Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
management/tags/2.3.3/include/admin/class-WP_MCM_Render_Settings.php - https://plugins.trac.wordpress.org/browser/wp-media-category-management/trunk/include/class-WP_MCM_Options.php - https://wordpress.org/plugins/wp-media-category-management/#developers - https://plugins.trac.wordpress.org/changeset/3242626/wp-media-category-management/trunk/include/admin/class-WP_MCM_Settings.php
CVE ID: CVE-2025-0866 State: PUBLISHED Published: 2025-02-20T09:21:38.136Z Last Updated: 2025-02-20T15:37:03.194Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: torviswesley Products: Legoeso PDF Manager Problem Types: CWE-89 Description: The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existin
e for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5e640767-7998-4404-a894-0b1794464c66?source=cve - https://plugins.trac.wordpress.org/browser/legoeso-pdf-manager/trunk/inc/admin/class-pdf-doc-list-table.php#L543 - https://wordpress.org/plugins/legoeso-pdf-manager/#developers - https://plugins.trac.wordpress.org/browser/legoeso-pdf-manager/trunk/inc/admin/class-pdf-doc-list-table.php#L567
CVE ID: CVE-2025-0867 State: PUBLISHED Published: 2025-02-14T12:37:09.250Z Last Updated: 2025-02-21T14:16:05.951Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SICK AG Products: SICK MEAC300 Problem Types: CWE-522 Description: The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command with administrative privileges. This allows a privilege escalation to the administrative level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com
scalation to the administrative level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0001.pdf - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0001.json
CVE ID: CVE-2025-0868 State: PUBLISHED Published: 2025-02-20T11:26:11.784Z Last Updated: 2025-10-03T08:56:10.028Z Vendors: Arc53 Products: DocsGPT Problem Types: CWE-95 Description: A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.. This issue affects DocsGPT: from 0.8.1 through 0.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/02/CVE-2025-0868/ - https://cert.pl/posts/2025/02/CVE-2025-0868/ - https://github.com/arc53/DocsGPT
CVE ID: CVE-2025-0869 State: PUBLISHED Published: 2025-01-30T13:00:12.408Z Last Updated: 2025-02-07T16:21:17.637Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Cianet Products: ONU GW24AC Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Cianet ONU GW24AC up to 20250127. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Login. The manipulation of the argument browserLang leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294055 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294055 - https://vuldb.com/?ctiid.294055 - https://vuldb.com/?submit.489867
CVE ID: CVE-2025-0870 State: PUBLISHED Published: 2025-01-30T13:00:20.408Z Last Updated: 2025-01-30T14:56:00.294Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Axiomatic Products: Bento4 Problem Types: CWE-122, CWE-119 Description: A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in the library Ap4DataBuffer.h. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Thi
ather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294056 - https://vuldb.com/?ctiid.294056 - https://github.com/axiomatic-systems/Bento4/issues/980 - https://github.com/user-attachments/files/16929290/Bug2.zip
CVE ID: CVE-2025-0871 State: PUBLISHED Published: 2025-01-30T14:31:15.315Z Last Updated: 2025-02-12T19:51:12.711Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Maybecms Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Maybecms 1.2. This affects an unknown part of the file /mb/admin/index.php?u=article-edit of the component Add Article. The manipulation of the argument data_info[content] leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294057 - https://vuldb.com/?ctiid.294057 - https://vuldb.com/?submit.487930 - https://github.com/Upgradeextension/Maybecms/blob/main/README.md
CVE ID: CVE-2025-0872 State: PUBLISHED Published: 2025-01-30T16:00:18.075Z Last Updated: 2025-01-30T16:18:05.556Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /addpayment.php. The manipulation of the argument id/amount/desc/inccat leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294066 - https://vuldb.com/?ctiid.294066 - https://vuldb.com/?submit.487953 - https://github.com/magic2353112890/cve/issues/3 - https://itsourcecode.com/
CVE ID: CVE-2025-0873 State: PUBLISHED Published: 2025-01-30T17:00:08.553Z Last Updated: 2025-02-12T19:51:11.657Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /customeredit.php. The manipulation of the argument id/address/fullname/phonenumber/email/city/comment leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294067 - https://vuldb.com/?ctiid.294067 - https://vuldb.com/?submit.487984 - https://github.com/magic2353112890/cve/issues/5 - https://itsourcecode.com/
CVE ID: CVE-2025-0874 State: PUBLISHED Published: 2025-01-30T18:00:11.900Z Last Updated: 2025-02-12T19:51:11.030Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Simple Plugins Car Rental Management Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Simple Plugins Car Rental Management 1.0. Affected by this issue is some unknown functionality of the file /admin/approve.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294068 - https://vuldb.com/?ctiid.294068 - https://vuldb.com/?submit.488538 - https://github.com/magic2353112890/cve/issues/8 - https://code-projects.org/
CVE ID: CVE-2025-0875 State: PUBLISHED Published: 2025-09-22T08:02:09.660Z Last Updated: 2025-09-22T15:49:07.219Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: PROLIZ Computer Software Hardware Service Trade Ltd. Co. Products: OBS (Student Affairs Information System) Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Parameter Injection.This issue affects OBS (Student Affairs Information System): before v26.0328. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bi
on System): before v26.0328. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0282
CVE ID: CVE-2025-0876 State: PUBLISHED Published: 2025-10-03T11:25:23.950Z Last Updated: 2025-10-03T13:52:50.337Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Isin Basi Advertisement Information Technologies Trade Inc. Products: IT's Workif Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies Trade Inc. IT's Workif allows Cross-Site Scripting (XSS).This issue affects IT's Workif: through 20251003. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0312
CVE ID: CVE-2025-0877 State: PUBLISHED Published: 2025-03-06T13:09:06.285Z Last Updated: 2025-03-06T15:50:52.224Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: AtaksAPP Products: Reservation Management System Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AtaksAPP Reservation Management System allows Cross-Site Scripting (XSS).This issue affects Reservation Management System: before 4.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0059
CVE ID: CVE-2025-0878 State: PUBLISHED Published: 2025-09-03T13:16:51.212Z Last Updated: 2025-09-03T15:43:07.642Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Akinsoft Products: LimonDesk Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XSS).This issue affects LimonDesk: from s1.02.14 before v1.02.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0206
CVE ID: CVE-2025-0879 State: PUBLISHED Published: 2025-09-17T12:32:42.925Z Last Updated: 2025-09-17T13:19:18.681Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Shopside Software Products: Shopside App Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shopside Software Shopside App allows Cross-Site Scripting (XSS). This issue requires high privileges.This issue affects Shopside App: before 17.02.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0270
CVE ID: CVE-2025-0880 State: PUBLISHED Published: 2025-01-30T20:31:08.278Z Last Updated: 2025-01-30T21:21:39.243Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/updateplan.php. The manipulation of the argument planid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294125 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294125 - https://vuldb.com/?ctiid.294125 - https://vuldb.com/?submit.488716 - https://www.yuque.com/u21735104/brookes/za83ilxr9g2fkv8b
CVE ID: CVE-2025-0881 State: PUBLISHED Published: 2025-01-30T20:31:11.269Z Last Updated: 2025-01-30T21:21:00.332Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/saveroutine.php. The manipulation of the argument rname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2941
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294126 - https://vuldb.com/?ctiid.294126 - https://vuldb.com/?submit.489192 - https://github.com/wizdzz/CVE/issues/1
CVE ID: CVE-2025-0882 State: PUBLISHED Published: 2025-01-30T21:00:17.251Z Last Updated: 2025-01-30T21:17:27.265Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Chat System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Chat System up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user/addnewmember.php. The manipulation of the argument user leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294127 - https://vuldb.com/?ctiid.294127 - https://vuldb.com/?submit.491463 - https://github.com/LamentXU123/cve/blob/main/sql_injection3.md - https://code-projects.org/
CVE ID: CVE-2025-0883 State: PUBLISHED Published: 2025-03-12T15:24:50.309Z Last Updated: 2025-05-12T15:35:58.132Z Vendors: OpenText™ Products: Service Manager Problem Types: CWE-81 Description: Improper Neutralization of Script in an Error Message Web Page vulnerability in OpenText™ Service Manager. The vulnerability could reveal sensitive information retained by the browser. This issue affects Service Manager: 9.70, 9.71, 9.72, 9.80. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000037099?language=en_US
CVE ID: CVE-2025-0884 State: PUBLISHED Published: 2025-03-12T15:24:31.859Z Last Updated: 2025-05-12T15:36:18.682Z Vendors: OpenText™ Products: Service Manager Problem Types: CWE-428 Description: Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. The vulnerability could allow a user to gain SYSTEM privileges through Privilege Escalation. This issue affects Service Manager: 9.70, 9.71, 9.72. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000036731?language=en_US
CVE ID: CVE-2025-0885 State: PUBLISHED Published: 2025-07-03T09:54:20.856Z Last Updated: 2025-07-03T13:17:25.834Z Vendors: OpenText™ Products: GroupWise Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow unauthorized access to calendar items marked private. This issue affects GroupWise versions 7 through 17.5, 23.4, 24.1, 24.2, 24.3, 24.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000041560?language=en_US
CVE ID: CVE-2025-0886 State: PUBLISHED Published: 2025-07-17T19:16:16.273Z Last Updated: 2025-07-17T20:09:10.929Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Elliptic Virtual Lock Sensor Service For ThinkPad P1 Gen 6 (Type 21FV, 21FW), Elliptic Human Presence Detection Driver for ThinkPad P1 Gen 7 (Type 21KV, 21KW), Elliptic Virtual Lock Sensor Service for P14s Gen 4 (Type 21HF, 21HG), Elliptic Human Presence Detection Device Driver for ThinkPad P14s Gen 4 (Type 21K5, 21K6), Elliptic Human Presence Detection Driver for ThinkPad P14s Gen 5 (Type 21G2, 21G3), Elliptic Human Presence Detection Device Driver for ThinkPad P14s Gen 5 (Type 21ME,
inkPad P14s Gen 5 (Type 21G2, 21G3), Elliptic Human Presence Detection Device Driver for ThinkPad P14s Gen 5 (Type 21ME, 21MF), Elliptic Human Presence detection Device Driver for ThinkPad P16 Gen 2 (Type 21FA, 21FB), Elliptic Virtual Lock Sensor Service for P16s Gen 2 (Type 21HK, 21HL), Elliptic Human Presence Detection Device Driver for ThinkPad P16s Gen 2 (Type 21K9, 21KA), lliptic Human Presence Detection Driver for P16s Gen 3 (Type 21KS, 21KT), Elliptic Human Presence Detection Device Driver for ThinkPad P16v Gen 1 (Type 21FC, 21FD), Elliptic Human Presence Detection Driver for ThinkPad P16v Gen 1 (Type 21FE, 21FF), Elliptic Human Presence Detection Device Driver for ThinkPad P16v Gen 2
river for ThinkPad P16v Gen 1 (Type 21FE, 21FF), Elliptic Human Presence Detection Device Driver for ThinkPad P16v Gen 2 (Type 21KX, 21KY), Elliptic Virtual Lock Sensor Service for ThinkPad T14 Gen 3 (Type 21AH, 21AJ), Elliptic Virtual Lock Sensor Service for ThinkPad T14 Gen 3 (Type 21CF, 21CG)), Elliptic Virtual Lock Sensor Service for T14 Gen 4 (Type 21HD, 21HE), Elliptic Human Presence Detection Device Driver for T14 Gen 4 (Type 21K3, 21K4), lliptic Human Presence Detection Device Driver for T14 Gen 5 (Type 21MC, 21MD), Elliptic Human Presence Detection Device Driver for T14 Gen 5 (Type 21ML, 21MM), Elliptic Virtual Lock Sensor Service for T14s Gen 4 (Type 21F6, 21F7), Elliptic Human Pre
r T14 Gen 5 (Type 21ML, 21MM), Elliptic Virtual Lock Sensor Service for T14s Gen 4 (Type 21F6, 21F7), Elliptic Human Presence Detection Device Driver for ThinkPad T14s Gen 4 (Type 21F8, 21F9), Elliptic Human Presence Detection Device Driver for T14s Gen 5 (Type 21LS, 21LT), Elliptic Human Presence Detection driver for ThinkPad T14s Gen 6 (Type 21M1, 21M2), Elliptic Virtual Lock Sensor Service for T16 Gen 2 (Type 21HH, 21HJ), Elliptic Human Presence Detection Device Driver for T16 Gen 2 (Type 21K7 21K8), Elliptic Human Presence Detection Device Driver for T16 Gen 3 (Type 21MN, 21MQ), Elliptic Virtual Lock Sensor Service for X1 2-in-1 Gen 9 (Type 21KE, 21KF), Elliptic Virtual Lock Sensor Servi
N, 21MQ), Elliptic Virtual Lock Sensor Service for X1 2-in-1 Gen 9 (Type 21KE, 21KF), Elliptic Virtual Lock Sensor Service for ThinkPad X1 Carbon 12th Gen (Type 21KC, 21KD), Elliptic Human Presence Detection Device Driver for X13 2-in-1 Gen 5 (Type 21LW, 21LX), Elliptic Virtual Lock Sensor for ThinkPad X13 Gen 4 (Type 21EX, 21EY), Elliptic Human Presence Detection Driver for ThinkPad X13 Gen 4 (Type 21J3, 21J4), Elliptic Human Presence Detection Device Driver for X13 Gen 5 (Type 21LU, 21LV), Elliptic Virtual Lock Sensor for X13 Yoga Gen 4 (Type 21F2, 21F3) Problem Types: CWE-276 Description: An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could a
E-276 Description: An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-182738
CVE ID: CVE-2025-0889 State: PUBLISHED Published: 2025-02-26T01:41:25.407Z Last Updated: 2025-02-26T15:43:14.546Z Vendors: BeyondTrust Products: Privilege Management for Windows Problem Types: CWE-268 Description: Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.beyondtrust.com/trust-center/security-advisories/bt25-01
CVE ID: CVE-2025-0890 State: PUBLISHED Published: 2025-02-04T10:06:56.163Z Last Updated: 2025-02-12T20:51:26.709Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: VMG4325-B10A firmware Problem Types: CWE-287 Description: **UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/secur
to do so. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025
CVE ID: CVE-2025-0893 State: PUBLISHED Published: 2025-02-19T17:56:19.166Z Last Updated: 2025-02-27T18:30:27.067Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Symantec Products: Symantec Diagnostic Tool Description: Symantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25417
CVE ID: CVE-2025-0895 State: PUBLISHED Published: 2025-03-02T15:20:05.520Z Last Updated: 2025-09-01T01:09:34.068Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cognos Analytics Mobile Problem Types: CWE-215 Description: IBM Cognos Analytics Mobile 1.1 for Android could allow a user with physical access to the device, to obtain sensitive information from debugging code log messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184430