Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-43589 State: PUBLISHED Published: 2025-06-10T16:23:04.239Z Last Updated: 2025-06-11T04:01:47.021Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-416 Description: InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb25-53.html
CVE ID: CVE-2025-43590 State: PUBLISHED Published: 2025-06-10T16:22:58.626Z Last Updated: 2025-06-13T15:08:47.941Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-787 Description: InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb25-53.html
CVE ID: CVE-2025-43591 State: PUBLISHED Published: 2025-07-08T21:49:03.603Z Last Updated: 2025-07-10T03:55:48.910Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-122 Description: InDesign Desktop versions 19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb25-60.html
CVE ID: CVE-2025-43592 State: PUBLISHED Published: 2025-07-08T21:49:02.841Z Last Updated: 2025-07-10T03:55:53.281Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-824 Description: InDesign Desktop versions 19.5.3 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb25-60.html
CVE ID: CVE-2025-43593 State: PUBLISHED Published: 2025-06-10T16:23:00.230Z Last Updated: 2025-06-13T15:07:16.094Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-787 Description: InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb25-53.html
CVE ID: CVE-2025-43594 State: PUBLISHED Published: 2025-07-08T21:49:02.057Z Last Updated: 2025-07-10T03:55:52.189Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: InDesign Desktop Problem Types: CWE-787 Description: InDesign Desktop versions 19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/indesign/apsb25-60.html
CVE ID: CVE-2025-43595 State: PUBLISHED Published: 2025-05-01T21:12:58.729Z Last Updated: 2025-05-22T16:49:29.201Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MSP360 Products: Backup Problem Types: CWE-276 Description: An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder. Upgrade to MSP360 Backup 4.4 (released on 2025-04-22). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.msp360.com/cloudberry-backup-mac-linux/whats-new - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-
udberry-backup-mac-linux/whats-new - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-119-01.json - https://www.cve.org/CVERecord?id=CVE-2025-43595
CVE ID: CVE-2025-43596 State: PUBLISHED Published: 2025-05-22T16:49:06.833Z Last Updated: 2025-05-22T19:33:20.668Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MSP360 Products: Backup Problem Types: CWE-276 Description: An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a specially crafted file with an arbitrary file backup target. Upgrade to MSP360 Backup 8.1.1.19 (released on 2025-05-15). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.msp360.com/cloudberry-backup/whats-new - https://help.msp360.com/cloudberry-backup/securi
nt: References: - https://help.msp360.com/cloudberry-backup/whats-new - https://help.msp360.com/cloudberry-backup/security/admin-privileges - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-119-01.json - https://www.cve.org/CVERecord?id=CVE-2025-43596
CVE ID: CVE-2025-43697 State: PUBLISHED Published: 2025-06-10T11:28:58.914Z Last Updated: 2025-06-11T13:29:20.263Z Vendors: Salesforce Products: OmniStudio Problem Types: CWE-281 Description: Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=004980323&type=1
CVE ID: CVE-2025-43698 State: PUBLISHED Published: 2025-06-10T11:33:08.994Z Last Updated: 2025-06-11T13:28:41.726Z Vendors: Salesforce Products: OmniStudio Problem Types: CWE-281 Description: Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=004980323&type=1
CVE ID: CVE-2025-43699 State: PUBLISHED Published: 2025-06-10T11:44:01.720Z Last Updated: 2025-06-18T13:31:44.330Z Vendors: Salesforce Products: OmniStudio Problem Types: CWE-602 Description: Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check. This impacts OmniStudio: before Spring 2025 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=004980323&type=1
CVE ID: CVE-2025-43700 State: PUBLISHED Published: 2025-06-10T11:12:53.559Z Last Updated: 2025-06-10T15:15:24.723Z Vendors: Salesforce Products: OmniStudio Problem Types: CWE-281 Description: Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=004980323&type=1
CVE ID: CVE-2025-43701 State: PUBLISHED Published: 2025-06-10T11:21:57.415Z Last Updated: 2025-06-10T15:14:47.515Z Vendors: Salesforce Products: OmniStudio Problem Types: CWE-281 Description: Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=004980323&type=1
CVE ID: CVE-2025-43703 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-17T13:56:42.103Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Ankitects Products: Anki Problem Types: CWE-830 Description: An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ankitects/an
fix for CVE-2024-32484. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ankitects/anki/pull/3925 - https://github.com/ankitects/anki/pull/3925/commits/24bca15fd3d9dc386916509eb2d4862d1184e709
CVE ID: CVE-2025-43704 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-17T13:56:34.779Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Veritas Products: Data Insight Problem Types: CWE-319 Description: Arctera/Veritas Data Insight before 7.1.2 can send cleartext credentials when configured to use HTTP Basic Authentication to a Dell Isilon OneFS server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/ARC25-006
CVE ID: CVE-2025-43708 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T19:22:56.942Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: VisiCut Products: VisiCut Problem Types: CWE-674 Description: VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='../../../set/set[2]' is used, aka an "insecure deserialization" issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Gelcon/PoC-of-VisiCut2_1-Stack-Overflow-Vul - https://github.com/t-oster/VisiCut - https://visicut.org
CVE ID: CVE-2025-43711 State: PUBLISHED Published: 2025-07-04T00:00:00.000Z Last Updated: 2025-07-08T14:36:02.112Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Tunnelblick Project Products: Tunnelblick Problem Types: CWE-459 Description: Tunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (upon the next boot) by dragging a crafted Tunnelblick.app file into /Applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tunnelblick.net/downloads.html - https://tunnelblick.net/cCVE-2025-43711.html
CVE ID: CVE-2025-43712 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-08-04T11:38:21.950Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: JHipster Products: JHipster Problem Types: CWE-451 Description: JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin
its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier because there is no privilege escalation in the context of the JHipster backend (the report only demonstrates that, after using JHipster to generate an application, one can make a non-functional admin screen visible in the front end of that application). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jhipster/generator-jhipster/releases - https://medium.com/@hritikgodara/cve-2025-43712-privilege-escalation-via-response-manipulation-in-the-jhipster-platfor
- https://medium.com/@hritikgodara/cve-2025-43712-privilege-escalation-via-response-manipulation-in-the-jhipster-platform-5e18c0434def - https://groups.google.com/g/jhipster-dev/c/ATSlWkEjw2w - https://firecompass.com/cve-2025-43712-jhipster-platform-privilege-escalation-vulnerability-discovered-by-firecompass-research-added-to-nist/
CVE ID: CVE-2025-43713 State: PUBLISHED Published: 2025-07-03T00:00:00.000Z Last Updated: 2025-07-03T14:08:08.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows system services that support license key management and deprecated Windows network authentication. The services are implemented with .NET remoting and can be exploited via well-known deserialization techniques inherent in the technology. Because the services run with SYSTEM-level rights, exploits can be crafted to achieve escalation of privilege and arbitrary code execution. This affects DataGate for SQ
s, exploits can be crafted to achieve escalation of privilege and arbitrary code execution. This affects DataGate for SQL Server 17.0.36.0 and 16.0.89.0, DataGate Component Suite 17.0.36.0 and 16.0.89.0, DataGate Monitor 17.0.26.0 and 16.0.65.0, DataGate WebPak 17.0.37.0 and 16.0.90.0, Monarch for .NET 11.4.50.0 and 10.0.62.0, Encore RPG 4.1.36.0, Visual RPG .NET FW 17.0.37.0 and 16.0.90.0, Visual RPG .NET FW Windows Deployment 17.0.36.0 and 16.0.89.0, WingsRPG 11.0.38.0 and 10.0.95.0, Mobile RPG 11.0.35.0 and 10.0.94.0, Monarch Framework for .NET FW 11.0.36.0 and 10.0.89.0, Browser Terminal 17.0.37.0 and 16.0.90.0, Visual RPG Classic 5.2.7.0 and 5.1.17.0, Visual RPG Deployment 5.2.7.0 and 5
, Browser Terminal 17.0.37.0 and 16.0.90.0, Visual RPG Classic 5.2.7.0 and 5.1.17.0, Visual RPG Deployment 5.2.7.0 and 5.1.17.0, and DataGate Studio 17.0.38.0 and 16.0.104.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://asna.com - https://www.asna.com/en/kb/security-update
CVE ID: CVE-2025-43714 State: PUBLISHED Published: 2025-05-19T00:00:00.000Z Last Updated: 2025-05-19T15:50:23.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which enables HTML injection within most modern graphical web browsers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@zer0dac/chatgpt-a-potential-phishing-vector-via-html-injection-bf703c79590a
CVE ID: CVE-2025-43715 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T19:16:59.738Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Nullsoft Products: Nullsoft Scriptable Install System Problem Types: CWE-754 Description: Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag. Additional Analyst N
ion. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/nsis/bugs/1315/ - https://nsis.sourceforge.io/Docs/AppendixF.html#v3.11-rl
CVE ID: CVE-2025-43716 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-23T13:43:05.407Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Ivanti Products: LANDesk Management Suite Problem Types: CWE-180 Description: A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /client/index.php endpoint, an attacker can bypass access controls and gain unauthorized access to various endpoints such as /client/index.php%3F.php/gsb/firewall.php within the management web panel, potentially exposing sensitive device information. NOTE: This vulnerability only affects
thin the management web panel, potentially exposing sensitive device information. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Graphical-overview-of-the-LANDesk-Management-Gateway-Functionality - https://medium.com/@0xbytehunter/discovery-of-path-traversal-vulnerability-in-landesk-management-gateway-devices-6dba386dd290
CVE ID: CVE-2025-43717 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T19:16:25.268Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: avb Products: HTTP_Request2 Problem Types: CWE-531 Description: In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pear/HTTP_Request2/commit/07925aa77e441dba0ff0fa973a09802729cb838f - https://github.com/pear/HTTP_Request2/commit/265e05f9e08a28a38a57219516a8e4e2df
925aa77e441dba0ff0fa973a09802729cb838f - https://github.com/pear/HTTP_Request2/commit/265e05f9e08a28a38a57219516a8e4e2dfdbb147 - https://github.com/pear/HTTP_Request2/compare/v2.6.0...v2.7.0 - https://github.com/pear/HTTP_Request2/blob/b1c61b71128045734d757c4d3d436457ace80ea7/package.xml#L24
CVE ID: CVE-2025-43718 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-06T17:41:43.699Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: freedesktop Products: Poppler Problem Types: CWE-674 Description: Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor). Additional Analyst Notes: - CISA ADP Vulnrichment:
with deep recursion in the regex executor (std::__detail::_Executor). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408 - https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-43718.md
CVE ID: CVE-2025-43720 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T13:52:37.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. The Configuration profile is exposed to the Observer user role, revealing the password requires to escape out of the MDM controlled device's profile. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/h-mdm/hmdm-server/commit/19e4a63f732c99064444df7e8c61b4f01df362e8 - https://github.com/h-mdm/hmdm-server/compare/v5.32.1...v5.33.1 - https://www.periculo.co.uk/cyber-security-blog/how-our-pen-tester-foun
com/h-mdm/hmdm-server/compare/v5.32.1...v5.33.1 - https://www.periculo.co.uk/cyber-security-blog/how-our-pen-tester-found-a-critical-vulnerability-cve-2025-43720
CVE ID: CVE-2025-43722 State: PUBLISHED Published: 2025-09-08T18:43:50.348Z Last Updated: 2025-09-09T03:55:26.628Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-269 Description: Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000363686/dsa-2025-319-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities
CVE ID: CVE-2025-43723 State: PUBLISHED Published: 2025-11-10T19:10:43.824Z Last Updated: 2025-11-10T19:38:29.859Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-327 Description: Dell PowerScale OneFS, versions prior to 9.10.1.3 and versions 9.11.0.0 through 9.12.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000390206/dsa-2025-381-security-upda
es: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000390206/dsa-2025-381-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities
CVE ID: CVE-2025-43724 State: PUBLISHED Published: 2025-10-08T14:45:47.371Z Last Updated: 2025-10-08T15:19:28.839Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-639 Description: Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain unauthorized access to NFSv4 or SMB shares. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376214/dsa-2025-347-security-update-for-dell-powerscale-o
ent: References: - https://www.dell.com/support/kbdoc/en-us/000376214/dsa-2025-347-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities
CVE ID: CVE-2025-43725 State: PUBLISHED Published: 2025-09-10T15:56:08.961Z Last Updated: 2025-09-11T14:43:09.450Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerProtect Data Manager Problem Types: CWE-276 Description: Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotec
ment: References: - https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE ID: CVE-2025-43726 State: PUBLISHED Published: 2025-09-02T18:29:58.871Z Last Updated: 2025-09-03T03:55:34.467Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Alienware Command Center 5.x (AWCC) Problem Types: CWE-59 Description: Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000361664/dsa-2025-336