Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22829 State: PUBLISHED Published: 2025-06-10T23:11:24.828Z Last Updated: 2025-06-11T13:53:45.517Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-269 Description: The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations. Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue
plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloudstack.staged.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0 - https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/ - https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60
CVE ID: CVE-2025-22830 State: PUBLISHED Published: 2025-08-12T14:02:50.803Z Last Updated: 2025-08-12T14:40:09.250Z Vendors: AMI Products: AptioV Problem Types: CWE-362 Description: APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A successful exploitation of this vulnerability may lead to resource exhaustion and impact Confidentiality, Integrity, and Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025006.pdf
CVE ID: CVE-2025-22831 State: PUBLISHED Published: 2025-10-14T14:00:34.748Z Last Updated: 2025-10-14T18:51:10.280Z Vendors: AMI Products: AptioV Problem Types: CWE-787 Description: APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf
CVE ID: CVE-2025-22832 State: PUBLISHED Published: 2025-10-14T14:00:42.309Z Last Updated: 2025-10-14T18:51:36.347Z Vendors: AMI Products: AptioV Problem Types: CWE-787 Description: APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf
CVE ID: CVE-2025-22833 State: PUBLISHED Published: 2025-10-14T14:00:50.483Z Last Updated: 2025-10-14T18:51:56.528Z Vendors: AMI Products: AptioV Problem Types: CWE-787 Description: APTIOV contains a vulnerability in BIOS where an attacker may cause a Buffer Copy without Checking Size of Input by local accessing. Successful exploitation of this vulnerability may lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025008.pdf
CVE ID: CVE-2025-22834 State: PUBLISHED Published: 2025-08-12T14:02:14.354Z Last Updated: 2025-08-12T14:37:37.856Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: AMI Products: AptioV Problem Types: CWE-665 Description: AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Successful exploitation of this vulnerability may leave the resource in an unexpected state and potentially impact confidentiality, integrity, and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025006.pdf
CVE ID: CVE-2025-22835 State: PUBLISHED Published: 2025-03-04T03:44:39.777Z Last Updated: 2025-03-11T16:10:11.459Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-787 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE ID: CVE-2025-22836 State: PUBLISHED Published: 2025-08-12T16:58:32.833Z Last Updated: 2025-08-14T03:55:51.337Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) 800 Series Ethernet Problem Types: Escalation of Privilege, CWE-190 Description: Integer overflow or wraparound in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01296.html
CVE ID: CVE-2025-22837 State: PUBLISHED Published: 2025-03-04T03:44:40.887Z Last Updated: 2025-03-04T14:23:25.615Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-476 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE ID: CVE-2025-22838 State: PUBLISHED Published: 2025-08-12T16:58:34.496Z Last Updated: 2025-08-12T20:50:49.202Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) RealSense(TM) Dynamic Calibrator software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) RealSense(TM) Dynamic Calibrator software before version 2.14.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01318.html
CVE ID: CVE-2025-22839 State: PUBLISHED Published: 2025-08-12T16:58:36.355Z Last Updated: 2025-11-03T17:32:11.118Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: n/a Products: Intel(R) Xeon(R) 6 Scalable processors Problem Types: Escalation of Privilege, CWE-1220 Description: Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01310.html
CVE ID: CVE-2025-22840 State: PUBLISHED Published: 2025-08-12T16:58:37.844Z Last Updated: 2025-11-03T17:32:12.054Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: n/a Products: Intel(R) Xeon(R) 6 Scalable processors Problem Types: Escalation of Privilege, CWE-1281 Description: Sequence of processor instructions leads to unexpected behavior for some Intel(R) Xeon(R) 6 Scalable processors may allow an authenticated user to potentially enable escalation of privilege via local access Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01308.html
CVE ID: CVE-2025-22841 State: PUBLISHED Published: 2025-03-04T03:44:42.029Z Last Updated: 2025-03-04T14:22:40.440Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE ID: CVE-2025-22842 State: PUBLISHED Published: 2025-04-07T02:35:35.271Z Last Updated: 2025-04-07T13:32:50.035Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md
CVE ID: CVE-2025-22843 State: PUBLISHED Published: 2025-05-13T21:02:39.645Z Last Updated: 2025-05-15T04:01:55.525Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Edge Orchestrator software for Intel(R) Tiber™ Edge Platform Problem Types: Escalation of Privilege, CWE-279 Description: Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01239.html
CVE ID: CVE-2025-22844 State: PUBLISHED Published: 2025-05-13T21:02:41.122Z Last Updated: 2025-05-14T13:55:11.853Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Edge Orchestrator software for Intel(R) Tiber™ Edge Platform Problem Types: Information Disclosure, CWE-284 Description: Improper access control for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an unauthenticated user to potentially enable information disclosure via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01239.html
CVE ID: CVE-2025-22846 State: PUBLISHED Published: 2025-02-05T17:31:04.163Z Last Updated: 2025-02-12T20:51:34.054Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next SPK Problem Types: CWE-404 Description: When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000139780
CVE ID: CVE-2025-22847 State: PUBLISHED Published: 2025-03-04T03:44:43.174Z Last Updated: 2025-03-04T14:21:38.257Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE ID: CVE-2025-22848 State: PUBLISHED Published: 2025-05-13T21:02:43.550Z Last Updated: 2025-05-14T13:54:46.638Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Edge Orchestrator software for Intel(R) Tiber™ Edge Platform Problem Types: Denial of Service, CWE-754 Description: Improper conditions check for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01239.html
CVE ID: CVE-2025-22851 State: PUBLISHED Published: 2025-04-07T02:35:39.555Z Last Updated: 2025-04-07T14:20:58.087Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-190 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md
CVE ID: CVE-2025-22853 State: PUBLISHED Published: 2025-08-12T16:58:39.412Z Last Updated: 2025-08-14T03:55:10.191Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: Intel(R) TDX Problem Types: Escalation of Privilege, CWE-662 Description: Improper synchronization in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01312.html
CVE ID: CVE-2025-22854 State: PUBLISHED Published: 2025-06-15T15:00:06.010Z Last Updated: 2025-06-16T18:07:39.037Z Vendors: Ping Identity Products: PingFederate Problem Types: CWE-394 Description: Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.pingidentity.com/en/resources/downloads/pingfederate.html - https://docs.pingidentity.com/integrations/google/google_login_integration_kit/pf_google_cic_changelog.html
CVE ID: CVE-2025-22855 State: PUBLISHED Published: 2025-04-08T14:02:44.119Z Last Updated: 2025-04-08T14:47:47.378Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-79 Description: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-344
CVE ID: CVE-2025-22859 State: PUBLISHED Published: 2025-05-13T14:46:42.743Z Last Updated: 2025-05-13T15:17:40.699Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-23 Description: A Relative Path Traversal vulnerability [CWE-23] in FortiClientEMS 7.4.0 through 7.4.1 and FortiClientEMS Cloud 7.4.0 through 7.4.1 may allow a remote unauthenticated attacker to perform a limited arbitrary file write on the system via upload requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-552
CVE ID: CVE-2025-22860 State: REJECTED Published: N/A Last Updated: 2025-08-23T02:55:12.473Z Description: No description available.
CVE ID: CVE-2025-22861 State: REJECTED Published: N/A Last Updated: 2025-08-23T02:55:12.023Z Description: No description available.
CVE ID: CVE-2025-22862 State: PUBLISHED Published: 2025-10-02T12:48:41.208Z Last Updated: 2025-10-15T13:40:09.175Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-288 Description: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component. Additional Analyst Notes:
heir privileges via triggering a malicious Webhook action in the Automation Stitch component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-385
CVE ID: CVE-2025-22863 State: REJECTED Published: N/A Last Updated: 2025-08-23T02:55:11.559Z Description: No description available.
CVE ID: CVE-2025-22864 State: REJECTED Published: N/A Last Updated: 2025-08-23T02:55:11.066Z Description: No description available.
CVE ID: CVE-2025-22865 State: PUBLISHED Published: 2025-01-28T01:03:25.121Z Last Updated: 2025-01-30T19:14:21.959Z Vendors: Go standard library Products: crypto/x509 Problem Types: CWE-228: Improper Handling of Syntactically Invalid Structure Description: Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.dev/cl/643098 - https://go.dev/issue/71216 - https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ - https://pkg.go.dev/vuln/GO-2025-3421
CVE ID: CVE-2025-22866 State: PUBLISHED Published: 2025-02-06T16:54:10.252Z Last Updated: 2025-02-21T18:03:36.215Z Vendors: Go standard library Products: crypto/internal/nistec Problem Types: CWE-208: Observable Timing Discrepancy Description: Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl
n protocols. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/643735 - https://go.dev/issue/71383 - https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k - https://pkg.go.dev/vuln/GO-2025-3447
CVE ID: CVE-2025-22867 State: PUBLISHED Published: 2025-02-06T17:09:56.893Z Last Updated: 2025-02-06T21:23:25.105Z Vendors: Go toolchain Products: cmd/go Problem Types: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive. This issue only affected go1.24rc2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.dev/cl/646996 - https://go.dev/issue/71476 - https://groups.google.com/g/golang-de
ulnrichment: References: - https://go.dev/cl/646996 - https://go.dev/issue/71476 - https://groups.google.com/g/golang-dev/c/TYzikTgHK6Y - https://pkg.go.dev/vuln/GO-2025-3428
CVE ID: CVE-2025-22868 State: PUBLISHED Published: 2025-02-26T03:07:49.012Z Last Updated: 2025-02-26T14:46:20.671Z Vendors: golang.org/x/oauth2 Products: golang.org/x/oauth2/jws Problem Types: CWE-1286: Improper Validation of Syntactic Correctness of Input Description: An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.dev/cl/652155 - https://go.dev/issue/71490 - https://pkg.go.dev/vuln/GO-2025-3488
CVE ID: CVE-2025-22869 State: PUBLISHED Published: 2025-02-26T03:07:48.855Z Last Updated: 2025-04-11T22:03:24.222Z Vendors: golang.org/x/crypto Products: golang.org/x/crypto/ssh Problem Types: CWE-770: Allocation of Resources Without Limits or Throttling Description: SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/652135 - https://go.dev/issue/71931 - https://pkg.go.dev/vuln/GO-2025-3487
CVE ID: CVE-2025-22870 State: PUBLISHED Published: 2025-03-12T18:27:59.376Z Last Updated: 2025-05-09T20:03:37.043Z Vendors: golang.org/x/net Products: golang.org/x/net/http/httpproxy, golang.org/x/net/proxy Problem Types: CWE-115 Misinterpretation of Input Description: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/cl/654697 - https://go.dev/issue/71984 - https://pkg.go.dev/v
ner: - CISA ADP Vulnrichment: References: - https://go.dev/cl/654697 - https://go.dev/issue/71984 - https://pkg.go.dev/vuln/GO-2025-3503
CVE ID: CVE-2025-22871 State: PUBLISHED Published: 2025-04-08T20:04:34.769Z Last Updated: 2025-04-18T14:57:31.331Z Vendors: Go standard library Products: net/http/internal Problem Types: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Description: The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/cl/652998 - https://go.dev/issue/71988 - https://groups.go
tainer: - CISA ADP Vulnrichment: References: - https://go.dev/cl/652998 - https://go.dev/issue/71988 - https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk - https://pkg.go.dev/vuln/GO-2025-3563
CVE ID: CVE-2025-22872 State: PUBLISHED Published: 2025-04-16T17:13:02.550Z Last Updated: 2025-05-16T23:03:07.693Z Vendors: golang.org/x/net Products: golang.org/x/net/html Problem Types: CWE-79 Description: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts). Additional Analyst Notes: - CISA ADP Vuln
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/662715 - https://go.dev/issue/73070 - https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA - https://pkg.go.dev/vuln/GO-2025-3595
CVE ID: CVE-2025-22874 State: PUBLISHED Published: 2025-06-11T16:42:52.856Z Last Updated: 2025-06-16T20:26:53.242Z Vendors: Go standard library Products: crypto/x509 Problem Types: CWE-295: Improper Certificate Validation Description: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.dev/cl/670375 - https://go.dev/issue/73612 - https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A - https://pkg.go.dev/vuln/GO-2025-3749
CVE ID: CVE-2025-22880 State: PUBLISHED Published: 2025-02-07T07:26:04.691Z Last Updated: 2025-02-07T15:54:27.041Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: CNCSoft-G2 Problem Types: CWE-122 Description: Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCS
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00002_CNCSoft-G2%20-%20Heap-based%20Buffer%20Overflow_v1.pdf