Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-62168 State: PUBLISHED Published: 2025-10-17T16:21:30.156Z Last Updated: 2025-11-05T17:04:22.477Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: squid-cache Products: squid Problem Types: CWE-209, CWE-550 Description: Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application
This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-c8cc-phh7-xmxr - https://github.com/squid-cache/squid/commit/0951a0681011dfca3d78c84fd7f1e19c78a4443f
CVE ID: CVE-2025-62169 State: PUBLISHED Published: 2025-10-23T16:09:19.945Z Last Updated: 2025-10-23T16:41:54.757Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WildRikku Products: OctoPrint-SpoolManager Problem Types: CWE-287 Description: OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks. This issue has been patched in versions 1.8.0a3 of the testing branch and 1.7.8 of the stable branch. The impact of this vulner
sue has been patched in versions 1.8.0a3 of the testing branch and 1.7.8 of the stable branch. The impact of this vulnerability is greatly reduced when using OctoPrint version 1.11.2 and newer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WildRikku/OctoPrint-SpoolManager/security/advisories/GHSA-2rrc-f24f-94f6 - https://github.com/WildRikku/OctoPrint-SpoolManager/commit/b725e113316e177ce81238a2dbbbdb63d92c40b0 - https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.7.8 - https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.8.0a3
CVE ID: CVE-2025-62170 State: PUBLISHED Published: 2025-10-13T17:45:21.365Z Last Updated: 2025-10-27T16:11:53.120Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: rathena Products: rathena Problem Types: CWE-416 Description: rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to cause a denial of service by crashing the map-server. This issue has been patched in commit af2f3ba. There are no known workarounds aside from manually applying the
-server. This issue has been patched in commit af2f3ba. There are no known workarounds aside from manually applying the patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rathena/rathena/security/advisories/GHSA-9mj9-8vgv-r92j - https://github.com/rathena/rathena/commit/af2f3ba33fc03dc6dd510f8cfe84cd9185af748d
CVE ID: CVE-2025-62171 State: PUBLISHED Published: 2025-10-17T16:30:27.144Z Last Updated: 2025-11-03T17:45:24.673Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-190 Description: ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with sp
e by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vul
, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9pp9-cfwx-54rm - https://github.com/ImageMagick/ImageMagick/commit/cea1693e2ded51b4cc91c70c54096cbed1691c00
CVE ID: CVE-2025-62172 State: PUBLISHED Published: 2025-10-14T15:14:09.946Z Last Updated: 2025-10-21T20:39:28.185Z Vendors: home-assistant Products: core Problem Types: CWE-80, CWE-79 Description: Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject malicious JavaScript code into an energy entity's name field, which is then executed when any user hovers over data points in the energy dashboard graph tooltips. The vulnerability exists because entity names containing HTML are not properly sanitized before being
d graph tooltips. The vulnerability exists because entity names containing HTML are not properly sanitized before being rendered in graph tooltips. This could allow an attacker with authentication to execute arbitrary JavaScript in the context of other users' sessions. Additionally, if an energy provider (such as Tibber) supplies a malicious default name for an entity, the vulnerability can be exploited without direct user action when the default name is used. This issue has been patched in version 2025.10.2. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m
CVE ID: CVE-2025-62174 State: PUBLISHED Published: 2025-10-13T20:54:36.040Z Last Updated: 2025-10-14T14:00:54.691Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: mastodon Products: mastodon Problem Types: CWE-613 Description: Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using `bin/tootctl accounts modify --reset-password`, active sessions and access tokens for that account are not revoked. This allows an attacker with access to a previously compromised session or token to continue using the account a
evoked. This allows an attacker with access to a previously compromised session or token to continue using the account after the password has been reset. This issue has been patched in versions 4.2.27, 4.3.14, and 4.4.6. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-f3q3-rmf7-9655 - https://github.com/mastodon/mastodon/commit/1631fb80e8029d2c5425a03a2297b93f7e225217
CVE ID: CVE-2025-62175 State: PUBLISHED Published: 2025-10-13T20:59:31.260Z Last Updated: 2025-10-14T13:58:02.806Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: mastodon Products: mastodon Problem Types: CWE-273, CWE-274 Description: Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. This allows disabled or suspended accounts to continue receiving real-time updates through existing streaming connections and to establish new streaming connections, even though they cannot interact with other API
isting streaming connections and to establish new streaming connections, even though they cannot interact with other API endpoints. This undermines moderation actions, as administrators expect disabled or suspended accounts to be fully disconnected from the service. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-r2fh-jr9c-9pxh - https://github.com/mastodon/mastodon/commit/2971ac9863b91372e68ac152caf6f4dbff511d17
CVE ID: CVE-2025-62176 State: PUBLISHED Published: 2025-10-13T21:04:53.206Z Last Updated: 2025-10-14T13:53:19.170Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: mastodon Products: mastodon Problem Types: CWE-280 Description: Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allows OAuth clients without the read scope to subscribe to public channels and receive public timeline events. The impact is limited, as this only
t the read scope to subscribe to public channels and receive public timeline events. The impact is limited, as this only affects new public posts published on the public timelines and requires an otherwise valid token, but this may lead to unexpected access to public posts in a limited-federation setting. This issue has been patched in versions 4.4.6, 4.3.14, and 4.2.27. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-7gwh-mw97-qjgp - https://github.com/mastodon/mastodon/commit/7e98fa9b476fdaed235519f1d527eb956004ba0c
CVE ID: CVE-2025-62177 State: PUBLISHED Published: 2025-10-13T21:09:29.683Z Last Updated: 2025-10-14T13:33:32.920Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_listar.php endpoint, specifically in the id_funcionario parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References
ity of the database. This vulnerability is fixed in 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-4wrg-g9cj-hjcx - https://github.com/LabRedesCefetRJ/WeGIA/commit/017fdd71380ab898570752aebc3fe1ef318a5d0d
CVE ID: CVE-2025-62178 State: PUBLISHED Published: 2025-10-13T21:12:16.926Z Last Updated: 2025-10-14T15:11:27.699Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the idatendido parameter. This vulnerability is fixed in 3.5.1. Additional Analyst Notes:
o inject malicious scripts in the idatendido parameter. This vulnerability is fixed in 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fj32-779r-28qv - https://github.com/LabRedesCefetRJ/WeGIA/issues/1181 - https://github.com/LabRedesCefetRJ/WeGIA/commit/e39390f2c0172e8a127b9437e15e71ac4a0e77cf
CVE ID: CVE-2025-62179 State: PUBLISHED Published: 2025-10-13T21:13:59.524Z Last Updated: 2025-10-14T15:12:45.289Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint, specifically in the cpf parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: R
availability of the database. This vulnerability is fixed in 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x36x-x5j4-wfjf - https://github.com/LabRedesCefetRJ/WeGIA/commit/885972c55c3a06b5275120e88bb1113754a63b26
CVE ID: CVE-2025-62185 State: PUBLISHED Published: 2025-10-07T00:00:00.000Z Last Updated: 2025-10-08T14:59:13.616Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Ankitects Products: Anki Problem Types: CWE-427 Description: In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ankitects/anki/commit/5080451829505842b16d4a50f398ad44560a3e48 - https://github.com/ankitects/anki/commit/621
github.com/ankitects/anki/commit/5080451829505842b16d4a50f398ad44560a3e48 - https://github.com/ankitects/anki/commit/6213c9b6f99ebda181004f8915b92fe3618b939 - https://github.com/ankitects/anki/compare/25.02.4...25.02.5
CVE ID: CVE-2025-62186 State: PUBLISHED Published: 2025-10-07T00:00:00.000Z Last Updated: 2025-10-08T13:27:47.374Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Ankitects Products: Anki Problem Types: CWE-829 Description: Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ankitects/anki/releases/tag/25.02.5
CVE ID: CVE-2025-62187 State: PUBLISHED Published: 2025-10-07T00:00:00.000Z Last Updated: 2025-10-08T13:24:39.026Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Ankitects Products: Anki Problem Types: CWE-23 Description: In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ankitects/anki/releases/tag/25.02.6 - https://github.com/ankitects/anki/pull/4041 - https://github.com/ankitects/anki/pull/4041/commits/51476e05b2817
5.02.6 - https://github.com/ankitects/anki/pull/4041 - https://github.com/ankitects/anki/pull/4041/commits/51476e05b281737a0c2924342bccdb6e5be52ea9
CVE ID: CVE-2025-62189 State: PUBLISHED Published: 2025-11-21T06:17:56.472Z Last Updated: 2025-11-21T14:58:09.579Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: LogStare Inc. Products: LogStare Collector (for Windows), LogStare Collector (for Linux) Problem Types: CWE-863 Description: LogStare Collector contains an incorrect authorization vulnerability in UserRegistration. If exploited, a non-administrative user may create a new user account by sending a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.logstare.com/vulnerability/2025-001/ - https://jvn.jp/en/jp/JVN77560819/
CVE ID: CVE-2025-62199 State: PUBLISHED Published: 2025-11-11T17:59:27.802Z Last Updated: 2025-11-21T19:06:49.083Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2016, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office for Android, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024 Problem Types: CWE-416 Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guid
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62199
CVE ID: CVE-2025-62200 State: PUBLISHED Published: 2025-11-11T17:59:41.808Z Last Updated: 2025-11-21T19:07:04.451Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Excel 2016 Problem Types: CWE-822 Description: Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62200
CVE ID: CVE-2025-62201 State: PUBLISHED Published: 2025-11-11T17:59:42.387Z Last Updated: 2025-11-21T19:07:04.984Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016 Problem Types: CWE-122 Description: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/upda
o execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62201
CVE ID: CVE-2025-62202 State: PUBLISHED Published: 2025-11-11T17:59:42.941Z Last Updated: 2025-11-21T19:07:05.523Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016 Problem Types: CWE-125 Description: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/upda
se information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62202
CVE ID: CVE-2025-62203 State: PUBLISHED Published: 2025-11-11T17:59:43.546Z Last Updated: 2025-11-21T19:07:06.050Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016 Problem Types: CWE-416 Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vul
de locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62203
CVE ID: CVE-2025-62204 State: PUBLISHED Published: 2025-11-11T17:59:44.205Z Last Updated: 2025-11-21T19:07:06.496Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition Problem Types: CWE-502 Description: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62204
CVE ID: CVE-2025-62205 State: PUBLISHED Published: 2025-11-11T17:59:44.771Z Last Updated: 2025-11-21T19:07:07.087Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024 Problem Types: CWE-416 Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62205
CVE ID: CVE-2025-62206 State: PUBLISHED Published: 2025-11-11T17:59:28.307Z Last Updated: 2025-11-21T19:06:49.626Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Dynamics 365 (on-premises) version 9.1 Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62206
CVE ID: CVE-2025-62207 State: PUBLISHED Published: 2025-11-20T22:18:38.189Z Last Updated: 2025-11-22T04:55:16.633Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Monitor Control Service Problem Types: CWE-918 Description: Azure Monitor Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62207
CVE ID: CVE-2025-62208 State: PUBLISHED Published: 2025-11-11T17:59:45.339Z Last Updated: 2025-11-21T19:07:07.635Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607