Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-37132 State: PUBLISHED Published: 2025-10-14T16:53:16.724Z Last Updated: 2025-10-16T03:57:00.939Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisp
ng system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE ID: CVE-2025-37133 State: PUBLISHED Published: 2025-10-14T16:54:36.030Z Last Updated: 2025-10-16T03:56:59.802Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocal
- CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE ID: CVE-2025-37134 State: PUBLISHED Published: 2025-10-14T16:56:05.389Z Last Updated: 2025-10-16T03:56:58.799Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocal
CVE ID: CVE-2025-37135 State: PUBLISHED Published: 2025-10-14T16:56:37.077Z Last Updated: 2025-10-14T19:20:58.042Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLoca
: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE ID: CVE-2025-37136 State: PUBLISHED Published: 2025-10-14T16:56:58.248Z Last Updated: 2025-10-14T19:22:49.575Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLoca
CVE ID: CVE-2025-37137 State: PUBLISHED Published: 2025-10-14T16:57:32.140Z Last Updated: 2025-10-14T19:23:51.609Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLoca
CVE ID: CVE-2025-37138 State: PUBLISHED Published: 2025-10-14T16:57:50.910Z Last Updated: 2025-10-14T19:24:40.242Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system. Additi
actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE ID: CVE-2025-37139 State: PUBLISHED Published: 2025-10-14T16:58:14.200Z Last Updated: 2025-10-14T19:25:30.743Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_
SA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE ID: CVE-2025-37140 State: PUBLISHED Published: 2025-10-14T16:58:41.022Z Last Updated: 2025-10-14T19:26:15.112Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE ID: CVE-2025-37141 State: PUBLISHED Published: 2025-10-14T16:59:14.551Z Last Updated: 2025-10-14T19:26:49.673Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE ID: CVE-2025-37142 State: PUBLISHED Published: 2025-10-14T16:59:42.542Z Last Updated: 2025-10-14T19:27:36.196Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE ID: CVE-2025-37143 State: PUBLISHED Published: 2025-10-14T17:00:24.490Z Last Updated: 2025-10-14T18:19:14.303Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated malicious actor to download arbitrary files through carefully constructed exploits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&d
Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US
CVE ID: CVE-2025-37144 State: PUBLISHED Published: 2025-10-14T17:01:45.802Z Last Updated: 2025-10-15T13:33:21.809Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocal
CVE ID: CVE-2025-37145 State: PUBLISHED Published: 2025-10-14T17:02:25.602Z Last Updated: 2025-10-15T13:26:22.396Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocal
CVE ID: CVE-2025-37146 State: PUBLISHED Published: 2025-10-14T16:42:31.080Z Last Updated: 2025-10-16T03:57:02.099Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04958en_us&d
Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04958en_us&docLocale=en_US
CVE ID: CVE-2025-37147 State: PUBLISHED Published: 2025-10-14T16:42:57.397Z Last Updated: 2025-10-14T19:13:51.499Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensure only vendor-signed firmware can execute on the device. An adversary can exploit this vulnerability to run modified or custom firmware on affected Access Points. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay
Points. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04958en_us&docLocale=en_US
CVE ID: CVE-2025-37148 State: PUBLISHED Published: 2025-10-14T16:43:35.134Z Last Updated: 2025-10-14T19:15:02.395Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: ArubaOS (AOS) Description: A vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to potentially disrupt network services and require manual intervention to restore functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpes
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04958en_us&docLocale=en_US
CVE ID: CVE-2025-37149 State: PUBLISHED Published: 2025-10-14T15:55:23.841Z Last Updated: 2025-10-28T20:37:02.318Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: ProLiant RL300 Gen11 Server Description: A potential out-of-bound reads vulnerability in HPE ProLiant RL300 Gen11 Server's UEFI firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04952en_us&docLocale=en_US
CVE ID: CVE-2025-37155 State: PUBLISHED Published: 2025-11-18T18:40:40.560Z Last Updated: 2025-11-19T04:55:36.599Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking AOS-CX Description: A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docI
m. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US
CVE ID: CVE-2025-37156 State: PUBLISHED Published: 2025-11-18T18:46:10.640Z Last Updated: 2025-11-18T20:28:30.645Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking AOS-CX Description: A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker with administrative access to execute specific code that renders the switch non-bootable and effectively non-functional. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLo
es: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US
CVE ID: CVE-2025-37157 State: PUBLISHED Published: 2025-11-18T18:48:58.009Z Last Updated: 2025-11-19T04:55:35.900Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networkign AOS-CX Description: A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US
CVE ID: CVE-2025-37158 State: PUBLISHED Published: 2025-11-18T18:51:28.623Z Last Updated: 2025-11-19T04:55:35.219Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking AOS-CX Description: A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US
CVE ID: CVE-2025-37159 State: PUBLISHED Published: 2025-11-18T18:52:46.501Z Last Updated: 2025-11-19T04:55:34.559Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking AOS-CX Description: A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
or modification of sensitive configuration data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US
CVE ID: CVE-2025-37160 State: PUBLISHED Published: 2025-11-18T18:54:09.908Z Last Updated: 2025-11-18T20:56:20.675Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking AOS-CX Description: A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docL
tes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US
CVE ID: CVE-2025-37161 State: PUBLISHED Published: 2025-11-18T19:21:23.220Z Last Updated: 2025-11-19T14:36:15.968Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking 100 Series Cellular Bridge Description: A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com
disrupting network operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04970en_us&docLocale=en_US
CVE ID: CVE-2025-37162 State: PUBLISHED Published: 2025-11-18T19:23:20.504Z Last Updated: 2025-11-19T14:39:46.998Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking 100 Series Cellular Bridge Description: A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04970en_u
yst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04970en_us&docLocale=en_US
CVE ID: CVE-2025-37163 State: PUBLISHED Published: 2025-11-18T19:06:11.180Z Last Updated: 2025-11-19T04:55:38.634Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Management Software (Airwave) Description: A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public
operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04971en_us&docLocale=en_US
CVE ID: CVE-2025-37727 State: PUBLISHED Published: 2025-10-10T09:56:15.234Z Last Updated: 2025-10-10T16:34:36.812Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Elastic Products: Elasticsearch Problem Types: CWE-532 Description: Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453
CVE ID: CVE-2025-37728 State: PUBLISHED Published: 2025-10-07T13:54:49.677Z Last Updated: 2025-10-07T15:28:49.280Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Elastic Products: Kibana Problem Types: CWE-522 Description: Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-crowdstrike-connector-8-18-8-8-19-5-9-0-8-and-
CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-crowdstrike-connector-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-19/382455
CVE ID: CVE-2025-37729 State: PUBLISHED Published: 2025-10-13T13:47:08.907Z Last Updated: 2025-11-06T14:43:45.993Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Elastic Products: Elastic Cloud Enterprise (ECE) Problem Types: CWE-1336 Description: Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-
t Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641
CVE ID: CVE-2025-37730 State: PUBLISHED Published: 2025-05-06T17:29:07.189Z Last Updated: 2025-05-06T17:51:59.631Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Elastic Products: Logstash Problem Types: CWE-295 Description: Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP output was not being performed when the ssl_verification_mode => full was set. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/logstash-8-17-6-8-18-1-and-9-0-1-security-update-esa-2025-08/377869