Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-25201 State: PUBLISHED Published: 2025-02-12T18:07:13.686Z Last Updated: 2025-02-12T19:28:06.886Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Nitrokey Products: nitrokey-3-firmware Problem Types: CWE-287 Description: Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the application. An attacker without access to the proper administration key would be able to generate new keys and overwrite certificates. Such
cker without access to the proper administration key would be able to generate new keys and overwrite certificates. Such an attacker would not be able to read-out or extract existing private data, nor would they be able to gain access to cryptographic operations that would normally require PIN-based authentication. The issue is fixed in piv-authenticator 0.3.9, and in Nitrokey's firmware 1.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Nitrokey/nitrokey-3-firmware/security/advisories/GHSA-jfhm-ppq8-7hgx - https://github.com/Nitrokey/nitrokey-3-firmware/releases/tag/v1.8.1 - https://www.nitrokey.com/blog/2025/nitrokey-3-firmware-v181-security-update
CVE ID: CVE-2025-25202 State: PUBLISHED Published: 2025-02-11T18:28:19.046Z Last Updated: 2025-02-12T20:12:08.180Z Vendors: team-alembic Products: ash_authentication Problem Types: CWE-269 Description: Ash Authentication is an authentication framework for Elixir applications. Applications which have been bootstrapped by the igniter installer present since AshAuthentication v4.1.0 and who have used the magic link strategy _or_ are manually revoking tokens are affected by revoked tokens being allowed to verify as valid. Unless one hase implemented any kind of custom token revocation feature in your application, then one will not be affected. The impact here for users using builtin functionalit
ocation feature in your application, then one will not be affected. The impact here for users using builtin functionality is that magic link tokens are reusable until they expire. With that said, magic link tokens are only valid for 10 minutes, so the surface area for abuse is extremely low here. The flaw is patched in version 4.4.9. Additionally a compile time warning is shown to users with remediation instructions if they upgrade. 4.4.9 ships with an upgrader, so those who use `mix igniter.upgrade ash_authentication` will have the necessary patch applied. Otherwise, one may run the upgrader manually as described in the error message. As a workaround, delete the generated `:revoked?` generi
ay run the upgrader manually as described in the error message. As a workaround, delete the generated `:revoked?` generic action in the token resource. This will cause it to use the one internal to Ash Authentication which has always been correct. Alternatively, manually make the changes that are included in the patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-qrm9-f75w-hg4c - https://github.com/team-alembic/ash_authentication/commit/2dee55252df26fe3d990ff1199397cdcf1bfea8a
CVE ID: CVE-2025-25203 State: PUBLISHED Published: 2025-02-11T22:47:43.890Z Last Updated: 2025-02-12T15:34:14.901Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Ctrlpanel-gg Products: panel Problem Types: CWE-79 Description: CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting (XSS) vulnerability exists in the `TicketsController` and `Moderation/TicketsController` due to insufficient input validation on the `priority` field during ticket creation and unsafe rendering of this field in the moderator panel. Version 1.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
the moderator panel. Version 1.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-2q43-grv2-jxwh - https://github.com/Ctrlpanel-gg/panel/commit/393cbde662c7e54829e296eb5815794490d925c7
CVE ID: CVE-2025-25204 State: PUBLISHED Published: 2025-02-14T16:38:29.038Z Last Updated: 2025-03-03T19:13:28.888Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: cli Products: cli Problem Types: CWE-390 Description: `gh` is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attac
ent, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cli/cli/security/advisories/GHSA-fgw4-v983-mgp8 - https://github.com/cli/cli/issues/10418 - https://github.com/cli/cli/pull/10421
CVE ID: CVE-2025-25205 State: PUBLISHED Published: 2025-02-12T18:16:01.326Z Last Updated: 2025-02-13T14:14:25.849Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: advplyr Products: audiobookshelf Problem Types: CWE-202, CWE-287, CWE-400 Description: Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like "/api/items/1/cover" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server
"/api/items/1/cover" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw - https://github.com/advplyr/audiobookshelf/pull/3584 - https://github.com/advplyr/audiobookshelf/commit/bf8407274e3ee300af1927ee660d078a7a801e1c - https://github.co
ull/3584 - https://github.com/advplyr/audiobookshelf/commit/bf8407274e3ee300af1927ee660d078a7a801e1c - https://github.com/advplyr/audiobookshelf/commit/ec6537656925a43871b07cfee12c9f383844d224 - https://github.com/advplyr/audiobookshelf/blob/1a3d70d04100924d41391acb55bd8ddca486a4fa/server/Auth.js#L17-L41
CVE ID: CVE-2025-25206 State: PUBLISHED Published: 2025-02-14T16:47:04.660Z Last Updated: 2025-02-14T17:28:44.566Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: elabftw Products: elabftw Problem Types: CWE-89 Description: eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if cookies are enabled (default setting). Users must upgrade to eLabFTW version 5.1.15 to receive a fix. No known workarounds are available. Additional
setting). Users must upgrade to eLabFTW version 5.1.15 to receive a fix. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/elabftw/elabftw/security/advisories/GHSA-qffc-rfjh-77gg - https://github.com/elabftw/elabftw/releases/tag/5.1.15
CVE ID: CVE-2025-25207 State: PUBLISHED Published: 2025-06-09T06:12:51.416Z Last Updated: 2025-11-20T21:04:16.220Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Connectivity Link 1 Problem Types: CWE-400 Description: The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy
r persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-25207 - https://bugzilla.redhat.com/show_bug.cgi?id=2347421
CVE ID: CVE-2025-25208 State: PUBLISHED Published: 2025-06-09T06:13:03.864Z Last Updated: 2025-11-20T21:04:22.513Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Connectivity Link 1 Problem Types: CWE-400 Description: A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-25208 - https://bugzilla.redhat.com/show_bug.cgi?id=2347436
CVE ID: CVE-2025-25209 State: PUBLISHED Published: 2025-06-09T06:13:56.342Z Last Updated: 2025-11-20T21:04:28.780Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) Vendors: Red Hat Products: Red Hat Connectivity Link 1 Problem Types: CWE-200 Description: The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-system instead of copying it to the referred namespace. This creates space for a malicious actor with a developer persona access to leak those secrets over HTTP connection, as long the attacker knows the name of the targeted secrets and those secrets are limited t
ecrets over HTTP connection, as long the attacker knows the name of the targeted secrets and those secrets are limited to one line only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-25209 - https://bugzilla.redhat.com/show_bug.cgi?id=2347438
CVE ID: CVE-2025-25211 State: PUBLISHED Published: 2025-03-31T04:49:19.439Z Last Updated: 2025-03-31T16:01:20.073Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Inaba Denki Sangyo Co., Ltd. Products: CHOCO TEI WATCHER mini (IB-MCT001) Problem Types: CWE-521 Description: Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a brute-force attack may allow an attacker unauthorized access and login. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/files/chocomini_vulnerability.pdf - https://jvn.jp/en/vu/JVNVU91154745/ - https://www.cisa.gov/news-events/i
inaba.co.jp/files/chocomini_vulnerability.pdf - https://jvn.jp/en/vu/JVNVU91154745/ - https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-04 - https://www.nozominetworks.com/blog/unpatched-vulnerabilities-in-production-line-cameras-may-allow-remote-surveillance-hinder-stoppage-recording
CVE ID: CVE-2025-25212 State: PUBLISHED Published: 2025-08-11T02:55:17.285Z Last Updated: 2025-08-12T14:29:07.428Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-20 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE ID: CVE-2025-25213 State: PUBLISHED Published: 2025-04-09T09:03:20.081Z Last Updated: 2025-04-09T17:07:57.202Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Inaba Denki Sangyo Co., Ltd. Products: AC-WPS-11ac, AC-WPS-11ac-P, AC-WPSM-11ac, AC-WPSM-11ac-P, AC-PD-WPS-11ac, AC-PD-WPS-11ac-P Problem Types: CWE-1021 Description: Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malicious page while logged in, unintended operations may be performed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/securit
erformed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/security_20250404.pdf - https://jvn.jp/en/vu/JVNVU93925742/
CVE ID: CVE-2025-25214 State: PUBLISHED Published: 2025-07-24T15:10:58.938Z Last Updated: 2025-11-03T19:44:56.939Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-362 Description: A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of specially crafted HTTP request can lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2212
CVE ID: CVE-2025-25215 State: PUBLISHED Published: 2025-06-13T21:26:58.869Z Last Updated: 2025-11-03T19:44:58.322Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-763 Description: An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ww
this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053
CVE ID: CVE-2025-25216 State: PUBLISHED Published: 2025-11-11T16:50:11.413Z Last Updated: 2025-11-12T20:01:08.068Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) Graphics Drivers and Intel LTS kernels Problem Types: Denial of Service, CWE-20 Description: Improper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present with special i
enial of service. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01356.html
CVE ID: CVE-2025-25217 State: PUBLISHED Published: 2025-06-08T11:46:49.353Z Last Updated: 2025-06-09T03:31:54.576Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-476 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-06.md
CVE ID: CVE-2025-25218 State: PUBLISHED Published: 2025-05-06T08:50:02.099Z Last Updated: 2025-05-06T15:30:17.612Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-476 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md
CVE ID: CVE-2025-25220 State: PUBLISHED Published: 2025-03-18T08:26:13.758Z Last Updated: 2025-03-18T13:56:45.521Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: FUJI SOFT INCORPORATED Products: +F FS010M Problem Types: CWE-78 Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.1_1101. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fsi-plusf.jp/news/25031701.html - https://jvn.jp/en/jp/JVN11230428/
CVE ID: CVE-2025-25221 State: PUBLISHED Published: 2025-02-18T00:10:25.747Z Last Updated: 2025-02-18T15:24:46.624Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: LuxSoft Products: The LuxCal Web Calendar Problem Types: CWE-89 Description: The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.luxsoft.eu/?download - https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984 - https://jvn.jp/en/jp
- https://www.luxsoft.eu/?download - https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984 - https://jvn.jp/en/jp/JVN26024080/
CVE ID: CVE-2025-25222 State: PUBLISHED Published: 2025-02-18T00:11:03.172Z Last Updated: 2025-02-18T19:29:28.127Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: LuxSoft Products: The LuxCal Web Calendar Problem Types: CWE-89 Description: The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.luxsoft.eu/?download - https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984 - https://jvn.jp/
nces: - https://www.luxsoft.eu/?download - https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984 - https://jvn.jp/en/jp/JVN26024080/
CVE ID: CVE-2025-25223 State: PUBLISHED Published: 2025-02-18T00:11:36.413Z Last Updated: 2025-02-18T19:29:16.869Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: LuxSoft Products: The LuxCal Web Calendar Problem Types: CWE-22 Description: The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.luxsoft.eu/?download - https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984 - https://jvn.jp/en/jp/JVN26024080/
CVE ID: CVE-2025-25224 State: PUBLISHED Published: 2025-02-18T00:12:21.912Z Last Updated: 2025-02-18T19:29:03.746Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: LuxSoft Products: The LuxCal Web Calendar Problem Types: CWE-306 Description: The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability in dloader.php. If this vulnerability is exploited, arbitrary files on a server may be obtained. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.luxsoft.eu/?download - https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984 - https://jvn.jp/en/jp/JVN2
tps://www.luxsoft.eu/?download - https://www.luxsoft.eu/lcforum/viewtopic.php?pid=1984#p1984 - https://jvn.jp/en/jp/JVN26024080/
CVE ID: CVE-2025-25225 State: PUBLISHED Published: 2025-03-15T18:06:41.769Z Last Updated: 2025-03-19T04:34:38.101Z Vendors: hikashop.com Products: Hikashop component for Joomla Problem Types: CWE-284 Description: A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikashop.com/ - https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-25225
CVE ID: CVE-2025-25226 State: PUBLISHED Published: 2025-04-08T16:24:34.710Z Last Updated: 2025-04-21T07:16:38.978Z Vendors: Joomla! Project Products: Joomla! Framework Problem Types: CWE-89 Description: Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used. Additional Analyst Notes: - CISA ADP V
extending the affected class might be affected, if the vulnerable method is used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/963-20250401-framework-sql-injection-vulnerability-in-quotenamestr-method-of-database-package.html
CVE ID: CVE-2025-25227 State: PUBLISHED Published: 2025-04-08T16:24:18.330Z Last Updated: 2025-04-21T07:16:35.672Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-287 Description: Insufficient state checks lead to a vector that allows to bypass 2FA checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/964-20250402-core-mfa-authentication-bypass.html
CVE ID: CVE-2025-25228 State: PUBLISHED Published: 2025-04-21T07:16:45.498Z Last Updated: 2025-05-07T04:36:46.068Z Vendors: virtuemart.net Products: Virtuemart component for Joomla Problem Types: CWE-89 Description: A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the product management area in backend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://virtuemart.net/ - https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-25228
CVE ID: CVE-2025-25229 State: PUBLISHED Published: 2025-08-11T18:24:17.625Z Last Updated: 2025-08-11T18:41:08.281Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Omnissa Products: Omnissa Workspace ONE UEM Description: Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.omnissa.com/omsa-2025-0004/ - https://www.omnissa.com/omnissa-security-response/