Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r7r6-cc7p-4v5m - https://github.com/python-ldap/python-ldap/commit/3957526fb1852e84b90f423d9fef34c7af25b85a - https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.5
CVE ID: CVE-2025-61912 State: PUBLISHED Published: 2025-10-10T22:04:25.028Z Last Updated: 2025-10-14T14:58:06.682Z Vendors: python-ldap Products: python-ldap Problem Types: CWE-116, CWE-170 Description: python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patc
quest is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python-ldap/python-ldap/security/advisories/GHSA-p34h-wq7j-h5v6 - https://github.com/python-ldap/python-ldap/commit/6ea80326a34ee6093219628d7690bced50c49a3f - https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.5
CVE ID: CVE-2025-61913 State: PUBLISHED Published: 2025-10-08T22:43:24.076Z Last Updated: 2025-10-14T14:18:13.859Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-22 Description: Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability. Additional Analyst Notes: -
m, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jv9m-vf54-chjj - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-j44m-5v8f-gc9c - https://github.com/FlowiseAI/Flowise/commit/1fb12cd93143592a18995f63b781d25b354d48a3 - https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.8
CVE ID: CVE-2025-61919 State: PUBLISHED Published: 2025-10-10T19:22:42.454Z Last Updated: 2025-10-10T20:48:20.240Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: rack Products: rack Problem Types: CWE-400 Description: Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrad
ly into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using `query_parser.bytesize_limit`, preventing unbounded reads of `application/x-www-form-urlencoded` bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx `client_max_body_size`, Apache `LimitRequestBody`). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm - https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881 - https://github.com/ra
SA-6xw4-3v39-52mm - https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881 - https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db - https://github.com/rack/rack/commit/e179614c4a653283286f5f046428cbb85f21146f
CVE ID: CVE-2025-61920 State: PUBLISHED Published: 2025-10-10T19:25:07.679Z Last Updated: 2025-11-03T17:45:23.708Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: authlib Products: authlib Problem Types: CWE-20, CWE-400, CWE-770 Description: Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile
fication, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service. Version 1.6.5 patches the issue. Some temporary workarounds are available. Enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9 - https://github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5e
CVE ID: CVE-2025-61921 State: PUBLISHED Published: 2025-10-10T19:28:10.688Z Last Updated: 2025-10-10T20:54:47.627Z Vendors: sinatra Products: sinatra Problem Types: CWE-1333 Description: Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in genera
ted amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sinatra/sinatra/security/advisories/GHSA-mr3q-g2mv-mr4q - https://github.com/sinatra/sinatra/issues/2120 - https://github.com/sinatra/sinatra/pull/1823 - https://github.com/sinatra/sinatra/pull/2121 - https://bugs.ruby-lang.org/issues/19104
CVE ID: CVE-2025-61922 State: PUBLISHED Published: 2025-10-16T17:26:14.999Z Last Updated: 2025-10-17T14:00:38.840Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: PrestaShopCorp Products: ps_checkout Problem Types: CWE-287 Description: PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.
and 5.0.5. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-54hq-mf6h-48xh
CVE ID: CVE-2025-61923 State: PUBLISHED Published: 2025-10-16T17:31:07.064Z Last Updated: 2025-10-16T19:23:05.488Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: PrestaShopCorp Products: ps_checkout Problem Types: CWE-22 Description: PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShopCorp/ps_check
ounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-fpxp-pfqm-x54w
CVE ID: CVE-2025-61924 State: PUBLISHED Published: 2025-10-16T17:33:49.254Z Last Updated: 2025-10-16T19:22:58.718Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: PrestaShopCorp Products: ps_checkout Problem Types: CWE-184 Description: PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShopCorp/ps_checkout/sec
xist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-wvpg-4wrh-5889
CVE ID: CVE-2025-61925 State: PUBLISHED Published: 2025-10-10T19:34:05.142Z Last Updated: 2025-10-10T20:01:06.836Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: withastro Products: astro Problem Types: CWE-470 Description: Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It is common for web servers such as nginx to route requests via the `Host` header, and forward on other request headers. As such as malicious request can be sent with both a `Host` header and an `X-Forwarded-Host` header where the values do not match and the `X-Forwarded-Host` header
h both a `Host` header and an `X-Forwarded-Host` header where the values do not match and the `X-Forwarded-Host` header is malicious. Astro will then return the malicious value. This could result in any usages of the `Astro.url` value in code being manipulated by a request. For example if a user follows guidance and uses `Astro.url` for a canonical link the canonical link can be manipulated to another site. It is theoretically possible that the value could also be used as a login/registration or other form URL as well, resulting in potential redirecting of login credentials to a malicious party. As this is a per-request attack vector the surface area would only be to the malicious user until
to a malicious party. As this is a per-request attack vector the surface area would only be to the malicious user until one considers that having a caching proxy is a common setup, in which case any page which is cached could persist the malicious value for subsequent users. Many other frameworks have an allowlist of domains to validate against, or do not have a case where the headers are reflected to avoid such issues. This could affect anyone using Astro in an on-demand/dynamic rendering mode behind a caching proxy. Version 5.14.2 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/withastro/astro/security/advisories/GHSA-5ff5-
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88 - https://github.com/Chisnet/minimal_dynamic_astro_server
CVE ID: CVE-2025-61926 State: PUBLISHED Published: 2025-10-09T21:20:32.670Z Last Updated: 2025-10-16T18:13:02.504Z Vendors: ossf Products: allstar Problem Types: CWE-453, CWE-798 Description: Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component
eviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. All Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. Those who have not enabled or exposed the Reviewbot endpoint are not exposed to this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ossf/allstar/security/advisories/GHSA-33f4-mjch-7fpr - https://github.com/ossf/allstar/pull/713 - https://github.com/ossf/allstar/commit/e004ecb540d63ca6f5b1689b41af6c0040a82c73 - https://github.com/ossf/alls
ull/713 - https://github.com/ossf/allstar/commit/e004ecb540d63ca6f5b1689b41af6c0040a82c73 - https://github.com/ossf/allstar/blob/294ae985cc2facd0918e8d820e4196021aa0b914/pkg/reviewbot/reviewbot.go#L59
CVE ID: CVE-2025-61927 State: PUBLISHED Published: 2025-10-10T19:38:19.835Z Last Updated: 2025-10-10T19:59:09.406Z Vendors: capricorn86 Products: happy-dom Problem Types: CWE-94 Description: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality. It seems like what the attacker can get control over depends on if the proc
d get access to process level functionality. It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the `require()` function to import modules. Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment. Version 20.0.0 patches the issue by changing JavaScript evaluation to be disabled by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f - https://github.co
ment: References: - https://github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f - https://github.com/capricorn86/happy-dom/commit/819d15ba289495439eda8be360d92a614ce22405
CVE ID: CVE-2025-61928 State: PUBLISHED Published: 2025-10-09T21:24:37.541Z Last Updated: 2025-10-10T14:23:23.158Z Vendors: better-auth Products: better-auth Problem Types: CWE-285, CWE-306 Description: Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the `api/auth/api-key/create` route. `session?.user ?? (authRequired ? null : { id: ctx.body.userId })`. When no session exists but `userId` is present in the request body, `authRequired` becomes false and the user object is set to the attacker-controlled ID. Server-only fie
the request body, `authRequired` becomes false and the user object is set to the attacker-controlled ID. Server-only field validation only executes when `authRequired` is true (lines 280-295), allowing attackers to set privileged fields. No additional authentication occurs before the database operation, so the malicious payload is accepted. The same pattern exists in the update endpoint. This is a critical authentication bypass enabling full an unauthenticated attacker can generate an API key for any user and immediately gain complete authenticated access. This allows the attacker to perform any action as the victim user using the api key, potentially compromise the user data and the applica
ttacker to perform any action as the victim user using the api key, potentially compromise the user data and the application depending on the victim's privileges. Version 1.3.26 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/better-auth/better-auth/security/advisories/GHSA-99h5-pjcv-gr6v - https://github.com/better-auth/better-auth/commit/556085067609c508f8c546ceef9003ee8c607d39
CVE ID: CVE-2025-61929 State: PUBLISHED Published: 2025-10-10T19:50:14.036Z Last Updated: 2025-10-10T20:46:08.118Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: CherryHQ Products: cherry-studio Problem Types: CWE-94 Description: Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called `cherrystudio://`. When handling the MCP installation URL, it parses the base64-encoded configuration data and directly executes the command within it. In the files `src/main/services/ProtocolClient.ts` and `src/main/services/urlschema/mcp-install.ts`, when receiving a URL of the `cherrystudio://mcp` type,
ocolClient.ts` and `src/main/services/urlschema/mcp-install.ts`, when receiving a URL of the `cherrystudio://mcp` type, the `handleMcpProtocolUrl` function is called for processing. If an attacker crafts malicious content and posts it on a website or elsewhere (there are many exploitation methods, such as creating a malicious website with a button containing this malicious content), when the user clicks it, since the pop-up window contains normal content, the direct click is considered a scene action, and the malicious command is directly triggered, leading to the user being compromised. As of time of publication, no known patched versions exist. Additional Analyst Notes: - CISA ADP Vulnrich
g compromised. As of time of publication, no known patched versions exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-hh6w-rmjc-26f6
CVE ID: CVE-2025-61930 State: PUBLISHED Published: 2025-10-10T20:01:42.182Z Last Updated: 2025-10-10T20:44:48.803Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: emlog Products: emlog Problem Types: CWE-352 Description: Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist. Additional Analyst
over of privileged users. Severity: High. As of time of publication, no known patched versions exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-m2qw-9wjx-qxm2
CVE ID: CVE-2025-61931 State: PUBLISHED Published: 2025-10-24T05:17:30.940Z Last Updated: 2025-10-24T12:31:22.740Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Implem Inc. Products: Pleasanter Problem Types: CWE-79 Description: Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pleasanter.org/archives/vulnerability-update-20251024 - https://jvn.jp/en/jp/JVN20611740/
CVE ID: CVE-2025-61932 State: PUBLISHED Published: 2025-10-20T07:25:39.916Z Last Updated: 2025-10-22T22:20:23.471Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MOTEX Inc. Products: Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) Problem Types: CWE-940 Description: Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.motex.co.jp/news/notice/2025/release251020/ - https://j
nalyst Notes: - CISA ADP Vulnrichment: References: - https://www.motex.co.jp/news/notice/2025/release251020/ - https://jvn.jp/en/jp/JVN86318557/
CVE ID: CVE-2025-61933 State: PUBLISHED Published: 2025-10-15T15:19:49.359Z Last Updated: 2025-10-16T03:56:39.867Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156596
CVE ID: CVE-2025-61934 State: PUBLISHED Published: 2025-10-23T22:01:28.290Z Last Updated: 2025-10-24T14:31:43.765Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: AutomationDirect Products: Productivity Suite, Productivity 3000 P3-622 CPU, Productivity 3000 P3-550E CPU, Productivity 3000 P3-530 CPU, Productivity 2000 P2-622 CPU, Productivity 2000 P2-550 CPU, Productivity 1000 P1-550 CPU, Productivity 1000 P1-540 CPU Problem Types: CWE-1327 Description: A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the Producti
te software version v4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and read, write, or delete arbitrary files and folders on the target machine Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01 - https://www.automationdirect.com/support/software-downloads - https://support.automationdirect.com/docs/securityconsiderations.pdf - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json
CVE ID: CVE-2025-61935 State: PUBLISHED Published: 2025-10-15T15:19:46.027Z Last Updated: 2025-10-16T03:56:43.638Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-252 Description: When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000154664
CVE ID: CVE-2025-61938 State: PUBLISHED Published: 2025-10-15T13:55:47.664Z Last Updated: 2025-10-16T03:56:55.081Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-1284 Description: When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repeatedly. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s