Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
kage fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:9184 - https://access.redhat.com/errata/RHSA-2025:9185 - https://access.redhat.com/errata/RHSA-202
.com/errata/RHSA-2025:9184 - https://access.redhat.com/errata/RHSA-2025:9185 - https://access.redhat.com/errata/RHSA-2025:9186 - https://access.redhat.com/errata/RHSA-2025:9187 - https://access.redhat.com/errata/RHSA-2025:9188 - https://access.redhat.com/errata/RHSA-2025:9189 - https://access.redhat.com/errata/RHSA-2025:9190 - https://access.redhat.com/errata/RHSA-2025:9191 - https://access.redhat.com/errata/RHSA-2025:9192 - https://access.redhat.com/errata/RHSA-2025:9193 - https://access.redhat.com/errata/RHSA-2025:9194 - https://access.redhat.com/security/cve/CVE-2025-4404 - https://bugzilla.redhat.com/show_bug.cgi?id=2364606 - https://pagure.io/freeipa/c/6b9400c135ed16b10057b350cc9ce42aa0
4 - https://bugzilla.redhat.com/show_bug.cgi?id=2364606 - https://pagure.io/freeipa/c/6b9400c135ed16b10057b350cc9ce42aa0e862d4 - https://pagure.io/freeipa/c/796ed20092d554ee0c9e23295e346ec1e8a0bf6e
CVE ID: CVE-2025-4405 State: PUBLISHED Published: 2025-05-22T09:21:51.336Z Last Updated: 2025-05-22T13:28:13.251Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hotwptemplates Products: Hot Random Image Problem Types: CWE-79 Description: The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analy
, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5cff14e-e891-4569-afd8-2885ebb26401?source=cve - https://wordpress.org/plugins/hot-random-image/#developers - https://plugins.trac.wordpress.org/browser/hot-random-image/tags/1.9.2/hot_random_image.php#L43 - https://plugins.trac.wordpress.org/changeset/3298033/
CVE ID: CVE-2025-4406 State: PUBLISHED Published: 2025-07-10T01:43:43.416Z Last Updated: 2025-07-10T13:12:51.603Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: tomdever Products: wpForo Forum Problem Types: CWE-79 Description: The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vu
ry web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05b15f33-0f95-458f-8c21-16c0dd98c8bc?source=cve - https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.5/includes/functions.php#L2177 - https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.5/includes/functions.php#L2139
CVE ID: CVE-2025-4407 State: PUBLISHED Published: 2025-06-30T11:16:39.556Z Last Updated: 2025-06-30T14:48:59.556Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: ABB Products: Lite Panel Pro Problem Types: CWE-613 Description: Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A2771&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE ID: CVE-2025-4410 State: PUBLISHED Published: 2025-08-13T01:49:47.629Z Last Updated: 2025-08-14T05:53:21.108Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Insyde Software Products: InsydeH2O Problem Types: CWE-20 Description: A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025005/
CVE ID: CVE-2025-4411 State: PUBLISHED Published: 2025-07-23T12:19:46.253Z Last Updated: 2025-07-23T12:56:07.954Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Dataprom Informatics Products: PACS-ACSS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dataprom Informatics PACS-ACSS allows Cross-Site Scripting (XSS).This issue affects PACS-ACSS: before 16.05.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0171
CVE ID: CVE-2025-4412 State: PUBLISHED Published: 2025-05-27T10:09:14.055Z Last Updated: 2025-06-06T07:16:17.650Z Vendors: SparkLabs Products: Viscosity Problem Types: CWE-276 Description: On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible to load a dynamic library with Viscosity's TCC (Transparency, Consent, and Control) identity. The acquired resource access is limited without entitlements such as access to the camera or microphone. Only user-granted permissions for file resources apply. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. T
ss to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 1.11.5 of Viscosity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/tcc-bypass/ - https://www.sparklabs.com/viscosity/
CVE ID: CVE-2025-4413 State: PUBLISHED Published: 2025-06-18T02:21:37.425Z Last Updated: 2025-06-18T14:57:43.040Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: byrev Products: Pixabay Images Problem Types: CWE-434 Description: The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabay_upload function in all versions up to, and including, 3.4. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/44e71dea-d736-49c2-a630-f42905ac6b4d?source=cve - https://plugins.trac.wordpress.org/browser/pixabay-images/trunk/pixabay-images.php#L177
CVE ID: CVE-2025-4414 State: PUBLISHED Published: 2025-07-04T11:17:50.701Z Last Updated: 2025-07-07T15:01:19.943Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cmsmasters Products: CMSMasters Content Composer Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer allows PHP Local File Inclusion. This issue affects CMSMasters Content Composer: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cmsmasters-content-composer/vulnerability/wor
lnrichment: References: - https://patchstack.com/database/wordpress/plugin/cmsmasters-content-composer/vulnerability/wordpress-cmsmasters-content-composer-2-5-7-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-4415 State: PUBLISHED Published: 2025-05-21T16:21:29.463Z Last Updated: 2025-05-21T16:43:21.185Z Vendors: Drupal Products: Piwik PRO Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-058
CVE ID: CVE-2025-4416 State: PUBLISHED Published: 2025-05-21T16:21:55.502Z Last Updated: 2025-05-21T16:44:33.564Z Vendors: Drupal Products: Events Log Track Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-059
CVE ID: CVE-2025-4417 State: PUBLISHED Published: 2025-06-12T19:32:32.628Z Last Updated: 2025-06-12T19:57:09.559Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N) Vendors: AVEVA Products: PI Connector for CygNet Problem Types: CWE-79 Description: A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that will be executed by other users who visit affected pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-2
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09 - https://www.aveva.com/en/support-and-success/cyber-security-updates/
CVE ID: CVE-2025-4418 State: PUBLISHED Published: 2025-06-12T19:37:46.740Z Last Updated: 2025-06-12T19:54:54.525Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: AVEVA Products: PI Connector for CygNet Problem Types: CWE-354 Description: An improper validation of integrity check value vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow a miscreant with elevated privileges to modify PI Connector for CygNet local data files (cache and buffers) in a way that causes the connector service to become unresponsive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-ev
ce to become unresponsive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09 - https://www.aveva.com/en/support-and-success/cyber-security-updates/
CVE ID: CVE-2025-4419 State: PUBLISHED Published: 2025-05-22T09:21:51.716Z Last Updated: 2025-05-22T13:25:38.181Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: hotwptemplates Products: Hot Random Image Problem Types: CWE-22 Description: The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to access arbitrary images with allowed extensions, outside of the originally intended directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/t
ginally intended directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d6628232-0bd1-4194-8322-36084b1eb0f7?source=cve - https://plugins.trac.wordpress.org/browser/hot-random-image/tags/1.9.2/hot_random_image.php#L57 - https://wordpress.org/plugins/hot-random-image/#developers - https://plugins.trac.wordpress.org/changeset/3298033/
CVE ID: CVE-2025-4420 State: PUBLISHED Published: 2025-06-03T08:21:53.379Z Last Updated: 2025-06-03T13:28:12.793Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themehunk Products: Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce Problem Types: CWE-79 Description: The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ parameter in all versions up to, and including, 1.3.1 due to a missing capability check on the vayu_blocks_option_panel_callback() function and insufficient input sanitization and output escaping. This makes it possible for authenticate
nel_callback() function and insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db01bc0a-4508-4fb5-941d-3f1a52528e2b?source=cve - https://plugins.trac.wordpress.org/browser/vayu-blocks/trunk/inc/admin-api.php#L6 - https://wordpress.org/plugins/vayu-blocks/#developers - https://plugins.trac.wordpress.org/changeset/3303594/
CVE ID: CVE-2025-4421 State: PUBLISHED Published: 2025-07-30T00:39:28.366Z Last Updated: 2025-08-14T05:57:27.258Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Insyde Software Products: InsydeH2O Problem Types: CWE-787 Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025007/ - https://support.lenovo.com/us/en/product_security/home
CVE ID: CVE-2025-4422 State: PUBLISHED Published: 2025-07-30T00:40:47.816Z Last Updated: 2025-08-14T05:57:12.813Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Insyde Software Products: InsydeH2O Problem Types: CWE-787 Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025007/ - https://support.lenovo.com/us/en/product_security/home
CVE ID: CVE-2025-4423 State: PUBLISHED Published: 2025-07-30T00:42:01.874Z Last Updated: 2025-08-14T05:56:57.880Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Insyde Software Products: InsydeH2O Problem Types: CWE-119 Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025007/ - https://support.lenovo.com/us/en/product_security/home
CVE ID: CVE-2025-4424 State: PUBLISHED Published: 2025-07-30T00:43:53.891Z Last Updated: 2025-08-14T05:56:42.244Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: Insyde Software Products: InsydeH2O Problem Types: CWE-20 Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025007/ - https://support.lenovo.com/us/en/product_security/home
CVE ID: CVE-2025-4425 State: PUBLISHED Published: 2025-07-30T00:45:32.592Z Last Updated: 2025-08-14T05:56:26.016Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Insyde Software Products: InsydeH2O Problem Types: CWE-121 Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025007/ - https://support.lenovo.com/us/en/product_security/home
CVE ID: CVE-2025-4426 State: PUBLISHED Published: 2025-07-30T00:46:27.918Z Last Updated: 2025-08-14T05:55:19.842Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: Insyde Software Products: InsydeH2O Problem Types: CWE-200 Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025007/ - https://support.lenovo.com/us/en/product_security/home
CVE ID: CVE-2025-4427 State: PUBLISHED Published: 2025-05-13T15:45:35.145Z Last Updated: 2025-10-21T22:55:16.170Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Ivanti Products: Endpoint Manager Mobile Problem Types: CWE-288 Description: An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
CVE ID: CVE-2025-4428 State: PUBLISHED Published: 2025-05-13T15:46:55.176Z Last Updated: 2025-10-21T22:55:16.012Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Mobile Problem Types: CWE-94 Description: Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
CVE ID: CVE-2025-4429 State: PUBLISHED Published: 2025-05-30T06:00:05.917Z Last Updated: 2025-05-30T14:02:30.756Z Vendors: Unknown Products: Gearside Developer Dashboard Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a487f5c9-7db6-4427-8d95-17acbfd49fd2/
CVE ID: CVE-2025-4430 State: PUBLISHED Published: 2025-05-14T10:36:38.378Z Last Updated: 2025-05-14T13:35:34.712Z Vendors: Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy Products: EZD RP Problem Types: CWE-862 Description: Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 (published on 22nd August 2024). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-4430/ - https://www.gov.pl/web/ezd-rp
CVE ID: CVE-2025-4431 State: PUBLISHED Published: 2025-05-30T07:23:40.575Z Last Updated: 2025-05-30T13:56:18.607Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: krasenslavov Products: Featured Image Plus – Quick & Bulk Edit with Unsplash Problem Types: CWE-284 Description: The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fip_save_attach_featured function in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update featured image of any post. Additional
e for authenticated attackers, with Subscriber-level access and above, to update featured image of any post. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/209341fa-6761-4bc4-a921-afa98495a087?source=cve - https://plugins.trac.wordpress.org/browser/featured-image-plus/trunk/inc/admin/block-editor/block-editor-actions.php#L204
CVE ID: CVE-2025-4432 State: PUBLISHED Published: 2025-05-09T16:06:33.671Z Last Updated: 2025-11-20T20:48:58.969Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat Satellite 6, Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer Problem Types: CWE-770 Description: A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sendin
red when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-4432 - https://bugzilla.redhat.com/show_bug.cgi?id=2350655 - https://github.com/briansmith/ring - https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05 - https://github.com/briansmith/ring/commit/ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38 - https://github.com/briansmith/ring/pull/2447 - https://rustsec.org/advisories/RUSTS
f1d91f148c84e4806b4f0b3c98f6df3b38 - https://github.com/briansmith/ring/pull/2447 - https://rustsec.org/advisories/RUSTSEC-2025-0009.html
CVE ID: CVE-2025-4433 State: PUBLISHED Published: 2025-05-30T12:16:03.245Z Last Updated: 2025-05-30T13:54:34.603Z Vendors: Devolutions Products: Server Problem Types: CWE-284 Description: Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to perform privilege escalation by adding users to groups with administrative privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0010/
CVE ID: CVE-2025-4434 State: REJECTED Published: 2025-05-09T01:42:35.570Z Last Updated: 2025-05-30T20:15:08.640Z Description: No description available.