Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-30652 State: PUBLISHED Published: 2025-04-09T19:57:01.859Z Last Updated: 2025-04-09T20:33:23.314Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-755 Description: An Improper Handling of Exceptional Conditions vulnerability in routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker executing a CLI command to cause a Denial of Service (DoS). When asregex-optimized is configured and a specific "show route as-path" CLI command is executed, the rpd crashes and restarts. Repeated execution of this command will c
ic "show route as-path" CLI command is executed, the rpd crashes and restarts. Repeated execution of this command will cause a sustained DoS condition. This issue affects Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S10, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S6, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R2. and Junos OS Evolved: * All versions before 21.2R3-S9-EVO, * from 21.4-EVO before 21.4R3-S10-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S6-EVO, * from 23.2-EVO before 23.2R2-S3-EVO, * from 23.4-EVO before 23.4R2-S4-EVO, * from 24.2-EVO before 24.2R2-EVO. Additional Analyst Note
O before 23.2R2-S3-EVO, * from 23.4-EVO before 23.4R2-S4-EVO, * from 24.2-EVO before 24.2R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96462
CVE ID: CVE-2025-30653 State: PUBLISHED Published: 2025-04-09T19:57:37.713Z Last Updated: 2025-04-09T20:32:41.398Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-825 Description: An Expired Pointer Dereference vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause Denial of Service (DoS).On all Junos OS and Junos OS Evolved platforms, when an MPLS Label-Switched Path (LSP) is configured with node-link-protection and transport-class, and an LSP flaps, rpd crashes and restarts. Continuous flap
is configured with node-link-protection and transport-class, and an LSP flaps, rpd crashes and restarts. Continuous flapping of LSP can cause a sustained Denial of Service (DoS) condition. This issue affects: Junos OS: * All versions before 22.2R3-S4, * 22.4 versions before 22.4R3-S2, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2. Junos OS Evolved: * All versions before 22.2R3-S4-EVO, * 22.4-EVO versions before 22.4R3-S2-EVO, * 23.2-EVO versions before 23.2R2-EVO, * 23.4-EVO versions before 23.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96463
CVE ID: CVE-2025-30654 State: PUBLISHED Published: 2025-04-09T20:00:36.618Z Last Updated: 2025-04-09T20:40:40.786Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-200 Description: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged, authenticated attacker with access to the CLI to access sensitive information. Through the execution of a specific show mgd command, a user with limited permissions (e.g., a low-privileged login class user) can access sensitive
ecific show mgd command, a user with limited permissions (e.g., a low-privileged login class user) can access sensitive information such as hashed passwords, that can be used to further impact the system. This issue affects Junos OS: * All versions before 21.4R3-S10, * from 22.2 before 22.2R3-S5, * from 22.4 before 22.4R3-S5, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S3. Junos OS Evolved: * All versions before 21.4R3-S10-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S5-EVO, * from 23.2-EVO before 23.2R2-S3-EVO, * from 23.4-EVO before 23.4R2-S3-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96
23.4R2-S3-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96464
CVE ID: CVE-2025-30655 State: PUBLISHED Published: 2025-04-09T20:01:15.300Z Last Updated: 2025-04-09T20:35:13.421Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS, Junos OS Evolved Problem Types: CWE-754 Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to cause a Denial-of-Service (DoS). When a specific "show bgp neighbor" CLI command is run, the rpd cpu utilization rises and eventually causes a crash and restart. Repeated use of this command will cause a sustained
rpd cpu utilization rises and eventually causes a crash and restart. Repeated use of this command will cause a sustained DoS condition. The device is only affected if BGP RIB sharding and update-threading is enabled. This issue affects Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S8, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S2, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2. and Junos OS Evolved: * All versions before 21.2R3-S9-EVO, * from 21.4-EVO before 21.4R3-S8-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S2-EVO, * from 23.2-EVO before 23.2R2-S3-EVO, * from 23.4-EVO before 23.4R2-EVO. Additional Analyst Notes: -
ore 22.4R3-S2-EVO, * from 23.2-EVO before 23.2R2-S3-EVO, * from 23.4-EVO before 23.4R2-EVO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96465
CVE ID: CVE-2025-30656 State: PUBLISHED Published: 2025-04-09T20:01:48.339Z Last Updated: 2025-04-10T14:23:32.306Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-167 Description: An Improper Handling of Additional Special Element vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with MS-MPC, MS-MIC and SPC3, and SRX Series, allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If the SIP ALG processes specifically formatted SIP invites, a memory corruption will occur which will lead to a crash of the FPC processing these packets.
y formatted SIP invites, a memory corruption will occur which will lead to a crash of the FPC processing these packets. Although the system will automatically recover with the restart of the FPC, subsequent SIP invites will cause the crash again and lead to a sustained DoS. This issue affects Junos OS on MX Series and SRX Series: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S3, * 24.2 versions before 24.2R1-S2, 24.2R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96466
CVE ID: CVE-2025-30657 State: PUBLISHED Published: 2025-04-09T20:02:21.815Z Last Updated: 2025-04-09T20:32:08.395Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-116 Description: An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a device configured for flow-monitoring receives a specific BGP update message, it is correctly processed internally by the routing protocol daemon (rpd), but when it's sent to SRRD it's encoded incorrectly whic
ctly processed internally by the routing protocol daemon (rpd), but when it's sent to SRRD it's encoded incorrectly which leads to a crash and momentary interruption of jflow processing until it automatically restarts. This issue does not affect traffic forwarding itself. This issue affects Junos OS: * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3, * 23.2 versions before 23.2R1-S2, 23.2R2. This issue does not affected Junos OS Evolved. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96467
CVE ID: CVE-2025-30658 State: PUBLISHED Published: 2025-04-09T20:02:50.588Z Last Updated: 2025-04-09T20:31:32.793Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-401 Description: A Missing Release of Memory after Effective Lifetime vulnerability in the Anti-Virus processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX platforms with Anti-Virus enabled, if a server sends specific content in the HTTP body of a response to a client request, these packets are queued by Anti-Virus processing in Juniper Buffers (jbufs
HTTP body of a response to a client request, these packets are queued by Anti-Virus processing in Juniper Buffers (jbufs) which are never released. When these jbufs are exhausted, the device stops forwarding all transit traffic. A jbuf memory leak can be noticed from the following logs: (<node>.)<fpc> Warning: jbuf pool id <#> utilization level (<current level>%) is above <threshold>%! To recover from this issue, the affected device needs to be manually rebooted to free the leaked jbufs. This issue affects Junos OS on SRX Series: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R
ions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S3, * 24.2 versions before 24.2R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96469
CVE ID: CVE-2025-30659 State: PUBLISHED Published: 2025-04-09T20:03:23.936Z Last Updated: 2025-04-09T20:30:38.589Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-130 Description: An Improper Handling of Length Parameter Inconsistency vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a device configured for Secure Vector Routing (SVR) receives a specifically malformed packet the PFE will crash and restart. This issue affects Junos OS on SRX Series: * All 21.4 versions, * 2
lly malformed packet the PFE will crash and restart. This issue affects Junos OS on SRX Series: * All 21.4 versions, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2. This issue does not affect versions before 21.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96470
CVE ID: CVE-2025-30660 State: PUBLISHED Published: 2025-04-09T20:05:25.345Z Last Updated: 2025-04-09T20:29:59.919Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-754 Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).When processing a high rate of specific GRE traffic destined to the device, the respective PFE will hang causing traffic forwarding to stop. When this issue occurs the following logs can be observed
e respective PFE will hang causing traffic forwarding to stop. When this issue occurs the following logs can be observed: <fpc #> MQSS(0): LI-3: Received a parcel with more than 512B accompanying data CHASSISD_FPC_ASIC_ERROR: ASIC Error detected <...> This issue affects Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S8, * 22.2 versions before 22.2R3-S4, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S2, * 23.4 versions before 23.4R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA96471
CVE ID: CVE-2025-30661 State: PUBLISHED Published: 2025-07-11T14:38:52.289Z Last Updated: 2025-07-12T03:55:12.892Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-732 Description: An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a local, low-privileged user to install scripts to be executed as root, leading to privilege escalation. A local user with access to the local file system can copy a script to the router in a way that will be executed as root, as the system boots. Execution of the script as root can lead to pri
the router in a way that will be executed as root, as the system boots. Execution of the script as root can lead to privilege escalation, potentially providing the adversary complete control of the system. This issue only affects specific line cards, such as the MPC10, MPC11, LC4800, LC9600, MX304-LMIC16, SRX4700, and EX9200-15C. This issue affects Junos OS: * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S1, * from 24.4 before 24.4R1-S3, 24.4R2. This issue does not affect versions prior to 23.1R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA100057 - https://github.com/orangecertcc/security-resea
Vulnrichment: References: - https://supportportal.juniper.net/JSA100057 - https://github.com/orangecertcc/security-research/security/advisories/GHSA-2p66-9j7x-fmch
CVE ID: CVE-2025-30662 State: PUBLISHED Published: 2025-11-13T14:53:09.801Z Last Updated: 2025-11-14T04:55:37.758Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Zoom Communications Inc. Products: Zoom Workplace VDI Plugin macOS Universal installer Problem Types: CWE-646 Description: Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25045
CVE ID: CVE-2025-30663 State: PUBLISHED Published: 2025-05-14T17:31:03.695Z Last Updated: 2025-05-17T03:56:04.512Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-367 Description: Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25016
CVE ID: CVE-2025-30664 State: PUBLISHED Published: 2025-05-14T17:33:18.777Z Last Updated: 2025-10-02T20:57:56.911Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-79 Description: Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25017
CVE ID: CVE-2025-30665 State: PUBLISHED Published: 2025-05-14T17:35:06.968Z Last Updated: 2025-05-14T19:00:31.446Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps for Windows Problem Types: CWE-476 Description: NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25018
CVE ID: CVE-2025-30666 State: PUBLISHED Published: 2025-05-14T17:35:15.485Z Last Updated: 2025-05-14T19:00:27.119Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps for Windows Problem Types: CWE-476 Description: NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25018
CVE ID: CVE-2025-30667 State: PUBLISHED Published: 2025-05-14T17:36:19.136Z Last Updated: 2025-05-14T19:00:20.154Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-476 Description: NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25019
CVE ID: CVE-2025-30668 State: PUBLISHED Published: 2025-05-14T17:39:55.588Z Last Updated: 2025-10-02T20:44:44.793Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-191 Description: Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25020
CVE ID: CVE-2025-30669 State: PUBLISHED Published: 2025-11-13T14:49:54.870Z Last Updated: 2025-11-13T15:17:54.292Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Zoom Communications Inc. Products: Zoom Workplace Clients Problem Types: CWE-295 Description: Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25044
CVE ID: CVE-2025-30670 State: PUBLISHED Published: 2025-04-08T16:20:54.607Z Last Updated: 2025-04-08T20:20:47.470Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps for Windows Problem Types: CWE-476 Description: Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25015
CVE ID: CVE-2025-30671 State: PUBLISHED Published: 2025-04-08T16:21:01.713Z Last Updated: 2025-04-08T20:14:04.268Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps for Windows Problem Types: CWE-476 Description: Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25015
CVE ID: CVE-2025-30672 State: PUBLISHED Published: 2025-04-01T01:51:08.494Z Last Updated: 2025-04-01T18:28:05.280Z Vendors: TOBYINK Products: Mite Problem Types: CWE-427 Description: Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution. This affects the Mite distribution itself, and other distributions that contain code generated by Mite. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://metacpan.org/release/TOBYINK/Mite-0.0
by Mite. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://metacpan.org/release/TOBYINK/Mite-0.013000/changes - https://wiki.gentoo.org/wiki/Project:Perl/Dot-In-INC-Removal - https://perldoc.perl.org/perlrun#PERL_USE_UNSAFE_INC - https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html
CVE ID: CVE-2025-30673 State: PUBLISHED Published: 2025-04-01T02:02:25.594Z Last Updated: 2025-04-01T18:29:17.462Z Vendors: TOBYINK Products: Sub::HandlesVia Problem Types: CWE-427 Description: Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution. Sub::HandlesVia uses Mite to produce the affected code section due to CVE-2025-30672 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://metacpan.org/dist/Sub-HandlesVia/chan
025-30672 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://metacpan.org/dist/Sub-HandlesVia/changes#L12 - https://metacpan.org/release/TOBYINK/Sub-HandlesVia-0.050001/source/lib/Sub/HandlesVia/Mite.pm#L114 - https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html
CVE ID: CVE-2025-30675 State: PUBLISHED Published: 2025-06-10T23:12:23.838Z Last Updated: 2025-06-11T13:52:21.335Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-200 Description: In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain. A malicious admin can enumerate a
ttacker to gain unauthorized visibility into templates and ISOs under the ROOT domain. A malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details. This vulnerability has been fixed by ensuring the domain resolution strictly adheres to the caller's scope rather than defaulting to the ROOT domain. Affected users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/ - https://www.shapeblue.com/shapeb
t: References: - https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/ - https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/ - https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60