Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-41242 State: PUBLISHED Published: 2025-08-18T08:47:07.427Z Last Updated: 2025-08-25T18:14:59.837Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: VMware Products: Spring Framework Description: Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the appl
quences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://spring.io/security/cve-20
ding your application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://spring.io/security/cve-2025-41242
CVE ID: CVE-2025-41243 State: PUBLISHED Published: 2025-09-16T14:54:57.396Z Last Updated: 2025-09-17T03:55:50.342Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Spring Products: Cloud Gateway Problem Types: CWE-917, CWE-94 Description: Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management
Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2025-41243
CVE ID: CVE-2025-41244 State: PUBLISHED Published: 2025-09-29T16:09:51.871Z Last Updated: 2025-11-04T21:10:25.953Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: VMware Products: VCF operations, VMware tools, VMware Aria Operations, VMware Cloud Foundation, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure Problem Types: CWE-267 Description: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to roo
installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149
CVE ID: CVE-2025-41245 State: PUBLISHED Published: 2025-09-29T16:19:15.836Z Last Updated: 2025-09-30T15:42:32.121Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: VMware Products: VMware Aria Operations, VMware Cloud Foundation, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure Problem Types: CWE-1188 Description: VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://support.broadcom.com/group/ecx
Aria Operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149
CVE ID: CVE-2025-41246 State: PUBLISHED Published: 2025-09-29T15:57:58.438Z Last Updated: 2025-09-30T03:55:11.488Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: VMware Products: Tools Problem Types: CWE-863 Description: VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
nowledge of credentials of the targeted VMs and vCenter or ESX. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149
CVE ID: CVE-2025-41248 State: PUBLISHED Published: 2025-09-16T10:10:59.953Z Last Updated: 2025-09-18T06:29:51.189Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: VMware Products: Spring Security Description: The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not usin
this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41249 https://spring.io/security/cve-2025-41249 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2025-41248
CVE ID: CVE-2025-41249 State: PUBLISHED Published: 2025-09-16T10:15:34.118Z Last Updated: 2025-09-16T19:29:37.532Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: VMware Products: Spring Framework Description: The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not u
EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41248 https://spring.io/security/cve-2025-41248 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2025-41249
CVE ID: CVE-2025-41250 State: PUBLISHED Published: 2025-09-29T17:44:27.967Z Last Updated: 2025-09-30T03:55:12.416Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L) Vendors: VMware Products: vCenter, Cloud Foundation, Telco Cloud Platform, Telco Cloud Infrastructure, vSphere Foundation Problem Types: CWE-77 Description: VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/suppor
uled tasks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150
CVE ID: CVE-2025-41251 State: PUBLISHED Published: 2025-09-29T18:45:16.614Z Last Updated: 2025-09-30T03:55:13.262Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vmware Products: NSX Problem Types: CWE-640 Description: VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username enumeration → credential brute force risk. Attack Vector: Remote, unauthenticated. Severity: Important. CVSSv3: 8.1 (High). Acknowledgments: Reported by the National Security Agency. Affected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.
High). Acknowledgments: Reported by the National Security Agency. Affected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x NSX-T 3.x VMware Cloud Foundation (with NSX) 5.x, 4.5.x Fixed Versions: NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287). Workarounds: None. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150
CVE ID: CVE-2025-41252 State: PUBLISHED Published: 2025-09-29T19:02:07.283Z Last Updated: 2025-09-29T19:14:38.914Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: VMware Products: NSX Problem Types: CWE-203 Description: Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially leading to unauthorized access attempts. Impact: Username enumeration → facilitates unauthorized access. Attack Vector: Remote, unauthenticated. Severity: Important. CVSSv3: 7.5 (High). Acknowledgments: Reported by the National Security Agency. Affected Products: * VMware NSX 9.x.x.
t. CVSSv3: 7.5 (High). Acknowledgments: Reported by the National Security Agency. Affected Products: * VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x * NSX-T 3.x * VMware Cloud Foundation (with NSX) 5.x, 4.5.x Fixed Versions: * NSX 9.0.1.0; 4.2.2.2/4.2.3.1 http://4.2.2.2/4.2.3.1 ; 4.1.2.7; NSX-T 3.2.4.3; CCF async patch (KB88287). Workarounds: None. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150
CVE ID: CVE-2025-41253 State: PUBLISHED Published: 2025-10-16T14:25:21.356Z Last Updated: 2025-10-16T15:06:51.091Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: VMware Products: Spring Cloud Gateway Server Webflux Problem Types: CWE-917 Description: The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * An admin or untrusted third party using Spring Expre
r Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes. * An untrusted third party could create a route that uses SpEL to access environment variables or system properties if: * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
available to attackers. * The actuator endpoints are unsecured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve/2025-41253 - https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1
CVE ID: CVE-2025-41254 State: PUBLISHED Published: 2025-10-16T14:48:37.350Z Last Updated: 2025-10-16T16:10:14.510Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: VMware Products: Spring Framework Problem Types: CWE-352 Description: STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: * 6.2.0 - 6.2.11 * 6.1.0 - 6.1.23 * 6.0.x - 6.0.29 * 5.3.0 - 5.3.45 * Older, unsupported versions are also affected. MitigationUsers of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2
rs of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix versionAvailability6.2.x6.2.12OSS6.1.x6.1.24 Commercial https://enterprise.spring.io/ 6.0.xN/A Out of support https://spring.io/projects/spring-framework#support 5.3.x5.3.46 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. CreditThis vulnerability was discovered and responsibly reported by Jannis Kaiser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve/2025-41254 - https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N&version=3.1
CVE ID: CVE-2025-41255 State: PUBLISHED Published: 2025-06-25T09:21:37.479Z Last Updated: 2025-06-25T13:33:27.985Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: iterate GmbH Products: Cyberduck, Mountain Duck Problem Types: CWE-266 Description: Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sbaresearch/advisories/tree/public/20
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-01_Cyberduck_Mountain_Duck_Certificate_Handling - https://github.com/iterate-ch/cyberduck/security/advisories/GHSA-vjjc-grpp-m655
CVE ID: CVE-2025-41256 State: PUBLISHED Published: 2025-06-25T09:16:58.586Z Last Updated: 2025-06-25T13:34:07.242Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: iterate GmbH Products: Cyberduck, Mountain Duck Problem Types: CWE-328 Description: Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak. This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325
otes: - CISA ADP Vulnrichment: References: - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-02_Cyberduck_Mountain_Duck_Weak_Hash - https://github.com/iterate-ch/cyberduck/security/advisories/GHSA-688c-vjrc-84rv
CVE ID: CVE-2025-41335 State: PUBLISHED Published: 2025-11-04T13:15:43.266Z Last Updated: 2025-11-04T18:27:43.720Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id' and ' 'id_sociedad' in '/api/buscarEmpresaById.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41336 State: PUBLISHED Published: 2025-11-04T13:16:02.887Z Last Updated: 2025-11-04T17:05:55.761Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarConfiguracionParametros.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41337 State: PUBLISHED Published: 2025-11-04T13:16:20.518Z Last Updated: 2025-11-04T16:59:06.244Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarSSOParametros.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41338 State: PUBLISHED Published: 2025-11-04T13:16:37.282Z Last Updated: 2025-11-04T16:34:56.240Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'id_user' in '/backend/api/buscarTestigoByIdDenunciaUsuario.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41339 State: PUBLISHED Published: 2025-11-04T13:16:56.280Z Last Updated: 2025-11-04T15:56:59.396Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_sociedad' in '/backend/api/buscarTipoDenuncia.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41340 State: PUBLISHED Published: 2025-11-04T13:17:18.268Z Last Updated: 2025-11-04T15:33:20.238Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_tp_denuncia' and 'id_sociedad' in '/backend/api/buscarTipoDenunciabyId.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41341 State: PUBLISHED Published: 2025-11-04T13:17:34.546Z Last Updated: 2025-11-04T15:25:52.763Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'seguro' in '/backend/api/buscarUsuarioByDenuncia.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41342 State: PUBLISHED Published: 2025-11-04T13:17:51.179Z Last Updated: 2025-11-04T15:17:43.690Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_user' in '/backend/api/buscarUsuarioId.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41343 State: PUBLISHED Published: 2025-11-04T13:18:05.093Z Last Updated: 2025-11-04T15:07:08.054Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'email' in '/backend/api/users/searchUserByEmail.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41344 State: PUBLISHED Published: 2025-11-04T13:18:20.077Z Last Updated: 2025-11-04T15:04:57.015Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_archivo' in '/backend/api/verArchivo.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41345 State: PUBLISHED Published: 2025-11-04T13:18:42.706Z Last Updated: 2025-11-04T14:35:54.374Z Vendors: CanalDenuncia Products: CanalDenuncia.app Problem Types: CWE-862 Description: A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'id_user' in '/backend/api/buscarDenunciasById.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp
CVE ID: CVE-2025-41346 State: PUBLISHED Published: 2025-11-18T10:04:11.741Z Last Updated: 2025-11-18T21:12:26.877Z Vendors: Informática del Este Products: WinPlus Problem Types: CWE-863 Description: Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning that an attacker could compromise another user's account, thereby affecting the confidentiality, integrity, and availability of the data stored in the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-winplus-inform
ichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-winplus-informatica-del-este