.23.1.
published:2025-03-13T19:15:52.050


Instruction: Please provide detailed information about CVE-2025-2229

CVE:CVE-2025-2229
Description:A token is created using the username, current date/time, and a fixed  AES-128 encryption key, which is the same across all installations.
published:2025-03-13T19:15:52.523


Instruction: Please provide detailed information about CVE-2025-2230

CVE:CVE-2025-2230
Description:A flaw exists in the Windows login flow where an AuthContext token can  be exploited for replay attacks and authentication bypass.
published:2025-03-13T19:15:52.750


Instruction: Please provide detailed information about CVE-2025-1266

CVE:CVE-2025-1266
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-13T22:15:14.907


Instruction: Please provide detailed information about CVE-2025-24855

CVE:CVE-2025-24855
Description:numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
published:2025-03-14T02:15:15.717


Instruction: Please provide detailed information about CVE-2025-26163

CVE:CVE-2025-26163
Description:CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the CPF parameter.
published:2025-03-14T03:15:44.333


Instruction: Please provide detailed information about CVE-2025-30022

CVE:CVE-2025-30022
Description:CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.
published:2025-03-14T03:15:45.257


Instruction: Please provide detailed information about CVE-2025-0955

CVE:CVE-2025-0955
Description:The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos.
published:2025-03-14T05:15:41.760


Instruction: Please provide detailed information about CVE-2025-1285

CVE:CVE-2025-1285
Description:The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_api_key and save_api_key AJAX actions in all versions up to, and including, 3.6. This makes it possible for unauthenticated attackers to issue requests to internal services and update API key details.
published:2025-03-14T05:15:41.977


Instruction: Please provide detailed information about CVE-2025-1528

CVE:CVE-2025-1528
Description:The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function in all versions up to, and including, 2.5.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the values of arbitrary post meta.
published:2025-03-14T05:15:42.170


Instruction: Please provide detailed information about CVE-2025-2056

CVE:CVE-2025-2056
Description:The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 5.4.01 via the showFile function. This makes it possible for unauthenticated attackers to read the contents of specific file types on the server, which can contain sensitive information.
published:2025-03-14T05:15:42.523


Instruction: Please provide detailed information about CVE-2025-2166

CVE:CVE-2025-2166
Description:The CM FAQ  – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-14T05:15:42.723


Instruction: Please provide detailed information about CVE-2025-0952

CVE:CVE-2025-0952
Description:The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' AJAX action in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
published:2025-03-14T06:15:24.683


Instruction: Please provide detailed information about CVE-2025-1764

CVE:CVE-2025-1764
Description:The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.
published:2025-03-14T06:15:24.860


Instruction: Please provide detailed information about CVE-2025-2103

CVE:CVE-2025-2103
Description:The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on theironMusic_ajax() function in all versions up to, and including, 1.6.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
published:2025-03-14T06:15:25.057


Instruction: Please provide detailed information about CVE-2025-2289

CVE:CVE-2025-2289
Description:The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import, export, and update theme options.
published:2025-03-14T06:15:25.230


Instruction: Please provide detailed information about CVE-2025-2221

CVE:CVE-2025-2221
Description:The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and including, 1.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-14T07:15:38.477


Instruction: Please provide detailed information about CVE-2025-1526

CVE:CVE-2025-1526
Description:The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget (countdown feature) in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-14T08:15:12.120


Instruction: Please provide detailed information about CVE-2025-1507

CVE:CVE-2025-1507
Description:The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_actions() function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all features.
published:2025-03-14T09:15:14.477


Instruction: Please provide detailed information about CVE-2025-2232

CVE:CVE-2025-2232
Description:The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
published:2025-03-14T12:15:14.887


Instruction: Please provide detailed information about CVE-2025-26626

CVE:CVE-2025-26626
Description:The GLPI Inventory Plugin handles various types of tasks for GLPI agents for the GLPI asset and IT management software package. Versions prior to 1.5.0 are vulnerable to reflective cross-site scripting, which may lead to executing javascript code. Version 1.5.0 fixes the issue.
published:2025-03-14T13:15:40.077


Instruction: Please provide detailed information about CVE-2025-27593

CVE:CVE-2025-27593
Description:The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems.
published:2025-03-14T13:15:40.437


Instruction: Please provide detailed information about CVE-2025-27594

CVE:CVE-2025-27594
Description:The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack.
published:2025-03-14T13:15:40.623


Instruction: Please provide detailed information about CVE-2025-27595

CVE:CVE-2025-27595
Description:The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily calculated by an attacker. This impacts the security and the integrity of the device.
published:2025-03-14T13:15:40.763


Instruction: Please provide detailed information about CVE-2025-2000

CVE:CVE-2025-2000
Description:A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A python process calling Qiskit 0.18.0 through 1.4.1's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct place in the binary file as part of specially constructed payload.
published:2025-03-14T13:15:40.907


Instruction: Please provide detailed information about CVE-2025-2304

CVE:CVE-2025-2304
Description:A Privilege Escalation through a Mass Assignment exists in Camaleon CMS  When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
published:2025-03-14T13:15:41.160


Instruction: Please provide detailed information about CVE-2025-29029

CVE:CVE-2025-29029
Description:Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function.
published:2025-03-14T14:15:17.977


Instruction: Please provide detailed information about CVE-2025-29030

CVE:CVE-2025-29030
Description:Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function.
published:2025-03-14T14:15:18.200


Instruction: Please provide detailed information about CVE-2025-29031

CVE:CVE-2025-29031
Description:Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function.
published:2025-03-14T14:15:18.430


Instruction: Please provide detailed information about CVE-2025-29032

CVE:CVE-2025-29032
Description:Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function.
published:2025-03-14T14:15:18.623


Instruction: Please provide detailed information about CVE-2025-29776

CVE:CVE-2025-29776
Description:Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` causes an immediate infinite loop of timers to be executed on the canister, each timer attempting to clean up the global state of the previous timer. The infinite loop will occur with any valid invocation of `setTimer`. The problem has been fixed as of Azle version `0.30.0`. As a workaround, if a canister is caught in this infinite loop after calling `setTimer`, the canister can be upgraded and the timers will all be cleared, thus ending the loop.
published:2025-03-14T14:15:18.847


Instruction: Please provide detailed information about CVE-2025-2268

CVE:CVE-2025-2268
Description:The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP).
published:2025-03-14T14:15:20.270


Instruction: Please provide detailed information about CVE-2025-25871

CVE:CVE-2025-25871
Description:An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function
published:2025-03-14T16:15:40.767


Instruction: Please provide detailed information about CVE-2025-25872

CVE:CVE-2025-25872
Description:An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function
published:2025-03-14T16:15:40.870


Instruction: Please provide detailed information about CVE-2025-25873

CVE:CVE-2025-25873
Description:Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root Password function
published:2025-03-14T16:15:40.980


Instruction: Please provide detailed information about CVE-2025-1888

CVE:CVE-2025-1888
Description:The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting (XSS). An authenticated user can access the slides within a project and injecting malicious JavaScript into the "memo" field. The memo field has a hover over action that will display a Microsoft Tool Tip which a user can use to quickly view the memo associated with the slide and execute the JavaScript.
published:2025-03-14T17:15:50.807


Instruction: Please provide detailed information about CVE-2025-26215

CVE:CVE-2025-26215
Description:Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
published:2025-03-14T17:15:51.613


Instruction: Please provide detailed information about CVE-2025-26216

CVE:CVE-2025-26216
Description:Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
published:2025-03-14T17:15:51.730


Instruction: Please provide detailed information about CVE-2025-27606

CVE:CVE-2025-27606
Description:Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.
published:2025-03-14T17:15:52.017


Instruction: Please provide detailed information about CVE-2025-29384

CVE:CVE-2025-29384
Description:In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
published:2025-03-14T17:15:52.230


Instruction: Please provide detailed information about CVE-2025-29385

CVE:CVE-2025-29385
Description:In Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
published:2025-03-14T17:15:52.393


Instruction: Please provide detailed information about CVE-2025-29386

CVE:CVE-2025-29386
Description:In Tenda AC9 v1.0 V15.03.05.14_multi, the mac parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
published:2025-03-14T17:15:52.557


Instruction: Please provide detailed information about CVE-2025-29387

CVE:CVE-2025-29387
Description:In Tenda AC9 v1.0 V15.03.05.14_multi, the wanSpeed parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
published:2025-03-14T17:15:52.720


Instruction: Please provide detailed information about CVE-2025-29774

CVE:CVE-2025-29774
Description:xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker with a valid account to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.
published:2025-03-14T17:15:52.870


Instruction: Please provide detailed information about CVE-2025-26312

CVE:CVE-2025-26312
Description:SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter.
published:2025-03-14T18:15:31.817


Instruction: Please provide detailed information about CVE-2025-29775

CVE:CVE-2025-29775
Description:xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.
published:2025-03-14T18:15:32.180


Instruction: Please provide detailed information about CVE-2025-29779

CVE:CVE-2025-29779
Description:Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 and prior, the `secure_redundant_execution` function in feldman_vss.py attempts to mitigate fault injection attacks by executing a function multiple times and comparing results. However, several critical weaknesses exist. Python's execution environment cannot guarantee true isolation between redundant executions, the constant-time comparison implementation in Python is subject to timing variations, the randomized execution order and timing provide insufficient protection against sophisticated fault attacks, and the error handling may leak timing information about partial execution results. These limitations make the protection ineffective against targeted fault injection attacks, especially from attackers with physical access to the hardware. A successful fault injection attack could allow an attacker to bypass the redundancy check mechanisms, extract secret polynomial coefficients during share generation or verification, force the acceptance of invalid shares during verification, and/or manipulate the commitment verification process to accept fraudulent commitments. This undermines the core security guarantees of the Verifiable Secret Sharing scheme. As of time of publication, no patched versions of Post-Quantum Secure Feldman's Verifiable Secret Sharing exist, but other mitigations are available. Long-term remediation requires reimplementing the security-critical functions in a lower-level language like Rust. Short-term mitigations include deploying the software in environments with physical security controls, increasing the redundancy count (from 5 to a higher number) by modifying the source code, adding external verification of cryptographic operations when possible, considering using hardware security modules (HSMs) for key operations.
published:2025-03-14T18:15:32.330


Instruction: Please provide detailed information about CVE-2025-29780

CVE:CVE-2025-29780
Description:Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 and prior, the `feldman_vss` library contains timing side-channel vulnerabilities in its matrix operations, specifically within the `_find_secure_pivot` function and potentially other parts of `_secure_matrix_solve`. These vulnerabilities are due to Python's execution model, which does not guarantee constant-time execution. An attacker with the ability to measure the execution time of these functions (e.g., through repeated calls with carefully crafted inputs) could potentially recover secret information used in the Verifiable Secret Sharing (VSS) scheme. The `_find_secure_pivot` function, used during Gaussian elimination in `_secure_matrix_solve`, attempts to find a non-zero pivot element. However, the conditional statement `if matrix[row][col] != 0 and row_random < min_value:` has execution time that depends on the value of `matrix[row][col]`. This timing difference can be exploited by an attacker. The `constant_time_compare` function in this file also does not provide a constant-time guarantee. The Python implementation of matrix operations in the _find_secure_pivot and _secure_matrix_solve functions cannot guarantee constant-time execution, potentially leaking information about secret polynomial coefficients. An attacker with the ability to make precise timing measurements of these operations could potentially extract secret information through statistical analysis of execution times, though practical exploitation would require significant expertise and controlled execution environments. Successful exploitation of these timing side-channels could allow an attacker to recover secret keys or other sensitive information protected by the VSS scheme. This could lead to a complete compromise of the shared secret. As of time of publication, no patched versions of Post-Quantum Secure Feldman's Verifiable Secret Sharing exist, but other mitigations are available. As acknowledged in the library's documentation, these vulnerabilities cannot be adequately addressed in pure Python. In the short term, consider using this library only in environments where timing measurements by attackers are infeasible. In the medium term, implement your own wrappers around critical operations using constant-time libraries in languages like Rust, Go, or C. In the long term, wait for the planned Rust implementation mentioned in the library documentation that will properly address these issues.
published:2025-03-14T18:15:32.503


Instruction: Please provide detailed information about CVE-2025-29771

CVE:CVE-2025-29771
Description:HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. The issue is patched in version 2.0.3.
published:2025-03-14T19:15:48.847


Instruction: Please provide detailed information about CVE-2025-29782

CVE:CVE-2025-29782
Description:WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` endpoint in versions of the WeGIA application prior to 3.2.17. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Version 3.2.17 contains a patch for the issue.
published:2025-03-14T19:15:49.190


Instruction: Please provide detailed information about CVE-2025-2308

CVE:CVE-2025-2308
Description:A vulnerability, which was classified as critical, was found in HDF5 1.14.6. This affects the function H5Z__scaleoffset_decompress_one_byte of the component Scale-Offset Filter. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about a batch of vulnerabilities. His response was "reject" without further explanation. We have not received an elaboration even after asking politely for further details. Currently we assume that the vendor wants to "dispute" the entries which is why they are flagged as such until further details become available.
published:2025-03-14T21:15:37.043


Instruction: Please provide detailed information about CVE-2025-2309

CVE:CVE-2025-2309
Description:A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5T__bit_copy of the component Type Conversion Logic. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about a batch of vulnerabilities. His response was "reject" without further explanation. We have not received an elaboration even after asking politely for further details. Currently we assume that the vendor wants to "dispute" the entries which is why they are flagged as such until further details become available.
published:2025-03-14T21:15:37.260


Instruction: Please provide detailed information about CVE-2025-2310

CVE:CVE-2025-2310
Description:A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor was contacted early about a batch of vulnerabilities. His response was "reject" without further explanation. We have not received an elaboration even after asking politely for further details. Currently we assume that the vendor wants to "dispute" the entries which is why they are flagged as such until further details become available.
published:2025-03-14T21:15:37.443


Instruction: Please provide detailed information about CVE-2025-2295

CVE:CVE-2025-2295
Description:EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
published:2025-03-14T22:15:11.600


Instruction: Please provide detailed information about CVE-2025-2320

CVE:CVE-2025-2320
Description:A vulnerability has been found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this vulnerability is the function submit of the file /api/blade-user/submit of the component User Handler. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-14T22:15:11.747


Instruction: Please provide detailed information about CVE-2025-1653

CVE:CVE-2025-1653
Description:The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.7. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user meta that can be updated. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
published:2025-03-15T03:15:34.457


Instruction: Please provide detailed information about CVE-2025-1657

CVE:CVE-2025-1657
Description:The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to update post meta data and inject PHP Objects that may be unserialized.
published:2025-03-15T03:15:34.600


Instruction: Please provide detailed information about CVE-2025-1667

CVE:CVE-2025-1667
Description:The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTeacher() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to update arbitrary user details including email which makes it possible to request a password reset and access arbitrary user accounts, including administrators.
published:2025-03-15T04:15:21.273


Instruction: Please provide detailed information about CVE-2025-1668

CVE:CVE-2025-1668
Description:The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_DeleteUser() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to delete arbitrary user accounts.
published:2025-03-15T04:15:21.457


Instruction: Please provide detailed information about CVE-2025-1669

CVE:CVE-2025-1669
Description:The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with teacher-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-15T04:15:21.630


Instruction: Please provide detailed information about CVE-2025-1670

CVE:CVE-2025-1670
Description:The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-15T04:15:21.810


Instruction: Please provide detailed information about CVE-2025-2163

CVE:CVE-2025-2163
Description:The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on  the zoorum_set_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-03-15T04:15:22.073


Instruction: Please provide detailed information about CVE-2025-2164

CVE:CVE-2025-2164
Description:The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-15T04:15:22.260


Instruction: Please provide detailed information about CVE-2025-2267

CVE:CVE-2025-2267
Description:The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the make_archive() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information.
published:2025-03-15T04:15:22.443