Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ation Tool SDK Windows, SIMATIC BATCH V10.0, SIMATIC BATCH V9.1, SIMATIC Control Function Library (CFL) V1.x, SIMATIC Control Function Library (CFL) V2.x, SIMATIC Control Function Library (CFL) V3.x, SIMATIC Control Function Library (CFL) V4.x, SIMATIC D7-SYS, SIMATIC eaSie Core Package, SIMATIC eaSie Document Skills, SIMATIC eaSie PCS 7 Skill Package, SIMATIC eaSie Workflow Skills, SIMATIC Energy Suite V17, SIMATIC Energy Suite V18, SIMATIC Energy Suite V19, SIMATIC Logon V1.6, SIMATIC Logon V2.0, SIMATIC Management Agent, SIMATIC Management Console, SIMATIC MTP CREATOR V2.x, SIMATIC MTP CREATOR V3.x, SIMATIC MTP CREATOR V4.x, SIMATIC MTP CREATOR V5.x, SIMATIC MTP Integrator V1.x, SIMATIC M
.x, SIMATIC MTP CREATOR V3.x, SIMATIC MTP CREATOR V4.x, SIMATIC MTP CREATOR V5.x, SIMATIC MTP Integrator V1.x, SIMATIC MTP Integrator V2.x, SIMATIC NET PC Software V16, SIMATIC NET PC Software V17, SIMATIC NET PC Software V18, SIMATIC NET PC Software V19, SIMATIC NET PC Software V20, SIMATIC ODK 1500S, SIMATIC PCS 7 Advanced Process Faceplates V9.1, SIMATIC PCS 7 Advanced Process Functions V2.1, SIMATIC PCS 7 Advanced Process Functions V2.2, SIMATIC PCS 7 Advanced Process Graphics V10.0, SIMATIC PCS 7 Advanced Process Graphics V9.1, SIMATIC PCS 7 Advanced Process Library incl. Faceplates V10.0, SIMATIC PCS 7 Advanced Process Library V9.1, SIMATIC PCS 7 Basis Faceplates V9.1, SIMATIC PCS 7 Ba
cl. Faceplates V10.0, SIMATIC PCS 7 Advanced Process Library V9.1, SIMATIC PCS 7 Basis Faceplates V9.1, SIMATIC PCS 7 Basis Library V10.0, SIMATIC PCS 7 Basis Library V9.1, SIMATIC PCS 7 Industry Library V10.0, SIMATIC PCS 7 Industry Library V9.0, SIMATIC PCS 7 Industry Library V9.1, SIMATIC PCS 7 Logic Matrix V10.0, SIMATIC PCS 7 Logic Matrix V9.1, SIMATIC PCS 7 MPC Configurator, SIMATIC PCS 7 PowerControl, SIMATIC PCS 7 Standard Chemical Library V10.0, SIMATIC PCS 7 Standard Chemical Library V9.1, SIMATIC PCS 7 TeleControl, SIMATIC PCS 7 V10.0, SIMATIC PCS 7 V9.1, SIMATIC PCS 7/OPEN OS V9.1, SIMATIC PCS neo V5.0, SIMATIC PCS neo V6.0, SIMATIC PDM Maintenance Station V5.0, SIMATIC PDM V9.2,
PCS 7/OPEN OS V9.1, SIMATIC PCS neo V5.0, SIMATIC PCS neo V6.0, SIMATIC PDM Maintenance Station V5.0, SIMATIC PDM V9.2, SIMATIC PDM V9.3, SIMATIC Process Function Library (PFL) V4.0, SIMATIC Process Historian 2020, SIMATIC Process Historian 2022, SIMATIC Process Historian 2024, SIMATIC ProSave V17, SIMATIC ProSave V18, SIMATIC ProSave V19, SIMATIC ProSave V20, SIMATIC Route Control V10.0, SIMATIC Route Control V9.1, SIMATIC S7 F Systems V6.3, SIMATIC S7 F Systems V6.4, SIMATIC S7-1500 Software Controller V2, SIMATIC S7-1500 Software Controller V3, SIMATIC S7-Fail-safe Configuration Tool (S7-FCT), SIMATIC S7-PCT, SIMATIC S7-PLCSIM Advanced, SIMATIC S7-PLCSIM V17, SIMATIC S7-PLCSIM V18, SIMAT
iguration Tool (S7-FCT), SIMATIC S7-PCT, SIMATIC S7-PLCSIM Advanced, SIMATIC S7-PLCSIM V17, SIMATIC S7-PLCSIM V18, SIMATIC S7-PLCSIM V19, SIMATIC S7-PLCSIM V20, SIMATIC Safety Matrix, SIMATIC STEP 7 CFC V19, SIMATIC STEP 7 CFC V20, SIMATIC STEP 7 V5.7, SIMATIC Target, SIMATIC WinCC flexible ES, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC Runtime Professional V20, SIMATIC WinCC TeleControl, SIMATIC WinCC Unified Line Coordination, SIMATIC WinCC Unified PC Runtime V18, SIMATIC WinCC Unified PC Runtime V19, SIMATIC WinCC Unified PC Runtime V20, SIMATIC WinCC Unified Sequence, SIMATIC WinCC V7.5, SIMATIC WinCC V8.0, SIMATIC WinCC V8.1, SIMATIC WinCC Visualiz
V20, SIMATIC WinCC Unified Sequence, SIMATIC WinCC V7.5, SIMATIC WinCC V8.0, SIMATIC WinCC V8.1, SIMATIC WinCC Visualization Architect (SiVArc) V17, SIMATIC WinCC Visualization Architect (SiVArc) V18, SIMATIC WinCC Visualization Architect (SiVArc) V19, SIMATIC WinCC Visualization Architect (SiVArc) V20, SIMIT Rapid Tester, SIMIT Simulation Platform, SINAMICS Startdrive V17, SINAMICS Startdrive V18, SINAMICS Startdrive V19, SINAMICS Startdrive V20, SINEC NMS, SINEMA Remote Connect Client, SITRANS, Standard PID CTRL Tool, TeleControl Server Basic V3.1, TIA Administrator, TIA Portal Cloud Connector, TIA Portal Test Suite V17, TIA Portal Test Suite V18, TIA Portal Test Suite V19, TIA Portal Tes
Portal Cloud Connector, TIA Portal Test Suite V17, TIA Portal Test Suite V18, TIA Portal Test Suite V19, TIA Portal Test Suite V20, TIA Project-Server, TIA Project-Server V17, WinCC Panel Image Setup Problem Types: CWE-427 Description: The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-282044.html
CVE ID: CVE-2025-30034 State: PUBLISHED Published: 2025-08-12T11:16:58.223Z Last Updated: 2025-08-12T20:09:02.333Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: SIMATIC RTLS Locating Manager Problem Types: CWE-617 Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input sent to its listening port on the local loopback interface. This could allow an unauthenticated local attacker to cause a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-707630.htm
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-707630.html
CVE ID: CVE-2025-30036 State: PUBLISHED Published: 2025-08-27T10:19:41.153Z Last Updated: 2025-08-27T16:21:33.671Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-79 Description: Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up to full administrative rights. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30037 State: PUBLISHED Published: 2025-08-27T10:20:18.040Z Last Updated: 2025-08-27T16:12:54.068Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-306 Description: The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly accessible without authentication to any host able to reach the application server on port 443/tcp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30038 State: PUBLISHED Published: 2025-08-27T10:20:35.633Z Last Updated: 2025-08-27T16:11:57.191Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-1230 Description: The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files downloaded from potentially untrusted sources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30039 State: PUBLISHED Published: 2025-08-27T10:20:57.386Z Last Updated: 2025-08-27T13:37:11.652Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-306 Description: Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30040 State: PUBLISHED Published: 2025-08-27T10:21:17.049Z Last Updated: 2025-08-27T13:25:51.859Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-306 Description: The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30041 State: PUBLISHED Published: 2025-08-27T10:21:41.896Z Last Updated: 2025-08-27T13:25:30.693Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-306 Description: The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30048 State: PUBLISHED Published: 2025-08-27T10:22:14.990Z Last Updated: 2025-08-27T13:25:10.969Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-306 Description: The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30055 State: PUBLISHED Published: 2025-08-27T10:22:41.893Z Last Updated: 2025-08-27T13:24:16.973Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-94 Description: The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30056 State: PUBLISHED Published: 2025-08-27T10:23:17.397Z Last Updated: 2025-08-27T13:23:15.591Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-94 Description: The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30057 State: PUBLISHED Published: 2025-08-27T10:23:38.269Z Last Updated: 2025-08-27T14:01:26.014Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-94 Description: In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30058 State: PUBLISHED Published: 2025-08-27T10:24:03.128Z Last Updated: 2025-08-27T13:49:50.475Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-89 Description: In the PatientService.pl service, the "getPatientIdentifier" function is vulnerable to SQL injection through the "pesel" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30059 State: PUBLISHED Published: 2025-08-27T10:24:27.151Z Last Updated: 2025-08-27T13:39:54.327Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-89 Description: In the PrepareCDExportJSON.pl service, the "getPerfServiceIds" function is vulnerable to SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30060 State: PUBLISHED Published: 2025-08-27T10:24:45.586Z Last Updated: 2025-08-27T13:33:25.099Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-89 Description: In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30061 State: PUBLISHED Published: 2025-08-27T10:24:56.031Z Last Updated: 2025-08-27T13:32:23.932Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-89 Description: In the "utils/Reporter/OpenReportWindow.pl" service, there is an SQL injection vulnerability through the "UserID" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30063 State: PUBLISHED Published: 2025-08-27T10:25:02.678Z Last Updated: 2025-08-27T13:28:38.439Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-732 Description: The configuration file containing database logins and passwords is readable by any local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30064 State: PUBLISHED Published: 2025-08-27T10:25:20.090Z Last Updated: 2025-08-27T13:25:58.795Z Vendors: CGM Products: CGM CLININET Problem Types: CWE-912, CWE-347 Description: An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to generate a session for any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-2313/
CVE ID: CVE-2025-30065 State: PUBLISHED Published: 2025-04-01T07:53:42.993Z Last Updated: 2025-05-07T12:57:23.215Z Vendors: Apache Software Foundation Products: Apache Parquet Java Problem Types: CWE-502 Description: Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5
CVE ID: CVE-2025-30066 State: PUBLISHED Published: 2025-03-15T00:00:00.000Z Last Updated: 2025-10-21T22:55:23.291Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: tj-actions Products: changed-files Problem Types: CWE-506 Description: tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/github/docs/blob/962a1c8dccb
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193 - https://github.com/tj-actions/changed-files/issues/2463 - https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised - https://semgrep.dev/blog/2025/popular-github-action-tj-actionschanged-files-is-compromised/ - https://news.ycombinator.com/item?id=43368870 - https://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463 - https://news.ycombinat
ps://web.archive.org/web/20250315060250/https://github.com/tj-actions/changed-files/issues/2463 - https://news.ycombinator.com/item?id=43367987 - https://github.com/rackerlabs/genestack/pull/903 - https://github.com/chains-project/maven-lockfile/pull/1111 - https://sysdig.com/blog/detecting-and-mitigating-the-tj-actions-changed-files-supply-chain-attack-cve-2025-30066/ - https://github.com/espressif/arduino-esp32/issues/11127 - https://github.com/modal-labs/modal-examples/issues/1100 - https://github.com/tj-actions/changed-files/issues/2464 - https://github.com/tj-actions/changed-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28 - https://www.wiz.io/blog/github-ac
hanged-files/blob/45fb12d7a8bedb4da42342e52fe054c6c2c3fd73/README.md?plain=1#L20-L28 - https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 - https://www.stream.security/post/github-action-supply-chain-attack-exposes-secrets-what-you-need-to-know-and-how-to-respond - https://www.sweet.security/blog/cve-2025-30066-tj-actions-supply-chain-attack - https://github.com/tj-actions/changed-files/issues/2477 - https://blog.gitguardian.com/compromised-tj-actions/
CVE ID: CVE-2025-30067 State: PUBLISHED Published: 2025-03-27T15:06:36.598Z Last Updated: 2025-03-27T17:56:13.192Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.1. Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue. Addition
n: from 4.0.0 through 5.0.1. Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/6j19pt8yoqfphf1lprtrzoqkvz1gwbnc
CVE ID: CVE-2025-30072 State: PUBLISHED Published: 2025-05-19T00:00:00.000Z Last Updated: 2025-05-19T15:55:42.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tiiwee X1 Alarm System TWX1HAKV2 allows Authentication Bypass by Capture-replay, leading to physical Access to the protected facilities without triggering an alarm. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tiiwee.com/collections/x1-alarm-systems - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-006.txt
CVE ID: CVE-2025-30073 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T13:31:55.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first or all transactions with the same reference are completed, depending on timing. This can be used to transfer more money onto employee cards than is paid. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/businesslogik-fehler-bei-aufwertung-von-geldkarten-in-opcr-webapp-aufwertung-syss-2024-089
CVE ID: CVE-2025-30074 State: PUBLISHED Published: 2025-03-16T00:00:00.000Z Last Updated: 2025-03-17T16:03:47.139Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Parallels Desktop Problem Types: CWE-863 Description: Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.parallels.com/en/130944
CVE ID: CVE-2025-30075 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T18:27:11.018Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Alludo Products: MindManager Problem Types: CWE-673 Description: In Alludo MindManager before 25.0.208 on Windows, attackers could potentially execute code as other local users on the same machine if they could write DLL files to directories within victims' DLL search paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pastebin.com/5CaNfyGH
CVE ID: CVE-2025-30076 State: PUBLISHED Published: 2025-03-16T00:00:00.000Z Last Updated: 2025-03-17T15:52:17.570Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Koha Products: Koha Problem Types: CWE-78 Description: Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl0wyy/koha-task-scheduler-rce - https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39170
CVE ID: CVE-2025-30077 State: PUBLISHED Published: 2025-03-16T00:00:00.000Z Last Updated: 2025-03-17T15:51:20.512Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: onosproject Products: onos-lib-go Problem Types: CWE-129 Description: Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/onosproject/onos-lib-go/issues/295
CVE ID: CVE-2025-30080 State: PUBLISHED Published: 2025-04-02T00:00:00.000Z Last Updated: 2025-04-03T13:23:27.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service (software abort). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2025-30084 State: PUBLISHED Published: 2025-06-05T13:20:36.856Z Last Updated: 2025-06-14T04:36:30.353Z Vendors: rsjoomla.com Products: RSMail! component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or other input points, which is subsequently executed in the browser of any user who clicks on the crafted text in the dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
user who clicks on the crafted text in the dashboard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rsjoomla.com/
CVE ID: CVE-2025-30085 State: PUBLISHED Published: 2025-06-11T19:07:39.032Z Last Updated: 2025-06-12T15:18:38.814Z Vendors: rsjoomla.com Products: RSform!Pro component for Joomla Problem Types: CWE-94 Description: Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla was discovered. The issue occurs within the submission export feature and requires administrative access to the export feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rsjoomla.com/
CVE ID: CVE-2025-30086 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T15:07:51.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that
trator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goharbor/harbor/releases - https://www.elttam.com/blog/plormbing-your-django-orm/ - https://goharbor.io/blog/ - https://github.com/goharbor/harbor/security/advisories/GHSA-h27m-3qw8-3pw8