Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6497 State: PUBLISHED Published: 2025-06-23T00:31:07.356Z Last Updated: 2025-06-23T13:02:06.964Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: HTACG Products: tidy-html5 Problem Types: CWE-617 Description: A vulnerability was found in HTACG tidy-html5 5.8.0. It has been rated as problematic. This issue affects the function prvTidyParseNamespace of the file src/parser.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313613 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313613 - https://vuldb.com/?ctiid.313613 - https://vuldb.com/?submit.601008 - https://github.com/htacg/tidy-html5/issues/1142 - https://github.com/user-attachments/files/19825297/tidy-html5_crash_2.txt
CVE ID: CVE-2025-6498 State: PUBLISHED Published: 2025-06-23T01:31:05.868Z Last Updated: 2025-06-23T13:45:07.073Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: HTACG Products: tidy-html5 Problem Types: CWE-401, CWE-404 Description: A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0. Affected is the function defaultAlloc of the file src/alloc.c. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313614 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313614 - https://vuldb.com/?ctiid.313614 - https://vuldb.com/?submit.601009 - https://github.com/htacg/tidy-html5/issues/1152 - https://github.com/user-attachments/files/20438303/tidy-html5_crash_3.txt
CVE ID: CVE-2025-6499 State: PUBLISHED Published: 2025-06-23T02:00:08.771Z Last Updated: 2025-06-23T13:29:29.523Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: vstakhov Products: libucl Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as problematic was found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_parse_multiline_string of the file src/ucl_parser.c. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313615 - https://vuldb.com/?ctiid.313615 - https://vuldb.com/?submit.601011 - https://github.com/vstakhov/libucl/issues/319 - https://github.com/user-attachments/files/19825399/libucl_crash.txt
CVE ID: CVE-2025-6500 State: PUBLISHED Published: 2025-06-23T02:31:06.887Z Last Updated: 2025-06-23T13:28:25.788Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /php_action/editCategories.php. The manipulation of the argument editCategoriesName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes
attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313616 - https://vuldb.com/?ctiid.313616 - https://vuldb.com/?submit.601250 - https://github.com/mex135605/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-6501 State: PUBLISHED Published: 2025-06-23T03:00:15.916Z Last Updated: 2025-06-23T13:27:50.412Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part of the file /php_action/createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
ttack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313617 - https://vuldb.com/?ctiid.313617 - https://vuldb.com/?submit.601251 - https://github.com/mex135605/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-6502 State: PUBLISHED Published: 2025-06-23T03:31:05.474Z Last Updated: 2025-06-23T12:54:37.053Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php_action/changePassword.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313618 - https://vuldb.com/?ctiid.313618 - https://vuldb.com/?submit.601252 - https://github.com/mex135605/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-6503 State: PUBLISHED Published: 2025-06-23T04:00:16.529Z Last Updated: 2025-06-23T12:51:38.474Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /php_action/fetchSelectedCategories.php. The manipulation of the argument categoriesId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
ated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313619 - https://vuldb.com/?ctiid.313619 - https://vuldb.com/?submit.601286 - https://github.com/YunQipao/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-6504 State: PUBLISHED Published: 2025-07-29T12:56:28.054Z Last Updated: 2025-07-29T13:27:02.851Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Progress Software Products: Hybrid Data Pipeline Problem Types: Unauthorized Access to Sensitive resources Description: In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range. This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be requir
ge. This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6504
CVE ID: CVE-2025-6505 State: PUBLISHED Published: 2025-07-29T12:56:57.219Z Last Updated: 2025-07-29T13:25:19.719Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Hybrid Data Pipeline Problem Types: Unauthorized Access and Impersonation Description: Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. When OAuth Clients perform an OAuth handshake with the Hybrid Data Pipeline Server, the server ac
d unauthorized access. When OAuth Clients perform an OAuth handshake with the Hybrid Data Pipeline Server, the server accepts client credentials from both HTTP headers and request parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6505
CVE ID: CVE-2025-6507 State: PUBLISHED Published: 2025-09-01T05:10:21.567Z Last Updated: 2025-09-02T19:29:12.231Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: h2oai Products: h2oai/h2o-3 Problem Types: CWE-502 Description: A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files. This issue affects the latest master branch version 3.47.0.99999. The vulnerability arises from the ability to bypass regular expression filters intended to prevent malicious parameter injection in JDBC connections. Attackers can manipulate spaces betw
sion filters intended to prevent malicious parameter injection in JDBC connections. Attackers can manipulate spaces between parameters to evade detection, allowing for unauthorized file access and code execution. The vulnerability is addressed in version 3.46.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0a9d527a-2d39-4bc0-bf01-1e717587f077 - https://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d
CVE ID: CVE-2025-6509 State: PUBLISHED Published: 2025-06-23T15:31:05.152Z Last Updated: 2025-06-23T15:48:52.332Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: seaswalker Products: spring-analysis Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in seaswalker spring-analysis up to 4379cce848af96997a9d7ef91d594aa129be8d71. It has been declared as problematic. Affected by this vulnerability is the function echo of the file /src/main/java/controller/SimpleController.java. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This pr
te scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313621 - https://vuldb.com/?ctiid.313621 - https://vuldb.com/?submit.592962 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250609-01/report.md - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250609-01/report.md#steps-to-reproduce
CVE ID: CVE-2025-6510 State: PUBLISHED Published: 2025-06-23T16:00:16.088Z Last Updated: 2025-07-15T09:22:08.274Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C) Vendors: Netgear Products: EX6100 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Netgear EX6100 1.0.2.28_1.1.138. It has been rated as critical. Affected by this issue is the function sub_415EF8. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
y affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313622 - https://vuldb.com/?ctiid.313622 - https://vuldb.com/?submit.593678 - https://vuldb.com/?submit.595995 - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-ex6100-netgear - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-ex6100-netgear#poc - https://www.netgear.com/
CVE ID: CVE-2025-6511 State: PUBLISHED Published: 2025-06-23T16:31:05.057Z Last Updated: 2025-07-15T09:22:10.244Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:C) Vendors: Netgear Products: EX6150 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical has been found in Netgear EX6150 1.0.0.46_1.0.76. This affects the function sub_410090. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
cts products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313623 - https://vuldb.com/?ctiid.313623 - https://vuldb.com/?submit.595999 - https://vuldb.com/?submit.596008 - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-ex6150-netgear - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-ex6150-netgear#poc - https://www.netgear.com/
CVE ID: CVE-2025-6512 State: PUBLISHED Published: 2025-06-23T12:48:33.951Z Last Updated: 2025-06-23T13:22:47.485Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Bizerba SE & Co. KG Products: BRAIN2 Problem Types: CWE-94 Description: On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0004.pdf
CVE ID: CVE-2025-6513 State: PUBLISHED Published: 2025-06-23T12:37:55.000Z Last Updated: 2025-06-23T13:25:56.804Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Bizerba SE & Co. KG Products: BRAIN2 Problem Types: CWE-260 Description: Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0003.pdf
CVE ID: CVE-2025-6514 State: PUBLISHED Published: 2025-07-09T12:41:44.921Z Last Updated: 2025-07-09T13:06:05.402Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Problem Types: CWE-78 Description: mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844/ - https://github.com/geelen/mcp-remote/commit/607b226a356cb61a239ffaba2fb3db1c9dea4bac - https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability
CVE ID: CVE-2025-6515 State: PUBLISHED Published: 2025-10-20T16:13:43.527Z Last Updated: 2025-10-20T16:33:47.787Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: oatpp Products: oatpp-mcp Problem Types: CWE-330 Description: The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses from the oatpp-mcp server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/oatpp-mcp
r. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/oatpp-mcp-prompt-hijacking-jfsa-2025-001494691/
CVE ID: CVE-2025-6516 State: PUBLISHED Published: 2025-06-23T17:00:17.189Z Last Updated: 2025-06-23T17:40:18.086Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability has been found in HDF5 up to 1.14.6 and classified as critical. This vulnerability affects the function H5F_addr_decode_len of the file /hdf5/src/H5Fint.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313636 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313636 - https://vuldb.com/?ctiid.313636 - https://vuldb.com/?submit.592589 - https://github.com/HDFGroup/hdf5/issues/5581 - https://github.com/user-attachments/files/20626851/reproduce.tar.gz
CVE ID: CVE-2025-6517 State: PUBLISHED Published: 2025-06-23T18:00:15.580Z Last Updated: 2025-06-24T13:33:50.343Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C) Vendors: Dromara Products: MaxKey Problem Types: CWE-918 Description: A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component Meta URL Handler. The manipulation of the argument post leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be u
er-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313637 - https://vuldb.com/?ctiid.313637 - https://vuldb.com/?submit.593111 - https://github.com/honorseclab/vulns/blob/main/dromara_MaxKey/SSRF.md - https://github.com/honorseclab/vulns/blob/main/dromara_MaxKey/SSRF.md#vulnerability-verification
CVE ID: CVE-2025-6518 State: PUBLISHED Published: 2025-06-23T19:00:11.222Z Last Updated: 2025-06-23T19:25:40.707Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PySpur-Dev Products: pyspur Problem Types: CWE-1336, CWE-791 Description: A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/single_llm_call.py of the component Jinja2 Template Handler. The manipulation of the argument user_message leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been di
ion of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313638 - https://vuldb.com/?ctiid.313638 - https://vuldb.com/?submit.593612 - https://github.com/PySpur-Dev/pyspur/issues/289
CVE ID: CVE-2025-6519 State: PUBLISHED Published: 2025-09-02T11:23:59.838Z Last Updated: 2025-09-02T15:25:44.338Z Vendors: Copeland LP Products: E3 Supervisory Control Problem Types: CWE-522 Description: E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-6520 State: PUBLISHED Published: 2025-10-31T07:44:20.397Z Last Updated: 2025-10-31T17:27:27.106Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Abis Technology Products: BAPSIS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection.This issue affects BAPSIS: before 202510271606. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0365
CVE ID: CVE-2025-6521 State: PUBLISHED Published: 2025-06-27T17:06:55.087Z Last Updated: 2025-06-27T17:29:48.416Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: TrendMakers Products: Sight Bulb Pro Firmware ZJ_CG32-2201 Problem Types: CWE-327 Description: During the initial setup of the device the user connects to an access point broadcast by the Sight Bulb Pro. During the negotiation, AES Encryption keys are passed in cleartext. If captured, an attacker may be able to decrypt communications between the management app and the Sight Bulb Pro which may include sensitive information such as network credentials. Additional Analyst Notes: - CISA ADP Vulnrichment:
which may include sensitive information such as network credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-177-02 - https://www.trendmakerscares.com/Customer-Service-Hours
CVE ID: CVE-2025-6522 State: PUBLISHED Published: 2025-06-27T17:09:33.801Z Last Updated: 2025-06-27T18:33:29.421Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L) Vendors: TrendMakers Products: Sight Bulb Pro Firmware ZJ_CG32-2201 Problem Types: CWE-77 Description: Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/ic
ing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-177-02 - https://www.trendmakerscares.com/Customer-Service-Hours
CVE ID: CVE-2025-6523 State: PUBLISHED Published: 2025-07-22T17:00:10.697Z Last Updated: 2025-07-22T18:41:36.063Z Vendors: Devolutions Products: Server Problem Types: CWE-1391 Description: Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.3.0 * Devolutions Server 2025.1.11.0 and earlier Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0012/
CVE ID: CVE-2025-6524 State: PUBLISHED Published: 2025-06-23T21:00:12.541Z Last Updated: 2025-06-24T17:14:18.940Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: 70mai Products: 1S Problem Types: CWE-287 Description: A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video Services. The manipulation leads to improper authentication. Access to the local network is required for this attack to succeed. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contact