Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-41402 State: PUBLISHED Published: 2025-10-23T03:38:22.200Z Last Updated: 2025-10-23T14:35:08.110Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Gallagher Products: Command Centre Server Problem Types: CWE-602 Description: Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://s
0.3672 (MR7), all versions of 9.00 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-41402
CVE ID: CVE-2025-41403 State: PUBLISHED Published: 2025-05-22T10:39:59.813Z Last Updated: 2025-05-22T18:13:43.312Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/cve-2025-41403.html
CVE ID: CVE-2025-41404 State: PUBLISHED Published: 2025-06-26T06:04:32.064Z Last Updated: 2025-06-26T13:19:09.569Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: iroha Soft Co., Ltd. Products: iroha Board Problem Types: CWE-425 Description: Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is exploited, non-public contents may be viewed by an attacker who can log in to the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://irohaboard.irohasoft.jp/security/ - https://jvn.jp/en/jp/JVN92520966/
CVE ID: CVE-2025-41406 State: PUBLISHED Published: 2025-05-30T06:36:08.387Z Last Updated: 2025-05-30T12:19:09.713Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: UCHIDA YOKO CO., LTD. Products: wivia 5 Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specific operation, an arbitrary script may be executed on the web browser of the moderator user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.uchida.co.jp/wivia/support02.html - https://jvn.jp/en/jp/JVN51394666/
CVE ID: CVE-2025-41407 State: PUBLISHED Published: 2025-05-23T10:29:58.652Z Last Updated: 2025-05-23T11:57:14.276Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/cve-2025-41407.html
CVE ID: CVE-2025-41408 State: PUBLISHED Published: 2025-09-05T05:25:15.422Z Last Updated: 2025-09-05T13:45:13.400Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: LY Corporation Products: "Yahoo! Shopping" App for Android Problem Types: CWE-939 Description: Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN35290164/
CVE ID: CVE-2025-41410 State: PUBLISHED Published: 2025-10-16T08:39:58.233Z Last Updated: 2025-10-16T14:00:19.181Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-41413 State: PUBLISHED Published: 2025-06-17T20:22:05.902Z Last Updated: 2025-06-18T14:57:14.635Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Smart Editor Problem Types: CWE-787 Description: Fuji Electric Smart Editor is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-04
CVE ID: CVE-2025-41414 State: PUBLISHED Published: 2025-05-07T22:04:09.501Z Last Updated: 2025-05-08T13:06:27.107Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next SPK, BIG-IP Next CNF Problem Types: CWE-476 Description: When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000140968
CVE ID: CVE-2025-41415 State: PUBLISHED Published: 2025-08-21T19:57:26.099Z Last Updated: 2025-08-21T20:13:40.413Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: AVEVA Products: PI Integrator Problem Types: CWE-201 Description: The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to access publication targets) to retrieve sensitive information that could then be used to gain additional access to downstream resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf - https://www.cisa.gov/new
ontent/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04
CVE ID: CVE-2025-41418 State: PUBLISHED Published: 2025-06-27T05:24:04.762Z Last Updated: 2025-06-30T18:40:24.266Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: TB-eye Ltd. Products: XRN-410SN/TE, XRN-810SN/TE, XRN-1610SN/TE, PRN-4011N/TE, HRX-421FN/TE, HRX-821/TE, HRX-1621/TE, HRX-435FN/TE, HRX-835/TE, HRX-1635/TE, XRN-425SFN/TE, XRN-426S, XRN-820S/TE, XRN-1620S/TE, XRN-3210R/TE, XRN-6410R/TE, XRN-6410DR/TE Problem Types: CWE-120 Description: Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders. The CGI process may be terminated abnormally by processing a specially crafted request. Additional Analyst Note
corders. The CGI process may be terminated abnormally by processing a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tbeye.com/topics/ahd/ - https://jvn.jp/en/vu/JVNVU93396297/
CVE ID: CVE-2025-41420 State: PUBLISHED Published: 2025-07-24T15:11:00.461Z Last Updated: 2025-11-03T19:58:56.015Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-79 Description: A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_rep
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2209
CVE ID: CVE-2025-41421 State: PUBLISHED Published: 2025-10-01T13:48:38.754Z Last Updated: 2025-10-01T13:59:17.408Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: TeamViewer Products: Full Client, Host Problem Types: CWE-59 Description: Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
s may result in unauthorized access to sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1004/
CVE ID: CVE-2025-41423 State: PUBLISHED Published: 2025-04-24T06:50:12.214Z Last Updated: 2025-04-24T13:06:53.385Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-
propriate permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-41425 State: PUBLISHED Published: 2025-07-22T21:38:45.479Z Last Updated: 2025-07-23T19:57:18.417Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: DuraComm Corporation Products: SPM-500 DP-10iN-100-MU Problem Types: CWE-79 Description: DuraComm SPM-500 DP-10iN-100-MU is vulnerable to a cross-site scripting attack. This could allow an attacker to prevent legitimate users from accessing the web interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-01 - https://duracomm.com/contact-us/
CVE ID: CVE-2025-41426 State: PUBLISHED Published: 2025-05-21T19:22:29.596Z Last Updated: 2025-05-21T19:50:52.897Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Vertiv Products: Liebert RDU101, Liebert IS-UNITY Problem Types: CWE-121 Description: Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code execution on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-10 - https://www.vertiv.com/en-us/support/security-support-center/
CVE ID: CVE-2025-41427 State: PUBLISHED Published: 2025-06-24T04:37:09.818Z Last Updated: 2025-06-25T12:42:52.339Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ELECOM CO.,LTD. Products: WRC-X3000GS, WRC-X3000GSA, WRC-X3000GSN Problem Types: CWE-78 Description: WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Connection Diagnostics page. If a remote authenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.
, an arbitrary OS command may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20250624-01/ - https://jvn.jp/en/jp/JVN39435597/
CVE ID: CVE-2025-41428 State: PUBLISHED Published: 2025-06-03T08:09:40.730Z Last Updated: 2025-06-03T13:31:54.645Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Keiyo System Co., LTD Products: TimeWorks Problem Types: CWE-22 Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in TimeWorks 10.0 to 10.3. If exploited, arbitrary JSON files on the server may be viewed by a remote unauthenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.keiyo-system.co.jp/archives/11310 - https://jvn.jp/en/jp/JVN37075430/
CVE ID: CVE-2025-41429 State: PUBLISHED Published: 2025-05-19T08:07:38.068Z Last Updated: 2025-05-19T15:46:29.408Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: appleple inc. Products: a-blog cms Problem Types: CWE-117 Description: a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a legitimate user's session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVNVU-90760614.html - https://jvn.jp/en/vu/JVNVU90760614/
CVE ID: CVE-2025-41430 State: PUBLISHED Published: 2025-10-15T13:55:48.081Z Last Updated: 2025-10-16T03:56:30.879Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, SSL Orchestrator Problem Types: CWE-770 Description: When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000150667
CVE ID: CVE-2025-41431 State: PUBLISHED Published: 2025-05-07T22:04:11.279Z Last Updated: 2025-05-08T13:03:33.148Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-787 Description: When connection mirroring is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate in the standby BIG-IP systems in a traffic group. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000150668
CVE ID: CVE-2025-41433 State: PUBLISHED Published: 2025-05-07T22:04:09.139Z Last Updated: 2025-05-08T13:23:07.562Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-476 Description: When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K0001
not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000140937
CVE ID: CVE-2025-41436 State: PUBLISHED Published: 2025-11-14T08:00:42.467Z Last Updated: 2025-11-14T15:48:31.081Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-41437 State: PUBLISHED Published: 2025-06-09T10:44:08.879Z Last Updated: 2025-06-09T16:22:33.279Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: ManageEngine Products: OpManager Problem Types: CWE-79 Description: Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/itom/advisory/cve-2025-41437.html
CVE ID: CVE-2025-41438 State: PUBLISHED Published: 2025-05-29T23:17:18.012Z Last Updated: 2025-05-30T12:50:16.987Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Consilium Safety Products: CS5000 Fire Panel Problem Types: CWE-1188 Description: The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely impact the device's operation if exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ci
act the device's operation if exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-03 - https://www.consiliumsafety.com/en/support/
CVE ID: CVE-2025-41439 State: PUBLISHED Published: 2025-06-30T09:16:19.377Z Last Updated: 2025-06-30T15:12:29.712Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Ricoh Company, Ltd. Products: RICOH Streamline NX Problem Types: CWE-79 Description: A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of the user who accessed the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000008 - https://jvn
lnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000008 - https://jvn.jp/en/jp/JVN24333956/
CVE ID: CVE-2025-41441 State: PUBLISHED Published: 2025-05-26T06:27:12.284Z Last Updated: 2025-05-27T13:38:28.814Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SYNCK GRAPHICA Products: Mailform Pro CGI Problem Types: CWE-209 Description: Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon codes. This vulnerability only affects products that use the coupon feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synck.com/blogs/news/newsroom/detail_1745302910.html - https://jvn.jp/en/jp/JVN39546799/
CVE ID: CVE-2025-41442 State: PUBLISHED Published: 2025-07-10T23:15:27.981Z Last Updated: 2025-07-11T17:50:31.478Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Advantech Products: iView Problem Types: CWE-79 Description: A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisor
ctivities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183
CVE ID: CVE-2025-41443 State: PUBLISHED Published: 2025-10-16T08:10:40.582Z Last Updated: 2025-10-29T08:06:29.837Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-41444 State: PUBLISHED Published: 2025-06-09T11:14:58.186Z Last Updated: 2025-06-09T13:05:30.719Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: ManageEngine Products: ADAudit Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/active-directory-audit/cve-2025-41444.html
CVE ID: CVE-2025-41450 State: PUBLISHED Published: 2025-05-08T09:41:20.881Z Last Updated: 2025-08-27T07:14:14.846Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H) Vendors: Danfoss Products: AK-SM 8xxA Series Problem Types: CWE-305 Description: Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/
CVE ID: CVE-2025-41451 State: PUBLISHED Published: 2025-08-22T02:40:46.216Z Last Updated: 2025-08-22T11:25:28.640Z Vendors: Danfoss Products: AK-SM8xxA Series Problem Types: CWE-77 Description: Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.danfoss.com/en/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a/#tab-overview
CVE ID: CVE-2025-41452 State: PUBLISHED Published: 2025-08-22T02:40:53.563Z Last Updated: 2025-08-22T10:52:36.122Z Vendors: Danfoss Products: AK-SM8xxA Series Problem Types: CWE-15 Description: Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.danfoss.com/en/service-and-support/downloads/dcs/adap-kool-software/ak-sm-800a/#tab-overview
CVE ID: CVE-2025-41458 State: PUBLISHED Published: 2025-07-21T11:01:13.982Z Last Updated: 2025-07-21T12:28:22.467Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Two App Studio Products: Journey Problem Types: CWE-312 Description: Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cirosec.de/sa/sa-2025-005
CVE ID: CVE-2025-41459 State: PUBLISHED Published: 2025-07-21T11:01:29.417Z Last Updated: 2025-08-27T06:34:27.134Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Two App Studio Products: Journey Problem Types: CWE-287 Description: Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN attempts or dynamic code injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cirosec.de/sa/sa-2025-006