Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ssage Editor Output Filters enabled. A remote unauthenticated attacker can exploit this vulnerability to send unauthenticated requests to execute the IPDS pipeline with specially crafted Form Properties, enabling remote execution of arbitrary Python code. This vulnerability could lead to a full system compromise of the affected server, particularly if Visual Weather services are run under a privileged user account—contrary to the documented installation best practices. Upgrade to the patched versions 7.3.10 (or higher), 8.6.0 (or higher). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iblsoft.com/security/advisory-isec-2024-001/
CVE ID: CVE-2025-1078 State: PUBLISHED Published: 2025-02-06T17:00:16.524Z Last Updated: 2025-02-12T19:51:09.129Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: AppHouseKitchen Products: AlDente Charge Limiter Problem Types: CWE-285, CWE-266 Description: A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the function shouldAcceptNewConnection of the file com.apphousekitchen.aldente-pro.helper of the component XPC Service. The manipulation leads to improper authorization. It is possible to launch the attack on the local host. The exploit has been disclosed to the
to improper authorization. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.30 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294844 - https://vuldb.com/?ctiid.294844 - https://vuldb.com/?submit.492529 - https://winslow1984.com/books/cve-collection/page/aldente-charge-limiter-130-unauthorized-privileged-hardware-operations
CVE ID: CVE-2025-1079 State: PUBLISHED Published: 2025-05-12T20:03:09.061Z Last Updated: 2025-05-12T20:23:00.583Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Google Products: Web Designer Problem Types: CWE-61 Description: Client RCE on macOS and Linux via improper symbolic link resolution in Google Web Designer's preview feature Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://balintmagyar.com/articles/google-web-designer-symlink-client-side-rce-cve-2025-1079
CVE ID: CVE-2025-1080 State: PUBLISHED Published: 2025-03-04T20:04:10.946Z Last Updated: 2025-11-03T19:35:13.950Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-20 Description: LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1. Addit
os with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2025-1080
CVE ID: CVE-2025-1081 State: PUBLISHED Published: 2025-02-06T20:31:07.908Z Last Updated: 2025-02-12T19:41:08.602Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Bharti Airtel Products: Xstream Fiber Problem Types: CWE-1391 Description: A vulnerability was found in Bharti Airtel Xstream Fiber up to 20250123. It has been rated as problematic. This issue affects some unknown processing of the component WiFi Password Handler. The manipulation leads to use of weak credentials. The attack needs to be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and m
an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294857 - https://vuldb.com/?ctiid.294857 - https://vuldb.com/?submit.488582 - https://packetstorm.news/files/id/188799/
CVE ID: CVE-2025-1082 State: PUBLISHED Published: 2025-02-06T22:31:04.845Z Last Updated: 2025-02-07T15:59:29.820Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Mindskip Products: xzs-mysql 学之思开源考试系统 Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question/edit of the component Exam Edit Handler. The manipulation of the argument title/content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but d
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294858 - https://vuldb.com/?ctiid.294858 - https://vuldb.com/?submit.489633 - https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/StoredXSS-ExamEdit.md
CVE ID: CVE-2025-1083 State: PUBLISHED Published: 2025-02-06T23:00:11.019Z Last Updated: 2025-02-12T19:41:08.327Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Mindskip Products: xzs-mysql 学之思开源考试系统 Problem Types: CWE-942, CWE-346 Description: A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the component CORS Handler. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the
complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294859 - https://vuldb.com/?ctiid.294859 - https://vuldb.com/?submit.489634 - https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/OverlyPermissiveCORS-Multiple.md
CVE ID: CVE-2025-1084 State: PUBLISHED Published: 2025-02-06T23:31:04.582Z Last Updated: 2025-02-12T19:41:08.182Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Mindskip Products: xzs-mysql 学之思开源考试系统 Problem Types: CWE-352, CWE-862 Description: A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way. Additional
endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294860 - https://vuldb.com/?ctiid.294860 - https://vuldb.com/?submit.489644 - https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/CrossSiteRequestForgery-Multiple.md
CVE ID: CVE-2025-1085 State: PUBLISHED Published: 2025-02-07T00:00:17.837Z Last Updated: 2025-02-07T16:01:05.506Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Animati Products: PACS Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment:
contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294861 - https://vuldb.com/?ctiid.294861 - https://vuldb.com/?submit.489857
CVE ID: CVE-2025-1086 State: PUBLISHED Published: 2025-02-07T01:00:13.971Z Last Updated: 2025-02-07T16:00:53.053Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Safetytest Products: Cloud-Master Server Problem Types: CWE-24, CWE-23 Description: A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /static/. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional A
ublic and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294862 - https://vuldb.com/?ctiid.294862 - https://vuldb.com/?submit.491021
CVE ID: CVE-2025-1087 State: PUBLISHED Published: 2025-05-09T11:37:49.660Z Last Updated: 2025-09-17T13:48:50.101Z Vendors: Kong Inc. Products: Insomnia Problem Types: CWE-20, CWE-94 Description: Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability exists due to insufficient validation of user-supplied input when processing template strings, which can lead to arbitrary JavaScript execution in the context of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Kong/insomnia
CVE ID: CVE-2025-1088 State: PUBLISHED Published: 2025-06-18T09:54:30.329Z Last Updated: 2025-11-23T15:34:20.989Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Grafana Products: Grafana Problem Types: CWE-20 Description: In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2025-1088/
CVE ID: CVE-2025-1091 State: PUBLISHED Published: 2025-02-25T23:27:44.401Z Last Updated: 2025-02-26T15:43:26.749Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Tenable Products: Tenable Identity Exposure Problem Types: CWE-862 Description: A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2025-01
CVE ID: CVE-2025-1093 State: PUBLISHED Published: 2025-04-19T03:21:23.357Z Last Updated: 2025-04-21T02:43:50.427Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LiquidThemes Products: AI Hub - Startup & Technology WordPress Theme Problem Types: CWE-434 Description: The AIHub theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the generate_image function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/09adfe7e-f154-4143-827f-957ded3ffc8f?source=cve - https://themeforest.net/item/ai-hub-startup-technology-wordpress-theme/47473638
CVE ID: CVE-2025-1094 State: PUBLISHED Published: 2025-02-13T13:00:02.061Z Last Updated: 2025-03-14T03:55:17.849Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: PostgreSQL Problem Types: CWE-149 Description: Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in Pos
onstruct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.postgresql.org/support/security/CVE-2025-1094/
CVE ID: CVE-2025-1095 State: PUBLISHED Published: 2025-04-08T15:11:16.272Z Last Updated: 2025-09-29T15:29:18.930Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Personal Communications Problem Types: CWE-420 Description: IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to escalate their privileges. This vulnerability is due to an incomplete fix for CVE-2024-25029. Additional An
attacker to escalate their privileges. This vulnerability is due to an incomplete fix for CVE-2024-25029. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7230335
CVE ID: CVE-2025-1096 State: REJECTED Published: N/A Last Updated: 2025-02-08T00:13:24.732Z Description: No description available.
CVE ID: CVE-2025-1097 State: PUBLISHED Published: 2025-03-24T23:29:05.879Z Last Updated: 2025-11-03T20:57:02.247Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: kubernetes Products: ingress-nginx Problem Types: CWE-20 Description: A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) Additio
to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/131007
CVE ID: CVE-2025-1098 State: PUBLISHED Published: 2025-03-24T23:29:15.610Z Last Updated: 2025-11-03T20:57:03.818Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: kubernetes Products: ingress-nginx Problem Types: CWE-20 Description: A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secre
ure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/131008
CVE ID: CVE-2025-1099 State: PUBLISHED Published: 2025-02-10T10:44:26.274Z Last Updated: 2025-02-14T11:14:37.477Z Vendors: TP-Link Products: Tapo C500 V1 Wi-Fi Camera, Tapo C500 V2 Wi-Fi Camera Problem Types: CWE-321 Description: This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform impersonation, data decryption and man in the middle attacks on the targeted device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES0
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0017
CVE ID: CVE-2025-1100 State: PUBLISHED Published: 2025-02-12T13:26:02.042Z Last Updated: 2025-02-17T10:06:47.959Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-259 Description: A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to execute arbitrary code with root privileges via SSH. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1100
CVE ID: CVE-2025-1101 State: PUBLISHED Published: 2025-02-12T13:26:13.846Z Last Updated: 2025-02-17T10:07:13.153Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Q-Free Products: MaxTime Problem Types: CWE-204 Description: A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enumerate valid usernames via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1101
CVE ID: CVE-2025-1102 State: PUBLISHED Published: 2025-02-12T13:26:24.330Z Last Updated: 2025-02-17T10:07:19.039Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Q-Free Products: MaxTime Problem Types: CWE-346 Description: A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1102
CVE ID: CVE-2025-1103 State: PUBLISHED Published: 2025-02-07T15:00:10.453Z Last Updated: 2025-02-07T15:45:21.247Z Severity: N/A (CVSS 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C) Vendors: D-Link Products: DIR-823X Problem Types: CWE-476, CWE-404 Description: A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function set_wifi_blacklists of the file /goform/set_wifi_blacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vul
attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294933 - https://vuldb.com/?ctiid.294933 - https://vuldb.com/?submit.489603 - https://tasty-foxtrot-3a8.notion.site/D-link-DIR-823X-set_wifi_blacklists-Vulnerability-1870448e619580e5bf09cf628692f7a9?pvs=73 - https://www.dlink.com/
CVE ID: CVE-2025-1104 State: PUBLISHED Published: 2025-02-07T16:31:04.664Z Last Updated: 2025-02-07T16:41:57.418Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: D-Link Products: DHP-W310AV Problem Types: CWE-290, CWE-287 Description: A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authentication bypass by spoofing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294934 - https://vuldb.com/?ctiid.294934 - https://vuldb.com/?submit.489958 -
ment: References: - https://vuldb.com/?id.294934 - https://vuldb.com/?ctiid.294934 - https://vuldb.com/?submit.489958 - https://github.com/kn1g78/cve/blob/main/dlink.md - https://www.dlink.com/
CVE ID: CVE-2025-1105 State: PUBLISHED Published: 2025-02-07T18:00:15.963Z Last Updated: 2025-02-07T18:34:47.502Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: SiberianCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in SiberianCMS 4.20.6. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /app/sae/design/desktop/flat of the component HTTP GET Request Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additi
the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294938 - https://vuldb.com/?ctiid.294938 - https://vuldb.com/?submit.491207
CVE ID: CVE-2025-1106 State: PUBLISHED Published: 2025-02-07T18:31:04.414Z Last Updated: 2025-02-12T20:51:41.660Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: n/a Products: CmsEasy Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/database_admin.php. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
acted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294939 - https://vuldb.com/?ctiid.294939 - https://vuldb.com/?submit.491518 - https://github.com/Sinon2003/cve/blob/main/CmsEasy/CmsEasyPathTraversal-2.md
CVE ID: CVE-2025-1107 State: PUBLISHED Published: 2025-02-07T13:38:40.967Z Last Updated: 2025-02-12T20:51:40.689Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L) Vendors: Impronta Products: Janto Problem Types: CWE-620 Description: Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoint ‘/public/cgi/Gateway.php’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/avis