Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-27517 State: PUBLISHED Published: 2025-03-05T19:11:38.280Z Last Updated: 2025-03-05T19:26:13.059Z Vendors: livewire Products: volt Problem Types: CWE-20 Description: Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/livewire/volt/security/advisories/GHSA-v69f-5jxm-hwvv
CVE ID: CVE-2025-27518 State: PUBLISHED Published: 2025-03-07T15:36:48.366Z Last Updated: 2025-03-07T21:49:40.505Z Vendors: truefoundry Products: cognita Problem Types: CWE-79 Description: Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. An insecure CORS configuration in the Cognita backend server allows arbitrary websites to send cross site requests to the application. This vulnerability is fixed in commit 75079c3d3cf376381489b9a82ee46c69024e1a15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-193_GHSL-2024-194_Cognita/ - https://gith
ulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-193_GHSL-2024-194_Cognita/ - https://github.com/truefoundry/cognita/pull/424 - https://github.com/truefoundry/cognita/commit/75079c3d3cf376381489b9a82ee46c69024e1a15
CVE ID: CVE-2025-27519 State: PUBLISHED Published: 2025-03-07T15:36:34.819Z Last Updated: 2025-03-07T21:48:51.891Z Vendors: truefoundry Products: cognita Problem Types: CWE-22 Description: Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issue exists at /v1/internal/upload-to-local-directory which is enabled when the Local env variable is set to true, such as when Cognita is setup using Docker. Because the docker environment sets up the backend uvicorn server with auto reload enabled, when an attacker overwrites the /app/backend/__init__.py file, the file will automatically be reloaded a
reload enabled, when an attacker overwrites the /app/backend/__init__.py file, the file will automatically be reloaded and executed. This allows an attacker to get remote code execution in the context of the Docker container. This vulnerability is fixed in commit a78bd065e05a1b30a53a3386cc02e08c317d2243. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2024-193_GHSL-2024-194_Cognita/ - https://github.com/truefoundry/cognita/pull/393 - https://github.com/truefoundry/cognita/commit/a78bd065e05a1b30a53a3386cc02e08c317d2243
CVE ID: CVE-2025-27520 State: PUBLISHED Published: 2025-04-04T14:28:51.574Z Last Updated: 2025-04-04T14:51:45.561Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: bentoml Products: BentoML Problem Types: CWE-502 Description: BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3. Additional Analyst Notes: - CI
rver. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bentoml/BentoML/security/advisories/GHSA-33xw-247w-6hmc - https://github.com/bentoml/BentoML/commit/b35f4f4fcc53a8c3fe8ed9c18a013fe0a728e194
CVE ID: CVE-2025-27521 State: PUBLISHED Published: 2025-03-04T07:13:32.851Z Last Updated: 2025-09-18T06:40:47.390Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-280 Description: Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/3/
CVE ID: CVE-2025-27522 State: PUBLISHED Published: 2025-05-28T08:06:04.191Z Last Updated: 2025-05-28T13:59:51.264Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11732 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/s4dnmq3gwcjocxf85qk190knlzd26jby - https://github.com/apache/in
nrichment: References: - https://lists.apache.org/thread/s4dnmq3gwcjocxf85qk190knlzd26jby - https://github.com/apache/inlong/pull/11732
CVE ID: CVE-2025-27523 State: PUBLISHED Published: 2025-05-15T06:22:09.764Z Last Updated: 2025-05-15T15:53:51.556Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H) Vendors: Hitachi Products: JP1/IT Desktop Management 2 - Smart Device Manager Problem Types: CWE-611 Description: XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-115/index.html
CVE ID: CVE-2025-27524 State: PUBLISHED Published: 2025-05-15T06:27:32.686Z Last Updated: 2025-05-15T14:09:59.450Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hitachi Products: JP1/IT Desktop Management 2 - Smart Device Manager Problem Types: CWE-326 Description: Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software
10-50-06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-115/index.html
CVE ID: CVE-2025-27525 State: PUBLISHED Published: 2025-05-15T06:45:58.849Z Last Updated: 2025-05-15T14:06:02.849Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:L) Vendors: Hitachi Products: JP1/IT Desktop Management 2 - Smart Device Manager Problem Types: CWE-525 Description: Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/softwa
gh 10-50-06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-115/index.html
CVE ID: CVE-2025-27526 State: PUBLISHED Published: 2025-05-28T08:07:35.440Z Last Updated: 2025-05-28T14:00:41.948Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncdoe and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/4t4sqscm7xdqn883dy
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/4t4sqscm7xdqn883dyjy40qk6ncf26xf - https://github.com/apache/inlong/pull/11747
CVE ID: CVE-2025-27528 State: PUBLISHED Published: 2025-05-28T08:12:27.609Z Last Updated: 2025-05-28T13:20:49.864Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.ap
ng/pull/11747 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj - https://github.com/apache/inlong/pull/11747
CVE ID: CVE-2025-27531 State: PUBLISHED Published: 2025-06-06T14:55:28.516Z Last Updated: 2025-06-10T15:30:50.280Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5
CVE ID: CVE-2025-27532 State: PUBLISHED Published: 2025-04-30T11:49:02.687Z Last Updated: 2025-04-30T14:08:31.240Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Bosch Rexroth AG Products: ctrlX OS - Device Admin Problem Types: CWE-312 Description: A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secret information via multiple crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-640452.html
CVE ID: CVE-2025-27533 State: PUBLISHED Published: 2025-05-07T08:59:00.249Z Last Updated: 2025-11-03T19:45:36.972Z Vendors: Apache Software Foundation Products: Apache ActiveMQ Problem Types: CWE-789 Description: Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 be
lability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg
CVE ID: CVE-2025-27534 State: PUBLISHED Published: 2025-04-07T02:35:54.626Z Last Updated: 2025-04-07T15:28:24.310Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md
CVE ID: CVE-2025-27536 State: PUBLISHED Published: 2025-08-11T02:55:12.410Z Last Updated: 2025-08-11T20:36:45.637Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-843 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE ID: CVE-2025-27537 State: PUBLISHED Published: 2025-08-12T16:59:28.501Z Last Updated: 2025-08-13T20:15:22.681Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: Edge Orchestrator software Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable escalation of privilege via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01317.html
CVE ID: CVE-2025-27538 State: PUBLISHED Published: 2025-04-16T07:45:01.229Z Last Updated: 2025-04-16T14:34:29.842Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-306 Description: Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-27539 State: PUBLISHED Published: 2025-04-16T17:37:24.315Z Last Updated: 2025-04-17T14:26:56.263Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'VerifyUser' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack req
e to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25914) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-27540 State: PUBLISHED Published: 2025-04-16T17:37:25.783Z Last Updated: 2025-04-17T14:21:07.947Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'Authenticate' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack r
ite to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25913) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-27551 State: PUBLISHED Published: 2025-03-26T11:07:43.089Z Last Updated: 2025-09-05T13:20:43.993Z Vendors: WREIS Products: DBIx::Class::EncodedColumn Problem Types: CWE-338, CWE-916, CWE-331 Description: DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files lib/DBIx/Class/EncodedColumn/Digest.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.metacpan.org/docs/guides/random-data-for-security.html - https://metacpan.org/release/WREIS/DBIx-Class-EncodedColumn-0.00032/chan
org/docs/guides/random-data-for-security.html - https://metacpan.org/release/WREIS/DBIx-Class-EncodedColumn-0.00032/changes
CVE ID: CVE-2025-27552 State: PUBLISHED Published: 2025-03-26T11:08:11.434Z Last Updated: 2025-09-05T13:21:10.093Z Vendors: WREIS Products: DBIx::Class::EncodedColumn Problem Types: CWE-338, CWE-916, CWE-331 Description: DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.metacpan.org/docs/guides/random-data-for-security.html - https://metacpan.org/release/WREIS/DBIx-Class-EncodedColumn-0.00032/changes
CVE ID: CVE-2025-27553 State: PUBLISHED Published: 2025-03-23T14:16:20.363Z Last Updated: 2025-04-02T22:03:21.278Z Vendors: Apache Software Foundation Products: Apache Commons VFS Problem Types: CWE-23 Description: Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved file is not a descendent of the base file". However, when the path contains encoded ".." characters (for example, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exc
ple, "%2E%2E/bar.txt"), it might return file objects that are not a descendent of the base file, without throwing an exception. This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2.10.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/cnzqowyw9r2pl263cylmxhnvh41hyjcb
CVE ID: CVE-2025-27554 State: PUBLISHED Published: 2025-03-01T00:00:00.000Z Last Updated: 2025-03-04T19:32:41.251Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: ToDesktop Products: ToDesktop Problem Types: CWE-94 Description: ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build server (e.g., read secrets from the desktopify config.prod.json file), and consequently deploy updates to any app, via a postinstall script in package.json. No exploitation occurred. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kibty.town/blog/todeskto
exploitation occurred. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kibty.town/blog/todesktop - https://www.todesktop.com/blog/posts/security-incident-at-todesktop - https://news.ycombinator.com/item?id=43210858
CVE ID: CVE-2025-27556 State: PUBLISHED Published: 2025-04-02T00:00:00.000Z Last Updated: 2025-04-02T22:03:22.423Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: djangoproject Products: Django Problem Types: CWE-770 Description: An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.set_language are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contain
with a very large number of Unicode characters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/g/django-announce - https://www.djangoproject.com/weblog/2025/apr/02/security-releases/
CVE ID: CVE-2025-27558 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-11-03T17:32:22.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progr
early 2025, is a planned release of the 802.11 standard. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vanhoefm/fragattacks-survey-public/blob/main/README.md
CVE ID: CVE-2025-27559 State: PUBLISHED Published: 2025-08-12T16:59:30.075Z Last Updated: 2025-08-13T20:15:16.171Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: AI Playground software Problem Types: Escalation of Privilege, CWE-276 Description: Incorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01352.html
CVE ID: CVE-2025-27561 State: PUBLISHED Published: 2025-04-15T21:55:20.141Z Last Updated: 2025-04-16T14:39:46.686Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: Unauthenticated attackers can rename "rooms" of arbitrary users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-27562 State: PUBLISHED Published: 2025-08-11T02:55:24.122Z Last Updated: 2025-08-12T14:24:10.448Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-401 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE ID: CVE-2025-27563 State: PUBLISHED Published: 2025-06-08T11:47:13.415Z Last Updated: 2025-06-09T15:04:35.209Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-281 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-06.md