Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4602 State: PUBLISHED Published: 2025-05-24T03:37:31.470Z Last Updated: 2025-05-24T10:03:59.420Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: emagicone Products: eMagicOne Store Manager for WooCommerce Problem Types: CWE-73 Description: The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Reads in all versions up to, and including, 1.2.5 via the get_file() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is only exploitable by unauthenticated attackers in default configurations wher
can contain sensitive information. This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20caab24-4af7-4592-9b18-f2f5acb423c9?source=cve - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php#L35-36 - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.php#L2220 - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emos
mconnectorcommon.php#L2220 - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php#L426 - https://github.com/d0n601/CVE-2025-4602/ - https://ryankozak.com/posts/cve-2025-4602/
CVE ID: CVE-2025-4603 State: PUBLISHED Published: 2025-05-24T03:37:32.048Z Last Updated: 2025-05-24T10:03:20.435Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: emagicone Products: eMagicOne Store Manager for WooCommerce Problem Types: CWE-73 Description: The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-c
bitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/242ad00b-3602-4988-ab7a-76fba2e9d4cf?source=cve - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php#L35-36 - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.php#L21
36 - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmconnectorcommon.php#L2167 - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php#L380 - https://github.com/d0n601/CVE-2025-4603/ - https://ryankozak.com/posts/cve-2025-4603/
CVE ID: CVE-2025-4604 State: PUBLISHED Published: 2025-08-04T22:08:53.926Z Last Updated: 2025-08-05T13:34:19.292Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 and then attackers can run scripts in the Gogo shell Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4
hment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4604
CVE ID: CVE-2025-4605 State: PUBLISHED Published: 2025-06-11T13:53:51.204Z Last Updated: 2025-08-19T13:14:48.074Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: Autodesk Products: USD for Maya, USD for 3ds Max, Maya Problem Types: CWE-789 Description: A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnerability. A malicious actor may leverage this vulnerability to cause a denial-of-service (DoS), or cause data corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Autodesk/maya-usd - https://github.com/Autodesk/3dsmax-usd - https://www.autodesk.com/pro
ferences: - https://github.com/Autodesk/maya-usd - https://github.com/Autodesk/3dsmax-usd - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0011
CVE ID: CVE-2025-4606 State: PUBLISHED Published: 2025-07-09T03:22:04.150Z Last Updated: 2025-07-09T14:29:40.327Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: uxper Products: Sala - Startup & SaaS WordPress Theme Problem Types: CWE-620 Description: The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage th
t possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa385a1f-1623-4f0a-bb2f-d4564b8f91bf?source=cve - https://themeforest.net/item/sala-startup-saas-wordpress-theme/33843955?s_rank=4
CVE ID: CVE-2025-4607 State: PUBLISHED Published: 2025-05-31T06:40:56.485Z Last Updated: 2025-06-02T15:49:31.883Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: empoweringprowebsite Products: PSW Front-end Login & Registration Problem Types: CWE-330 Description: The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12 via the customer_registration() function. This is due to the use of a weak, low-entropy OTP mechanism in the forget() function. This makes it possible for unauthenticated attackers to initiate a password reset for any user, including administrators, and eleva
it possible for unauthenticated attackers to initiate a password reset for any user, including administrators, and elevate their privileges for full site takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d6e595-0682-4a41-a432-afbcb50144e8?source=cve - https://plugins.trac.wordpress.org/browser/psw-login-and-registration/trunk/public/class-prositegeneralfeatures-public.php#L493 - https://wordpress.org/plugins/psw-login-and-registration/#developers - https://plugins.trac.wordpress.org/browser/psw-login-and-registration/trunk/public/class-prositegeneralfeatures-public.php#L731 - https://plugins.trac.wordpress.o
/psw-login-and-registration/trunk/public/class-prositegeneralfeatures-public.php#L731 - https://plugins.trac.wordpress.org/browser/psw-login-and-registration/trunk/public/class-prositegeneralfeatures-public.php#L323
CVE ID: CVE-2025-4608 State: PUBLISHED Published: 2025-07-24T09:22:20.909Z Last Updated: 2025-07-24T13:13:52.396Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codemacher Products: Structured Content (JSON-LD) #wpsc Problem Types: CWE-79 Description: The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
or authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c8c60701-37f0-4404-b965-9136ac456e38?source=cve - https://wordpress.org/plugins/structured-content/#developers - https://plugins.trac.wordpress.org/browser/structured-content/tags/1.6.4/templates/shortcodes/local-business.php - https://plugins.trac.wordpress.org/browser/structured-content/tags/1.6.4/class-structuredcontent.php#L188
CVE ID: CVE-2025-4609 State: PUBLISHED Published: 2025-08-22T21:05:46.476Z Last Updated: 2025-08-26T03:55:23.509Z Vendors: Google Products: Chrome Problem Types: Incorrect handle provided in unspecified circumstances Description: Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html - https://issues.chromium.org/issues/412578726
CVE ID: CVE-2025-4610 State: PUBLISHED Published: 2025-05-17T09:22:53.941Z Last Updated: 2025-05-19T20:20:29.563Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cbutlerjr Products: WP-Members Membership Plugin Problem Types: CWE-79 Description: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_user_memberships shortcode in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff96d74-8f20-49a6-bd02-0bfe3498b599?source=cve - https://wordpress.org/plugins/wp-members/#developers - https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.2/includes/class-wp-members-products.php#L115 - https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.2/includes/class-wp-members-products.php#L660 - https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-members&old=32
includes/class-wp-members-products.php#L660 - https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-members&old=3240295&new_path=%2Fwp-members&new=3293207&sfp_email=&sfph_mail=
CVE ID: CVE-2025-4611 State: PUBLISHED Published: 2025-05-21T09:21:50.279Z Last Updated: 2025-05-21T10:15:51.279Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rilwis Products: Slim SEO – Fast & Automated WordPress SEO Plugin Problem Types: CWE-79 Description: The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs shortcode in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a
ied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6318a1cf-716f-450c-a1c2-497de8095daa?source=cve - https://wordpress.org/plugins/slim-seo/#developers - https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.5.3/src/Breadcrumbs.php#L37 - https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.5.3/src/Breadcrumbs.php#L85 - https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.5.3/src/Breadcrumbs.php#L1
gs/4.5.3/src/Breadcrumbs.php#L85 - https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.5.3/src/Breadcrumbs.php#L109 - https://github.com/elightup/slim-seo/commit/b475dceff3a6bd94335d5a79eb12cdd92e2c8350 - https://plugins.trac.wordpress.org/changeset/3296099/
CVE ID: CVE-2025-4613 State: PUBLISHED Published: 2025-06-12T09:06:05.252Z Last Updated: 2025-06-14T03:56:18.019Z Vendors: Google Products: Web Designer App Problem Types: CWE-20 Description: Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://balintmagyar.com/articles/google-web-designer-path-traversal-client-side-rce-cve-2025-4613
CVE ID: CVE-2025-4614 State: PUBLISHED Published: 2025-10-09T18:13:22.016Z Last Updated: 2025-10-09T19:15:06.182Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS, Prisma Access Problem Types: CWE-497 Description: An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authenticated to the firewall web UI. This may allow impersonation of users whose session tokens are leaked. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability. Additional Analy
limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-4614
CVE ID: CVE-2025-4615 State: PUBLISHED Published: 2025-10-09T18:28:04.905Z Last Updated: 2025-10-09T19:08:50.531Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS, Prisma Access Problem Types: CWE-83 Description: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ud NGFW and Prisma® Access are not affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVEN-2025-4615
CVE ID: CVE-2025-4616 State: PUBLISHED Published: 2025-11-14T17:33:21.420Z Last Updated: 2025-11-17T20:39:22.564Z Vendors: Palo Alto Networks Products: Prisma Browser Problem Types: CWE-354 Description: An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-4616
CVE ID: CVE-2025-4617 State: PUBLISHED Published: 2025-11-14T17:51:36.442Z Last Updated: 2025-11-14T18:45:30.974Z Vendors: Palo Alto Networks Products: Prisma Browser Problem Types: CWE-424 Description: An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-4617
CVE ID: CVE-2025-4618 State: PUBLISHED Published: 2025-11-14T17:53:38.487Z Last Updated: 2025-11-17T19:14:40.902Z Vendors: Palo Alto Networks Products: Prisma Browser Problem Types: CWE-316 Description: A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to retrieve sensitive data from Prisma Browser. Browser self-protection should be enabled to mitigate this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-4618
CVE ID: CVE-2025-4619 State: PUBLISHED Published: 2025-11-13T20:24:19.208Z Last Updated: 2025-11-14T18:08:10.682Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS, Prisma Access Problem Types: CWE-754 Description: A denial-of-service (DoS) vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to reboot a firewall by sending a specially crafted packet through the dataplane. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. This issue is applicable to the PAN-OS software versions listed below on PA-Series firewalls, VM-Series firewalls, and Prisma® Access software. This issue does not affect Cloud NGFW. ​​We have suc
Series firewalls, VM-Series firewalls, and Prisma® Access software. This issue does not affect Cloud NGFW. ​​We have successfully completed the Prisma Access upgrade for all customers, with the exception of those facing issues such as conflicting maintenance windows. Remaining customers will be promptly scheduled for an upgrade through our standard upgrade process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-4619
CVE ID: CVE-2025-4631 State: PUBLISHED Published: 2025-05-31T06:40:58.133Z Last Updated: 2025-06-02T15:49:14.554Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: unitybusinesstechnology Products: The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis Problem Types: CWE-285 Description: The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktend_object endpoint in versions 2.0.6.0 to 2.1.1.3. This makes it possible to trigger the save_object_as_user() function for objects whose '_datatype' is set to 'users',. This allows unauthenticated attackers
save_object_as_user() function for objects whose '_datatype' is set to 'users',. This allows unauthenticated attackers to write arbitrary strings straight into the user’s wp_capabilities meta field, potentially elevating the privileges of an existing user account or a newly created one to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c764811f-e9dc-4c3d-b696-5792e70ff0b6?source=cve - https://plugins.trac.wordpress.org/browser/profitori/tags/2.1.1.3/profitori.php#L2675 - https://plugins.trac.wordpress.org/browser/profitori/tags/2.1.1.3/profitori.php#L2698 - https://plugins.trac.wordpress.org
tps://plugins.trac.wordpress.org/browser/profitori/tags/2.1.1.3/profitori.php#L2698 - https://plugins.trac.wordpress.org/browser/profitori/tags/2.1.1.3/profitori.php#L3673 - https://wordpress.org/plugins/profitori/#developers - https://plugins.trac.wordpress.org/browser/profitori/tags/2.1.1.3/profitori.php#L2679
CVE ID: CVE-2025-4632 State: PUBLISHED Published: 2025-05-13T05:19:19.254Z Last Updated: 2025-10-21T22:55:16.506Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-22 Description: Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates#SVP-MAY-2025
CVE ID: CVE-2025-4633 State: PUBLISHED Published: 2025-05-30T08:14:50.821Z Last Updated: 2025-05-30T13:55:29.519Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: JCT Products: Airpointer Problem Types: CWE-798 Description: Default credentials were present in the web portal for Airpointer 2.4.107-2, allowing an unauthenticated malicious actor to log in via the web portal Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jct-aq.com/products/airpointer2d/
CVE ID: CVE-2025-4634 State: PUBLISHED Published: 2025-05-30T08:21:28.420Z Last Updated: 2025-05-30T13:54:29.915Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: JCT Products: Airpointer Problem Types: CWE-552 Description: The web portal on airpointer 2.4.107-2 was vulnerable local file inclusion. A malicious user with administrative privileges in the web portal would be able to manipulate requests to view files on the filesystem Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jct-aq.com/products/airpointer2d/
CVE ID: CVE-2025-4635 State: PUBLISHED Published: 2025-05-30T08:23:42.104Z Last Updated: 2025-05-30T13:01:33.991Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: JCT Products: Airpointer Problem Types: CWE-20 Description: A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code execution on the local device as a low privileged user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jct-aq.com/products/airpointer2d/
CVE ID: CVE-2025-4636 State: PUBLISHED Published: 2025-05-30T08:24:50.630Z Last Updated: 2025-05-30T12:58:45.485Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: JCT Products: Airpointer Problem Types: CWE-269 Description: Due to excessive privileges granted to the web user running the airpointer web platform, a malicious actor that gains control of the this user would be able to privilege escalate to the root user Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jct-aq.com/products/airpointer2d/
CVE ID: CVE-2025-4637 State: PUBLISHED Published: 2025-05-14T17:51:41.076Z Last Updated: 2025-05-15T14:26:59.683Z Vendors: davisking Products: dlib Problem Types: CWE-369 Description: Divide By Zero vulnerability in davisking dlib allows remote attackers to cause a denial of service via a crafted file. .This issue affects dlib: before <19.24.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/davisking/dlib/pull/3058
CVE ID: CVE-2025-4638 State: PUBLISHED Published: 2025-05-14T17:59:58.180Z Last Updated: 2025-05-15T13:49:10.296Z Vendors: PointCloudLibrary Products: pcl Description: A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL). This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic. Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITH_SYSTEM_ZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib. Additional A
evant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PointCloudLibrary/pcl/pull/6245 - https://github.com/PointCloudLibrary/pcl/blob/master/surface/CMakeLists.txt#L70 - https://github.com/PointCloudLibrary/pcl/commit/502bd2b013ce635f21632d523aa8cf2e04f7b7ac