Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-59762 State: PUBLISHED Published: 2025-10-02T14:35:39.228Z Last Updated: 2025-10-02T15:43:52.400Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DLG.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59763 State: PUBLISHED Published: 2025-10-02T14:36:12.640Z Last Updated: 2025-10-02T15:43:45.355Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_EK.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59764 State: PUBLISHED Published: 2025-10-02T14:36:56.961Z Last Updated: 2025-10-02T15:43:38.267Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_FCC.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59765 State: PUBLISHED Published: 2025-10-02T14:37:29.171Z Last Updated: 2025-10-02T15:43:31.319Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_LF.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59766 State: PUBLISHED Published: 2025-10-02T14:38:00.891Z Last Updated: 2025-10-02T15:43:21.301Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_LT.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59767 State: PUBLISHED Published: 2025-10-02T14:38:43.377Z Last Updated: 2025-10-02T15:43:13.947Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_LVE.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59768 State: PUBLISHED Published: 2025-10-02T14:39:08.452Z Last Updated: 2025-10-02T15:43:05.387Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_MNG.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59769 State: PUBLISHED Published: 2025-10-02T14:39:37.620Z Last Updated: 2025-10-02T15:41:31.626Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_MOL.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59770 State: PUBLISHED Published: 2025-10-02T14:41:43.808Z Last Updated: 2025-10-02T15:41:24.935Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_MON.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59771 State: PUBLISHED Published: 2025-10-02T14:42:31.892Z Last Updated: 2025-10-02T15:41:17.227Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_MRK.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59772 State: PUBLISHED Published: 2025-10-02T14:46:29.504Z Last Updated: 2025-10-02T15:41:11.333Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_SIL.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59773 State: PUBLISHED Published: 2025-10-02T14:47:52.132Z Last Updated: 2025-10-02T15:41:03.473Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_TP.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59774 State: PUBLISHED Published: 2025-10-02T14:48:21.842Z Last Updated: 2025-10-02T15:40:55.725Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_VON.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59776 State: PUBLISHED Published: 2025-10-23T22:17:23.123Z Last Updated: 2025-10-24T14:27:46.119Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: AutomationDirect Products: Productivity Suite, Productivity 3000 P3-622 CPU, Productivity 3000 P3-550E CPU, Productivity 3000 P3-530 CPU, Productivity 2000 P2-622 CPU, Productivity 2000 P2-550 CPU, Productivity 1000 P1-550 CPU, Productivity 1000 P1-540 CPU Problem Types: CWE-23 Description: A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simu
4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and create arbitrary directories on the target machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01 - https://www.automationdirect.com/support/software-downloads - https://support.automationdirect.com/docs/securityconsiderations.pdf - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json
CVE ID: CVE-2025-59777 State: PUBLISHED Published: 2025-11-10T04:10:44.836Z Last Updated: 2025-11-10T21:41:04.217Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GNU Project Products: GNU libbmicrohttpd Problem Types: CWE-476 Description: NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gnu.org/software/libmicrohttpd/ - https://
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gnu.org/software/libmicrohttpd/ - https://git.gnunet.org/libmicrohttpd.git/commit/?id=ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b - https://jvn.jp/en/jp/JVN76719218/
CVE ID: CVE-2025-59778 State: PUBLISHED Published: 2025-10-15T13:55:49.239Z Last Updated: 2025-10-16T03:56:38.832Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: F5OS - Chassis Problem Types: CWE-770 Description: When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000151718
CVE ID: CVE-2025-59780 State: PUBLISHED Published: 2025-11-14T23:26:35.691Z Last Updated: 2025-11-17T16:54:08.683Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: General Industrial Controls Products: Lynx+ Gateway Problem Types: CWE-306 Description: General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to send GET requests to obtain sensitive device information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-08 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-08.json
CVE ID: CVE-2025-59781 State: PUBLISHED Published: 2025-10-15T13:55:46.562Z Last Updated: 2025-10-16T03:56:29.117Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next CNF Problem Types: CWE-459 Description: When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000150637
CVE ID: CVE-2025-59797 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-22T15:37:43.428Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Profession Fit Products: Profession Fit Problem Types: CWE-425 Description: Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management page, and the plane page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.profession-fit.de - https://github.com/Henkel-CyberVM/CVEs/blob/main/CVE-2025-59797/README.md
CVE ID: CVE-2025-59798 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-11-03T17:45:20.873Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Artifex Products: Ghostscript Problem Types: CWE-121 Description: Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708539 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=0cae41b23a9669e801211dd4cf97b6dadd6dbdd7
CVE ID: CVE-2025-59799 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-11-03T17:45:21.821Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Artifex Products: Ghostscript Problem Types: CWE-121 Description: Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708517 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=6dab38fb211f15226c242ab7a83fa53e4b0ff781
CVE ID: CVE-2025-59800 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-23T13:52:36.379Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Artifex Products: Ghostscript Problem Types: CWE-190 Description: In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708602 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=176cf0188a2294bc307b8caec876f39412e58350
CVE ID: CVE-2025-59801 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-23T13:53:45.701Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Artifex Products: GhostXPS Problem Types: CWE-121 Description: In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708819 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=99727069197d548a8db69ba5d63f766bff40eaab
CVE ID: CVE-2025-59811 State: REJECTED Published: N/A Last Updated: 2025-09-23T02:55:11.835Z Description: No description available.
CVE ID: CVE-2025-59812 State: REJECTED Published: N/A Last Updated: 2025-09-23T02:55:11.369Z Description: No description available.
CVE ID: CVE-2025-59813 State: REJECTED Published: N/A Last Updated: 2025-09-23T02:55:10.886Z Description: No description available.
CVE ID: CVE-2025-59814 State: PUBLISHED Published: 2025-09-25T19:29:34.809Z Last Updated: 2025-09-29T17:25:33.798Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zenitel Products: ICX500, ICX510 Problem Types: CWE-89 Description: This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes - https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System
CVE ID: CVE-2025-59815 State: PUBLISHED Published: 2025-09-25T19:29:50.228Z Last Updated: 2025-09-29T17:15:41.293Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Zenitel Products: ICX500, ICX510 Problem Types: CWE-77 Description: This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes - https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System
CVE ID: CVE-2025-59816 State: PUBLISHED Published: 2025-09-25T19:30:03.608Z Last Updated: 2025-09-26T15:42:38.822Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Zenitel Products: ICX500, ICX510 Problem Types: CWE-89 Description: This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes - https://wiki.zenitel.com/wiki/Downloads#IC
nt: References: - https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes - https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System
CVE ID: CVE-2025-59817 State: PUBLISHED Published: 2025-09-25T19:30:15.139Z Last Updated: 2025-09-29T17:11:42.964Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Zenitel Products: TCIS-3+ Problem Types: CWE-77 Description: This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploitation grants full control over the device, potentially compromising its availability, confidentiality, and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zenitel.com/wiki/Downloads#Stations_and_Devices
CVE ID: CVE-2025-59821 State: PUBLISHED Published: 2025-09-23T17:42:17.239Z Last Updated: 2025-09-23T18:37:15.165Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim
ion does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-jc4g-c8ww-5738
CVE ID: CVE-2025-59822 State: PUBLISHED Published: 2025-09-23T18:54:42.867Z Last Updated: 2025-09-23T19:17:26.320Z Vendors: http4s Products: http4s Problem Types: CWE-444 Description: Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enable attackers to bypass front-end servers security controls, launch targeted attacks against active users, and poison web caches. A pre-requisite for exploitation involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has be
tion involves the web application being deployed behind a reverse-proxy that forwards trailer headers. This issue has been patched in versions 1.0.0-M45 and 0.23.31. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/http4s/http4s/security/advisories/GHSA-wcwh-7gfw-5wrr - https://github.com/http4s/http4s/commit/dd518f7c967e5165813b8d4a48a82b8fab852d41
CVE ID: CVE-2025-59823 State: PUBLISHED Published: 2025-09-25T14:17:37.607Z Last Updated: 2025-09-29T14:39:30.598Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: gardener Products: gardener-extension-provider-aws Problem Types: CWE-94 Description: Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP providers prior to version 1.46.0. This vulnerability could allow a user with administrative privileges for a Gardener p
providers prior to version 1.46.0. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components. This issue has been patched in Gardener Extensions for AWS providers version 1.64.0, Azure providers version 1.55.0, OpenStack providers version 1.49.0, and GCP providers version 1.46.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-
nrichment: References: - https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6 - https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0 - https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0 - https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0 - https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0
CVE ID: CVE-2025-59824 State: PUBLISHED Published: 2025-09-24T19:48:23.935Z Last Updated: 2025-09-24T20:09:36.681Z Vendors: siderolabs Products: omni Problem Types: CWE-863 Description: Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni and each Talos machine establish a peer-to-peer (P2P) SideroLink connection using WireGuard to mutually authenticate and authorize access. The WireGuard interface on Omni is configured to ensure that the source IP address of an incoming packet matches the IPv6 address assigned to the Talos peer. However, it performs no validation on the packet's destinati