Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-27836 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-11-03T19:46:37.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708192
CVE ID: CVE-2025-27837 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-03-26T13:40:47.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708238
CVE ID: CVE-2025-27839 State: PUBLISHED Published: 2025-03-07T00:00:00.000Z Last Updated: 2025-03-10T17:19:25.047Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Tangem Products: SDK Problem Types: CWE-1025 Description: operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tangem.com/en/blog/post/app-update/ - https://github.com/tangem/tangem-sdk-android/commit/2458818
References: - https://tangem.com/en/blog/post/app-update/ - https://github.com/tangem/tangem-sdk-android/commit/24588188fdb51ed469cd59d2c595128c1fe63b07 - https://github.com/tangem/tangem-sdk-android/releases/tag/release-app_5.18-409
CVE ID: CVE-2025-27840 State: PUBLISHED Published: 2025-03-08T00:00:00.000Z Last Updated: 2025-05-12T15:33:14.134Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: Espressif Products: ESP32 Problem Types: CWE-912 Description: Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TarlogicSecurity/Talks/blob/main/2025_RootedCon_BluetoothTools.pdf - https://x.com/pascal_gujer/status/1898442439704158276 - https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/ - https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-
/backdoor-esp32-chip-infect-ot-devices/ - https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices/ - https://reg.rootedcon.com/cfp/schedule/talk/5 - https://flyingpenguin.com/?p=67838 - https://github.com/em0gi/CVE-2025-27840 - https://github.com/orgs/espruino/discussions/7699 - https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/ - https://darkmentor.com/blog/esp32_non-backdoor/ - https://news.ycombinator.com/item?id=43308740 - https://news.ycombinator.com/item?id=43301369 - https://github.com/esphome/esphome/discussions/8382 - https://cheriot.org/auditing/backdo
binator.com/item?id=43301369 - https://github.com/esphome/esphome/discussions/8382 - https://cheriot.org/auditing/backdoor/2025/03/09/no-esp32-style-backdoor.html - https://www.espressif.com/en/news/Response_ESP32_Bluetooth
CVE ID: CVE-2025-27845 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T12:58:53.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for elevated permissions to the UI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://espec.com - https://espec.com/na/about/detail/cve_2025_27845
CVE ID: CVE-2025-27846 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T16:23:28.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges because GRUB and the BIOS are unprotected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://espec.com - https://espec.com/na/about/detail/cve_2025_27846
CVE ID: CVE-2025-27847 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T16:26:50.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://espec.com - https://espec.com/na/about/detail/cve_2025_27847
CVE ID: CVE-2025-27867 State: PUBLISHED Published: 2025-03-12T15:51:24.965Z Last Updated: 2025-03-21T20:36:57.712Z Vendors: Apache Software Foundation Products: Apache Felix HTTP Webconsole Plugin Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin. This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0. Users are recommended to upgrade to version 1.2.2, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/y83f2rvm8bccr5ctgv7mzxd69p6f77dp
CVE ID: CVE-2025-27888 State: PUBLISHED Published: 2025-03-20T11:29:00.730Z Last Updated: 2025-03-25T15:18:04.929Z Vendors: Apache Software Foundation Products: Apache Druid Problem Types: CWE-918, CWE-79, CWE-601 Description: Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or
ally crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected. Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/c0qo989pwtrqkjv6xfr0c30dnjq8vf39
CVE ID: CVE-2025-27889 State: PUBLISHED Published: 2025-07-10T00:00:00.000Z Last Updated: 2025-07-10T18:04:56.735Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: wftpserver Products: Wing FTP Server Problem Types: CWE-15 Description: Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wftpserver.com/wftpserver.htm - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-20
https://www.wftpserver.com/wftpserver.htm - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27889.txt
CVE ID: CVE-2025-27891 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-20T14:27:14.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds reads via malformed NAS packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/c
support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-27891/
CVE ID: CVE-2025-27892 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-16T18:32:23.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-8g35-7rmw-7f59 - https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-001/
CVE ID: CVE-2025-27893 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-08-08T12:37:21.236Z Severity: LOW (CVSS 1.8 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: Archer Products: Archer Problem Types: CWE-472 Description: In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. NOTE: the Supplier analyzed the reported exploitation steps and found that, although the user can modify the immutable field, upon switching to View mode the field is reverted to its original value,
though the user can modify the immutable field, upon switching to View mode the field is reverted to its original value, without anything being saved to the database (and consequently there is no impact). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://archerirm.com - https://github.com/NastyCrow/CVE-2025-27893
CVE ID: CVE-2025-27906 State: PUBLISHED Published: 2025-10-14T14:08:42.994Z Last Updated: 2025-10-14T19:09:55.400Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Content Navigator Problem Types: CWE-548 Description: IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files and folders are visible in the browser to a user; however, the contents of the files cannot be read obtained or modified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247854
CVE ID: CVE-2025-27907 State: PUBLISHED Published: 2025-04-22T16:20:21.645Z Last Updated: 2025-09-01T00:38:55.672Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-918 Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7231514
CVE ID: CVE-2025-27909 State: PUBLISHED Published: 2025-08-18T14:00:31.751Z Last Updated: 2025-08-18T14:12:36.834Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-942 Description: IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242354
CVE ID: CVE-2025-27910 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-12T15:26:25.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xujeff/tianti/issues/39
CVE ID: CVE-2025-27911 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-11T13:22:20.067Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C) Vendors: Datalust Products: Seq Problem Types: CWE-770 Description: An issue was discovered in Datalust Seq before 2024.3.13545. Expansion of identifiers in message templates can be used to bypass the system "Event body limit bytes" setting, leading to increased resource consumption. With sufficiently large events, there can be disk space exhaustion (if saved to disk) or a termination of the server process with an out-of-memory error. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
rmination of the server process with an out-of-memory error. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://datalust.co/seq - https://github.com/datalust/seq-tickets/issues/2365
CVE ID: CVE-2025-27912 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-11T13:20:54.633Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C) Vendors: Datalust Products: Seq Problem Types: CWE-352 Description: An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when (1) Entra ID or OpenID Connect authentication is in use and a user visits a compromised/malicious site, or (2) when username/password or Active Directory authentication is in use and a user visits a compromised/malicious site under the same effective top-level domain as the Seq server. Exploitation of the vulnerabil
a compromised/malicious site under the same effective top-level domain as the Seq server. Exploitation of the vulnerability allows the attacker to conduct impersonation attacks and perform actions in Seq on behalf of the targeted user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://datalust.co/seq - https://github.com/datalust/seq-tickets/issues/2366
CVE ID: CVE-2025-27913 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-11T02:52:25.597Z Vendors: Passbolt Products: API Problem Types: CWE-348 Description: Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.passbolt.com/incidents/host-header-injection
CVE ID: CVE-2025-27914 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-03-12T15:44:52.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token and involves a crafted URL with manipulated query parameters that triggers XSS when accessed by a victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Discl
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes
CVE ID: CVE-2025-27915 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-10-21T22:55:23.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filter
itrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes
CVE ID: CVE-2025-27916 State: PUBLISHED Published: 2025-11-06T00:00:00.000Z Last Updated: 2025-11-10T19:49:52.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AnyDesk through 9.0.4. When the connection between two clients is established via an IP address, it is possible to manipulate the data and spoof the AnyDesk ID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://anydesk.com/en/changelog/windows - https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdf
CVE ID: CVE-2025-27917 State: PUBLISHED Published: 2025-11-06T00:00:00.000Z Last Updated: 2025-11-10T20:51:39.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AnyDesk through 9.0.4. Remote Denial of Service can occur because of incorrect deserialization that results in failed memory allocation and a NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://anydesk.com/en/changelog/windows - https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdf
CVE ID: CVE-2025-27918 State: PUBLISHED Published: 2025-11-06T00:00:00.000Z Last Updated: 2025-11-12T17:01:40.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AnyDesk before 9.0.0. It has an integer overflow and resultant heap-based buffer overflow via a UDP packet during processing of an Identity user image within the Discovery feature, or when establishing a connection between any two clients. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://anydesk.com/en/changelog/windows - https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdf
CVE ID: CVE-2025-27919 State: PUBLISHED Published: 2025-11-06T00:00:00.000Z Last Updated: 2025-11-12T17:01:50.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission can manipulate remote AnyDesk settings and create a password for the Full Access profile without needing confirmation from the counterparty. Consequently, the attacker can later connect without this counterparty confirmation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://anydesk.com/en/changelog/windows - https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojte
https://anydesk.com/en/changelog/windows - https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdf
CVE ID: CVE-2025-27920 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-10-21T22:55:17.487Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Srimax Products: Output Messenger Problem Types: CWE-24 Description: Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.srimax.com/products-2/output-messenger/ - https://www.outputmess
tes: - CISA ADP Vulnrichment: References: - https://www.srimax.com/products-2/output-messenger/ - https://www.outputmessenger.com/cve-2025-27920/
CVE ID: CVE-2025-27921 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-05T15:57:38.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization or encoding. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.srimax.com/products-2/output-messenger/ - https://www.outputmessenger.com/cve-2025-27921/
CVE ID: CVE-2025-27924 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-11T15:51:51.478Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Nintex Products: Automation Problem Types: CWE-79 Description: Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.nintex.com/en-US/platform/ReleaseNotes/K2Five.htm
CVE ID: CVE-2025-27925 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-11T13:36:05.354Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Nintex Products: Automation Problem Types: CWE-502 Description: Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.nintex.com/en-US/platform/ReleaseNotes/K2Five.htm
CVE ID: CVE-2025-27926 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-11T13:36:37.534Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Nintex Products: Automation Problem Types: CWE-276 Description: In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.nintex.com/en-US/platform/ReleaseNotes/K2Five.htm
CVE ID: CVE-2025-27927 State: PUBLISHED Published: 2025-04-15T21:43:15.834Z Last Updated: 2025-04-16T14:41:30.177Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-27929 State: PUBLISHED Published: 2025-04-15T21:59:31.462Z Last Updated: 2025-04-16T14:36:29.970Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04