Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54949 State: PUBLISHED Published: 2025-08-07T22:58:23.290Z Last Updated: 2025-08-12T14:13:11.044Z Vendors: Meta Platforms, Inc Products: ExecuTorch Problem Types: Heap-based Buffer Overflow (CWE-122) Description: A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2025-54949 - https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be
CVE ID: CVE-2025-54950 State: PUBLISHED Published: 2025-08-07T23:03:03.775Z Last Updated: 2025-08-12T14:18:12.048Z Vendors: Meta Platforms, Inc Products: ExecuTorch Problem Types: Out-of-bounds Read (CWE-125) Description: An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2025-54950 - https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005
CVE ID: CVE-2025-54951 State: PUBLISHED Published: 2025-08-07T23:06:02.059Z Last Updated: 2025-08-12T14:20:40.207Z Vendors: Meta Platforms, Inc Products: ExecuTorch Problem Types: Heap-based Buffer Overflow (CWE-122) Description: A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2025-54951 - https://github.com/pytorch/executorch/commit/cea9b23aa8ff78aff9282
www.facebook.com/security/advisories/cve-2025-54951 - https://github.com/pytorch/executorch/commit/cea9b23aa8ff78aff92829a466da97461cc7930c
CVE ID: CVE-2025-54952 State: PUBLISHED Published: 2025-08-07T23:08:39.186Z Last Updated: 2025-08-08T14:11:22.140Z Vendors: Meta Platforms, Inc Products: ExecuTorch Problem Types: Integer Overflow to Buffer Overflow (CWE-680) Description: An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 8f062d3f661e20bb19b24b767b9a9a46e8359f2b. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2025-54952 - https://github.com/pytorch/executorch/comm
: References: - https://www.facebook.com/security/advisories/cve-2025-54952 - https://github.com/pytorch/executorch/commit/8f062d3f661e20bb19b24b767b9a9a46e8359f2b
CVE ID: CVE-2025-54955 State: PUBLISHED Published: 2025-08-02T00:00:00.000Z Last Updated: 2025-08-04T15:20:53.978Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenNebula Products: OpenNebula Problem Types: CWE-362 Description: OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account takeover. By exploiting this, an unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowledge of their credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenNebula/one - https://
edentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenNebula/one - https://github.com/Stolichnayer/OpenNebula-Account-Takeover - https://docs.opennebula.io/6.10/intro_release_notes/release_notes_enterprise/resolved_issues_6103.html - https://github.com/OpenNebula/one/releases/tag/release-7.0.0 - https://github.com/OpenNebula/one/commit/81058d9705e7ac619d294423de28b76d88f613b6
CVE ID: CVE-2025-54956 State: PUBLISHED Published: 2025-08-03T00:00:00.000Z Last Updated: 2025-11-25T06:04:43.764Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: r-lib Products: gh Problem Types: CWE-669 Description: The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/r-lib/gh/issues/222 - https://github.com/r-lib/gh/commit/b575d488c71318449cc6c8c989c617db29275848 - https://github.com/r-lib/gh/compare/v1.4.1...v1.5.0
CVE ID: CVE-2025-54957 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-20T18:05:36.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write. Additional Analyst Notes: -
f-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://professional.dolby.com/siteassets/pdfs/dolby-security-advisory-CVE-2025-54957-Oct-14-25.pdf
CVE ID: CVE-2025-54958 State: PUBLISHED Published: 2025-08-08T04:40:26.281Z Last Updated: 2025-08-08T15:59:33.184Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Mubit co.,ltd. Products: Powered BLUE 870 Problem Types: CWE-78 Description: Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If this vulnerability is exploited, arbitrary OS commands may be executed on the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mubit.co.jp/sub/products/blue/pb-base-cloud-890.html - https://jvn.jp/en/jp/JVN39636188/
CVE ID: CVE-2025-54959 State: PUBLISHED Published: 2025-08-08T04:39:40.478Z Last Updated: 2025-08-08T16:01:40.567Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mubit co.,ltd. Products: Powered BLUE 870 Problem Types: CWE-22 Description: Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected product may be disclosed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mubit.co.jp/sub/products/blue/pb-base-cloud-890.html - https://jvn.jp/en/jp/JVN39636188/
CVE ID: CVE-2025-54962 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-04T16:45:21.796Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thiagoralves Products: OpenPLC_v3 Problem Types: CWE-434 Description: /edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), and these are then publicly accessible under the /static URI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992 - https://github.com/Eyodav/OpenPLC-Insecure-File-Uplo
/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992 - https://github.com/Eyodav/OpenPLC-Insecure-File-Upload
CVE ID: CVE-2025-54963 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-24T14:13:50.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may submit a crafted job request that grants read access to files on the filesystem with the permissions of the GXP Job Service process. The path to a file is not sanitized for directory traversal, potentially allowing an attacker to read sensitive files in some configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.baesystems.com/en-us/product/geospatial-exploit
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54963
CVE ID: CVE-2025-54964 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-25T03:56:09.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Service may inject arbitrary executables. If the Job Service is configured for local-only access, this may allow for privilege escalation in certain situations. If the Job Service is network accessible, this may allow remote command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexpl
nt: References: - https://www.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54964
CVE ID: CVE-2025-54965 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T18:47:15.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameter before using it in the job status page. An attacker who is able to social engineer a user into clicking a malicious link may be able to execute arbitrary JavaScript in the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/conten
ww.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54965
CVE ID: CVE-2025-54966 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-24T14:15:46.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return sensitive information in certain situations, including local file paths and SOCET GXP version information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54966
CVE ID: CVE-2025-54967 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T13:40:46.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a SOCET GXP user into opening a malicious file can trigger a variety of outbound requests, potentially compromising sensitive information in the process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabi
us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54967
CVE ID: CVE-2025-54968 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T13:33:49.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication. In some configurations, this may allow remote users to submit jobs, or local users to submit jobs that will execute with the permissions of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54968
CVE ID: CVE-2025-54969 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T18:49:53.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers a valid user into clicking a malicious link or visiting a malicious website may be able to submit requests to the Job Status Service without the user's knowledge. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-g
tems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54969
CVE ID: CVE-2025-54970 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T13:35:46.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate requests. In some configurations, this may allow remote or local users to abort jobs or read information without the permissions of the job owner. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.baesystems.com/en-us/product/geospatial-exploitation-products - https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54970
CVE ID: CVE-2025-54971 State: PUBLISHED Published: 2025-11-18T17:01:17.182Z Last Updated: 2025-11-19T14:16:51.872Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-200 Description: An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to get the external resources password via the logs of the product Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG
of the product Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-686
CVE ID: CVE-2025-54972 State: PUBLISHED Published: 2025-11-18T17:01:15.406Z Last Updated: 2025-11-19T14:27:11.711Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiMail Problem Types: CWE-93 Description: An improper neutralization of crlf sequences ('crlf injection') in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2 all versions, FortiMail 7.0 all versions may allow an attacker to inject headers in the response via convincing a user to click on a specifically crafted link Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-634
CVE ID: CVE-2025-54973 State: PUBLISHED Published: 2025-10-14T15:23:03.723Z Last Updated: 2025-10-16T15:34:29.571Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:X/RL:X/RC:C) Vendors: Fortinet Products: FortiAnalyzer Problem Types: CWE-362 Description: A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10 and before 7.0.13 allows an attacker to attempt to win a race condition to bypass the FortiCloud SSO authorization via crafted FortiCloud SSO requests. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
FortiCloud SSO authorization via crafted FortiCloud SSO requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-198
CVE ID: CVE-2025-54974 State: REJECTED Published: N/A Last Updated: 2025-08-05T02:55:08.336Z Description: No description available.
CVE ID: CVE-2025-54975 State: REJECTED Published: N/A Last Updated: 2025-08-05T02:55:07.630Z Description: No description available.
CVE ID: CVE-2025-54976 State: REJECTED Published: N/A Last Updated: 2025-08-05T02:55:07.155Z Description: No description available.
CVE ID: CVE-2025-54977 State: REJECTED Published: N/A Last Updated: 2025-08-05T02:55:06.678Z Description: No description available.
CVE ID: CVE-2025-54978 State: REJECTED Published: N/A Last Updated: 2025-08-05T02:55:06.188Z Description: No description available.
CVE ID: CVE-2025-54979 State: REJECTED Published: N/A Last Updated: 2025-08-05T02:55:05.573Z Description: No description available.
CVE ID: CVE-2025-54980 State: REJECTED Published: N/A Last Updated: 2025-08-05T02:55:05.021Z Description: No description available.
CVE ID: CVE-2025-54982 State: PUBLISHED Published: 2025-08-05T05:36:06.752Z Last Updated: 2025-08-19T03:55:32.202Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Zscaler Products: Authentication Server Problem Types: CWE-347 Description: An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/zia/about-identity-providers
CVE ID: CVE-2025-54983 State: PUBLISHED Published: 2025-11-12T03:07:39.531Z Last Updated: 2025-11-12T18:18:36.813Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Zscaler Products: Zscaler Client Connector Problem Types: CWE-772 Description: A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2025
CVE ID: CVE-2025-54987 State: PUBLISHED Published: 2025-08-05T13:00:38.698Z Last Updated: 2025-08-06T03:55:18.677Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex One Problem Types: CWE-78 Description: A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0020652
CVE ID: CVE-2025-54988 State: PUBLISHED Published: 2025-08-20T20:08:49.481Z Last Updated: 2025-11-04T22:06:45.688Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Apache Software Foundation Products: Apache Tika PDF parser module Problem Types: CWE-611 Description: Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependenc
cious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w
CVE ID: CVE-2025-54989 State: PUBLISHED Published: 2025-08-15T15:04:19.097Z Last Updated: 2025-11-03T18:13:39.162Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: FirebirdSQL Products: firebird Problem Types: CWE-476 Description: Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
een patched in versions 3.0.13, 4.0.6, and 5.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7qp6-hqxj-pjjp - https://github.com/FirebirdSQL/firebird/issues/8554 - https://github.com/FirebirdSQL/firebird/commit/169da595f8693fc1a65a79c741724b1bc8db9f25
CVE ID: CVE-2025-54990 State: PUBLISHED Published: 2025-11-18T22:13:59.524Z Last Updated: 2025-11-19T21:03:14.756Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xwikisas Products: application-admintools Problem Types: CWE-276 Description: XWiki AdminTools integrates administrative tools for managing a running XWiki instance. Prior to version 1.1, users without admin rights have access to AdminTools.SpammedPages. View rights are not restricted only to admin users for AdminTools.SpammedPages. While no data is visible to non admin users, the page is still accessible. This issue has been patched in version 1.1. A workaround involves setting the view rights for
page is still accessible. This issue has been patched in version 1.1. A workaround involves setting the view rights for the AdminTools space to be only available for the XWikiAdminGroup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/application-admintools/security/advisories/GHSA-v7r8-8p5c-h4xw
CVE ID: CVE-2025-54992 State: PUBLISHED Published: 2025-08-11T21:34:48.750Z Last Updated: 2025-08-12T15:44:24.225Z Vendors: telstra Products: open-kilda Problem Types: CWE-611 Description: OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity (XXE) injection vulnerability was found in OpenKilda which in combination with GHSL-2025-024 allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is running. This issue may lead to Information disclosure. This issue has been patched in version 1.164.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/telstra/open-kilda/security/a
164.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/telstra/open-kilda/security/advisories/GHSA-43rg-6r66-6hr7 - https://github.com/telstra/open-kilda/pull/5778 - https://github.com/telstra/open-kilda/commit/1eddb4983a6287d083e3e99a56dc4c291abd347e