Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-13588 State: PUBLISHED Published: 2025-11-24T06:32:06.723Z Last Updated: 2025-11-24T13:49:41.734Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: lKinderBueno Products: Streamity Xtream IPTV Player Problem Types: CWE-918 Description: A vulnerability was found in lKinderBueno Streamity Xtream IPTV Player up to 2.8. The impacted element is an unknown function of the file public/proxy.php. Performing manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 2.8.1 is sufficient to resolve this issue. The patch is named c70bfb8d36b47bfd64c5ec7391
d be used. Upgrading to version 2.8.1 is sufficient to resolve this issue. The patch is named c70bfb8d36b47bfd64c5ec73917e1d9ddb97af92. It is suggested to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.333352 - https://vuldb.com/?ctiid.333352 - https://vuldb.com/?submit.687573 - https://github.com/lakshayyverma/CVE-Discovery/blob/main/Streamity.md - https://github.com/lKinderBueno/Streamity-Xtream-IPTV-Web-player/commit/c70bfb8d36b47bfd64c5ec73917e1d9ddb97af92 - https://github.com/lKinderBueno/Streamity-Xtream-IPTV-Web-player/releases/tag/v2.8.1
CVE ID: CVE-2025-13589 State: PUBLISHED Published: 2025-11-24T03:09:02.230Z Last Updated: 2025-11-24T16:04:29.829Z Vendors: Otsuka Information Technology Products: FMS Problem Types: CWE-79 Description: FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10520-03f29-1.html - https://www.twcert.org.tw/en/cp-139-10521-abdc1-2.html
CVE ID: CVE-2025-13594 State: REJECTED Published: N/A Last Updated: 2025-11-24T16:24:58.972Z Description: No description available.
CVE ID: CVE-2025-13596 State: PUBLISHED Published: 2025-11-24T07:30:49.545Z Last Updated: 2025-11-24T13:47:44.911Z Vendors: ATISoluciones Products: CIGES Problem Types: CWE-209, CWE-200 Description: A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Application version 2.15.6 and earlier. When certain unexpected conditions trigger unhandled exceptions, the application returns detailed error messages and stack traces to the client. This may expose internal filesystem paths, SQL queries, database connection details, or environment configuration data to remote unauthenticated attackers. This issue allows information gathering and recon
or environment configuration data to remote unauthenticated attackers. This issue allows information gathering and reconnaissance but does not enable direct system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.atisoluciones.com/incidentes-cve
CVE ID: CVE-2025-13598 State: REJECTED Published: N/A Last Updated: 2025-11-24T14:32:18.570Z Description: No description available.
CVE ID: CVE-2025-13609 State: PUBLISHED Published: 2025-11-24T18:08:56.048Z Last Updated: 2025-11-24T23:11:55.608Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 Problem Types: CWE-694 Description: A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls. Additional
dentity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-13609 - https://bugzilla.redhat.com/show_bug.cgi?id=2416761
CVE ID: CVE-2025-13643 State: PUBLISHED Published: 2025-11-25T05:16:24.472Z Last Updated: 2025-11-25T05:16:24.472Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-862 Description: A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14 References: - https://jira.mongodb.org/browse/SERVER-103582
CVE ID: CVE-2025-13644 State: PUBLISHED Published: 2025-11-25T05:23:12.317Z Last Updated: 2025-11-25T05:23:12.317Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-617 Description: MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2 Referen
s prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2 References: - https://jira.mongodb.org/browse/SERVER-101180
CVE ID: CVE-2025-1000 State: PUBLISHED Published: 2025-05-05T20:55:46.335Z Last Updated: 2025-11-03T19:35:12.546Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-770 Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when connecting to a z/OS database due to improper handling of automatic client rerouting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7232528
CVE ID: CVE-2025-1001 State: PUBLISHED Published: 2025-02-21T00:48:52.489Z Last Updated: 2025-02-21T21:28:49.043Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Medixant Products: RadiAnt DICOM Viewer Problem Types: CWE-295 Description: Medixant RadiAnt DICOM Viewer is vulnerable due to failure of the update mechanism to verify the update server's certificate which could allow an attacker to alter network traffic and carry out a machine-in-the-middle attack (MITM). An attacker could modify the server's response and deliver a malicious update to the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-me
te to the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-051-01 - https://www.radiantviewer.com/files/RadiAnt-2025.1-Setup.exe
CVE ID: CVE-2025-1002 State: PUBLISHED Published: 2025-02-10T20:32:22.730Z Last Updated: 2025-02-10T20:45:35.260Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: MicroDicom Products: DICOM Viewer Problem Types: CWE-295 Description: MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged network position to alter network traffic and carry out a machine-in-the-middle (MITM) attack. This allows the attackers to modify the server's response and deliver a malicious update to the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.c
d deliver a malicious update to the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-037-01
CVE ID: CVE-2025-1003 State: PUBLISHED Published: 2025-02-03T23:56:35.322Z Last Updated: 2025-02-04T15:44:21.943Z Vendors: HP, Inc. Products: HP Anyware Linux Agent Problem Types: CWE-273 Description: A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass which may result in escalation of privilege. HP is releasing a software update to mitigate this potential vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11920613-11920636-16
CVE ID: CVE-2025-1004 State: PUBLISHED Published: 2025-02-06T21:02:18.072Z Last Updated: 2025-02-12T19:41:08.471Z Vendors: HP Inc. Products: Certain HP LaserJet Pro Printers Problem Types: CWE-241 Description: Certain HP LaserJet Pro printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer via IPP (Internet Printing Protocol). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/au-en/document/ish_11927586-11927615-16/hpsbpi03998
CVE ID: CVE-2025-1005 State: PUBLISHED Published: 2025-02-15T09:24:22.205Z Last Updated: 2025-02-18T21:19:59.272Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor addons Problem Types: CWE-79 Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion widget in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exe
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b74d6aa-ad59-42be-b454-9c27428cab01?source=cve - https://plugins.trac.wordpress.org/browser/elementskit-lite/trunk/modules/layout-manager/assets/js/ekit-layout-library.js - https://wordpress.org/plugins/elementskit-lite/#developers - https://plugins.trac.wordpress.org/changeset?old_path=%2Felementskit-lite&old=3230214&new_path=%2Felementskit-lite&new=3237243&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1006 State: PUBLISHED Published: 2025-02-19T16:55:31.747Z Last Updated: 2025-02-19T20:09:48.316Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html - https://issues.chromium.org/issues/390590778
CVE ID: CVE-2025-1007 State: PUBLISHED Published: 2025-02-19T08:40:58.325Z Last Updated: 2025-02-19T19:36:50.732Z Vendors: Eclipse Foundation Products: OpenVSX Problem Types: CWE-285, CWE-283 Description: In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/eclipse/openvsx/security/advisori
o. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4h
CVE ID: CVE-2025-1008 State: PUBLISHED Published: 2025-03-05T08:21:56.627Z Last Updated: 2025-03-05T14:58:37.868Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: worldweb Products: Recently Purchased Products For Woo Problem Types: CWE-79 Description: The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebcd32-90c1-419c-a67c-6fe41ee9fab1?source=cve - https://plugins.trac.wordpress.org/browser/recently-purchased-products-for-woo/tags/1.1.3/includes/class-rppw-public.php#L160 - https://wordpress.org/plugins/recently-purchased-products-for-woo/#developers
CVE ID: CVE-2025-1009 State: PUBLISHED Published: 2025-02-04T13:58:51.928Z Last Updated: 2025-11-03T20:56:46.086Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free in XSLT Description: An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1936613 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/sec
lla.org/show_bug.cgi?id=1936613 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-08/ - https://www.mozilla.org/security/advisories/mfsa2025-09/ - https://www.mozilla.org/security/advisories/mfsa2025-10/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1010 State: PUBLISHED Published: 2025-02-04T13:58:52.357Z Last Updated: 2025-11-03T20:56:48.887Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free in Custom Highlight Description: An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1936982 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://
tps://bugzilla.mozilla.org/show_bug.cgi?id=1936982 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-08/ - https://www.mozilla.org/security/advisories/mfsa2025-09/ - https://www.mozilla.org/security/advisories/mfsa2025-10/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1011 State: PUBLISHED Published: 2025-02-04T13:58:53.239Z Last Updated: 2025-11-03T20:56:51.660Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: A bug in WebAssembly code generation could result in a crash Description: A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1936454 - https://www.mozilla.org/security/
rogram Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1936454 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-09/ - https://www.mozilla.org/security/advisories/mfsa2025-10/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1012 State: PUBLISHED Published: 2025-02-04T13:58:53.687Z Last Updated: 2025-11-03T20:56:54.541Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free during concurrent delazification Description: A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1939710 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisor
bug.cgi?id=1939710 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-08/ - https://www.mozilla.org/security/advisories/mfsa2025-09/ - https://www.mozilla.org/security/advisories/mfsa2025-10/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1013 State: PUBLISHED Published: 2025-02-04T13:58:54.445Z Last Updated: 2025-11-03T20:56:55.953Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Potential opening of private browsing tabs in normal browsing windows Description: A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1932555 - https://www.mozilla.org
t: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1932555 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-09/ - https://www.mozilla.org/security/advisories/mfsa2025-10/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1014 State: PUBLISHED Published: 2025-02-04T13:58:54.940Z Last Updated: 2025-11-03T20:56:57.329Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Certificate length was not properly checked Description: Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1940804 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozill
illa.mozilla.org/show_bug.cgi?id=1940804 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-09/ - https://www.mozilla.org/security/advisories/mfsa2025-10/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1015 State: PUBLISHED Published: 2025-02-04T13:58:56.867Z Last Updated: 2025-03-10T18:41:26.138Z Vendors: Mozilla Products: Thunderbird Problem Types: Unsanitized address book fields Description: The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability affects Thunderbird < 128.7 and Thunderbird
d, and that page could execute (unprivileged) JavaScript. This vulnerability affects Thunderbird < 128.7 and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1939458 - https://www.mozilla.org/security/advisories/mfsa2025-10/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1016 State: PUBLISHED Published: 2025-02-04T13:58:55.672Z Last Updated: 2025-11-03T20:56:58.724Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 Description: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 11
ome of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1936601%2C1936844%2C1937694%2C1938469%2C1939583%2C1940994 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-08/ - https://www.mozilla.org/security/advisories/mfsa2025-09/ - https://www.mozilla.org/security/advisories/mfsa2025-10/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1017 State: PUBLISHED Published: 2025-02-04T13:58:56.028Z Last Updated: 2025-11-03T20:57:00.637Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 Description: Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Additional Analyst Notes: - CIS
affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1926256%2C1935984%2C1935471 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-09/ - https://www.mozilla.org/security/advisories/mfsa2025-10/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1018 State: PUBLISHED Published: 2025-02-04T13:58:52.807Z Last Updated: 2025-02-05T16:18:00.922Z Vendors: Mozilla Products: Firefox, Thunderbird Problem Types: Fullscreen notification is not displayed when fullscreen is re-requested Description: The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability affects Firefox < 135 and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1910818 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.
la.mozilla.org/show_bug.cgi?id=1910818 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-11/