Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
THUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the Github API to push malicious code or rewrite release commits in the AdeptLanguage/Adept repository. This issue has been patched in commit a1a41b7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AdeptLanguage/Adept/security/advisories/GHSA-8c7v-vccv-cx4q - https://github.com/AdeptLanguage/Adept/commit/a1a41b72cdf1bebfc0cf6d7b3a8350e6406b2220
CVE ID: CVE-2025-32959 State: PUBLISHED Published: 2025-04-22T17:45:00.340Z Last Updated: 2025-04-22T18:50:33.199Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: cuba-platform Products: cuba Problem Types: CWE-770 Description: CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementation does not restrict the size of uploaded files. An attacker could exploit this by uploading excessively large files, potentially causing the server to run out of space and return HTTP 500 error, resulting in a denial of service. This issue has been patched in version 7.2.23. A workaround is prov
rn HTTP 500 error, resulting in a denial of service. This issue has been patched in version 7.2.23. A workaround is provided on the Jmix documentation website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cuba-platform/cuba/security/advisories/GHSA-w3mp-6vrj-875g - https://github.com/jmix-framework/jmix/security/advisories/GHSA-f3gv-cwwh-758m - https://github.com/cuba-platform/cuba/commit/42b6c00fd0572b8e52ae31afd1babc827a3161a1 - https://docs.jmix.io/jmix/files-vulnerabilities.html - https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application
CVE ID: CVE-2025-32960 State: PUBLISHED Published: 2025-04-22T17:45:53.855Z Last Updated: 2025-04-23T15:59:07.985Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cuba-platform Products: restapi Problem Types: CWE-79 Description: The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in ve
he browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 7.2.7. A workaround is provided on the Jmix documentation website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cuba-platform/restapi/security/advisories/GHSA-88h5-34xw-2q56 - https://github.com/jmix-framework/jmix/security/advisories/GHSA-x27v-f838-jh93 - https://github.com/cuba-platform/restapi/commit/b3d599f6657d7e212fdb134a61ab5e0888669eb1 - https://docs.jmix.io/jmix/files-vulnerabilities.html - https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application
CVE ID: CVE-2025-32961 State: PUBLISHED Published: 2025-04-22T17:46:00.961Z Last Updated: 2025-04-23T15:59:02.433Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cuba-platform Products: jpawebapi Problem Types: CWE-79 Description: The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to version 1.1.1, the input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file
tml. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be uploaded beforehand. This issue has been patched in version 1.1.1. A workaround is provided on the Jmix documentation website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cuba-platform/jpawebapi/security/advisories/GHSA-hg25-w3vg-7279 - https://github.com/cuba-platform/jpawebapi/commit/78b837d7e2b12d0df69cef1bc6042ebf3bdaf22c - https://docs.jmix.io/jmix/files-vulnerabilities.html - https://docs.jmix.io/jmix/files-vulnerabilities.html#disable-files-endpoint-in-cuba-application
CVE ID: CVE-2025-32962 State: PUBLISHED Published: 2025-05-16T13:51:55.581Z Last Updated: 2025-05-16T14:53:52.917Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: dpgaspar Products: Flask-AppBuilder Problem Types: CWE-601 Description: Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workar
ariable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-99pm-ch96-ccp2 - https://github.com/dpgaspar/Flask-AppBuilder/commit/32eedbbb5cb483a3e782c5f2732de4a6a650d9b6
CVE ID: CVE-2025-32963 State: PUBLISHED Published: 2025-04-22T17:14:56.958Z Last Updated: 2025-04-25T16:03:14.020Z Vendors: minio Products: operator Problem Types: CWE-522 Description: MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/minio/operator/security/advisories/GHSA-7m6v-q233-q9j9 - https://github.com/minio/oper
References: - https://github.com/minio/operator/security/advisories/GHSA-7m6v-q233-q9j9 - https://github.com/minio/operator/releases/tag/v7.1.0
CVE ID: CVE-2025-32964 State: PUBLISHED Published: 2025-04-22T17:15:03.200Z Last Updated: 2025-04-22T17:35:37.926Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: miraheze Products: ManageWiki Problem Types: CWE-285 Description: ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting extension, a restricted extension would be automatically disabled even if the user did not hold the ManageWiki-restricted right. This issue has been patched in commit 00bebea. A workaround involves ensuring that any extensions requiring specific permissions in `$wgManageWikiExtensions` also require the same permiss
s ensuring that any extensions requiring specific permissions in `$wgManageWikiExtensions` also require the same permissions for managing any conflicting extensions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/miraheze/ManageWiki/security/advisories/GHSA-ccrf-x5rp-gppr - https://github.com/miraheze/ManageWiki/commit/00bebea43a3e3ff0157b5f04df17c1d1e88a9acd
CVE ID: CVE-2025-32965 State: PUBLISHED Published: 2025-04-22T20:39:48.452Z Last Updated: 2025-04-23T13:24:31.517Z Vendors: XRPLF Products: xrpl.js Problem Types: CWE-506 Description: xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions. Anyone who used one of these versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js s
e versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js should pgrade to version 4.2.5 or 2.14.3 to receive a patch. To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys. If any account's master key is potentially compromised, disable the key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/XRPLF/xrpl.js/security/advisories/GHSA-33qr-m49q-rxfx - https://www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-crypto-stealing-backdoor - https://xrpl
://www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-crypto-stealing-backdoor - https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/assign-a-regular-key-pair - https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/disable-master-key-pair
CVE ID: CVE-2025-32966 State: PUBLISHED Published: 2025-04-23T15:21:50.361Z Last Updated: 2025-04-23T16:23:29.128Z Vendors: dataease Products: dataease Problem Types: CWE-290 Description: DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7
CVE ID: CVE-2025-32967 State: PUBLISHED Published: 2025-05-23T15:31:52.551Z Last Updated: 2025-05-23T15:40:15.258Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: openemr Products: openemr Problem Types: CWE-778 Description: OpenEMR is a free and open source electronic health records and medical practice management application. A logging oversight in versions prior to 7.0.3.4 allows password change events to go unrecorded on the client-side log viewer, preventing administrators from auditing critical actions. This weakens traceability and opens the system to undetectable misuse by insiders or attackers. Version 7.0.3.4 contains a patch for the issue. Additio
pens the system to undetectable misuse by insiders or attackers. Version 7.0.3.4 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openemr/openemr/security/advisories/GHSA-7qj6-jxfc-xw4v
CVE ID: CVE-2025-32968 State: PUBLISHED Published: 2025-04-23T15:27:27.181Z Last Updated: 2025-04-23T16:19:13.147Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-89 Description: XWiki is a generic wiki platform. In versions starting from 1.6-milestone-1 to before 15.10.16, 16.4.6, and 16.10.1, it is possible for a user with SCRIPT right to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has
ial information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki. The protection added to this REST API is the same as the one used to validate complete select queries, making it more consistent. However, while the script API always had this protection for complete queries, it's important to note that it's a very strict protection and some valid, but complex, queries might suddenly require the author to have programming right. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platf
programming right. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g9jj-75mx-wjcx - https://jira.xwiki.org/browse/XWIKI-22718
CVE ID: CVE-2025-32969 State: PUBLISHED Published: 2025-04-23T15:33:03.732Z Last Updated: 2025-04-23T16:15:40.344Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-89 Description: XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the us
"Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f69v-xrj8-rhxf - https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113 - https://jira.xwiki.org/browse/XWIKI
://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113 - https://jira.xwiki.org/browse/XWIKI-22691
CVE ID: CVE-2025-32970 State: PUBLISHED Published: 2025-04-30T14:54:52.008Z Last Updated: 2025-04-30T15:19:11.652Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-601 Description: XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment:
This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pjhg-9wr9-rj96 - https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802 - https://jira.xwiki.org/browse/XWIKI-22487
CVE ID: CVE-2025-32971 State: PUBLISHED Published: 2025-04-30T14:54:55.124Z Last Updated: 2025-04-30T15:18:28.533Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-863 Description: XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the Solr script service doesn't take dropped programming rights into account. The Solr script service that is accessible in XWiki's scripting API normally requires programming rights to be called. Due to using the wrong API for checking rights, it doesn't take the fact into
requires programming rights to be called. Due to using the wrong API for checking rights, it doesn't take the fact into account that programming rights might have been dropped by calling `$xcontext.dropPermissions()`. If some code relies on this for the safety of executing Velocity code with the wrong author context, this could allow a user with script rights to either cause a high load by indexing documents or to temporarily remove documents from the search index. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0-rc-1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-987p-r3jc-8c8v - https:/
DP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-987p-r3jc-8c8v - https://github.com/xwiki/xwiki-platform/commit/6570f40f976aec82baf388b5239d1412cab238c9 - https://jira.xwiki.org/browse/XWIKI-22474
CVE ID: CVE-2025-32972 State: PUBLISHED Published: 2025-04-30T14:54:58.945Z Last Updated: 2025-04-30T15:17:31.398Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-285 Description: XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are
the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rp38-24m3-rx87 - https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e - https://jira.xwiki.org/browse/XWIKI-22462
CVE ID: CVE-2025-32973 State: PUBLISHED Published: 2025-04-30T14:55:04.478Z Last Updated: 2025-04-30T15:15:04.046Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-862 Description: XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without programming rights and contains an XWiki.ComponentClass, there is no warning that this will grant programming rights to this object. An attacker who created such a
ponentClass, there is no warning that this will grant programming rights to this object. An attacker who created such a malicious object could use this to gain programming rights on the wiki. For this, the attacker needs to have edit rights on at least one page to place this object and then get an admin user to edit that document. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x7wv-5qg4-vmr6 - https://github.com/xwiki/xwiki-platform/commit/1a6f1b2e050770331c9a63d12a3fd8a36d199f62 - https://jira.xwiki.org/browse/XWIKI-22460
CVE ID: CVE-2025-32974 State: PUBLISHED Published: 2025-04-30T14:55:01.470Z Last Updated: 2025-04-30T15:15:51.720Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-116, CWE-269 Description: XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15.9 when there is content on the page like a script macro that would gain more rights due to the editing. This analysis doesn't consider certain kinds of properties, a
ript macro that would gain more rights due to the editing. This analysis doesn't consider certain kinds of properties, allowing a user to put malicious scripts in there that will be executed after a user with script, admin, or programming rights edited the page. Such a malicious script could impact the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in versions 15.10.8 and 16.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvgm-3rw2-7j4r - https://github.com/xwiki/xwiki-platform/commit/153dbfa2ef1a7a0a644fe3f889684c6a8738c5fc - https://jira.xwiki.org
-7j4r - https://github.com/xwiki/xwiki-platform/commit/153dbfa2ef1a7a0a644fe3f889684c6a8738c5fc - https://jira.xwiki.org/browse/XWIKI-22002
CVE ID: CVE-2025-32975 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-11-03T19:53:50.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
plete administrative takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978 - https://seclists.org/fulldisclosure/2025/Jun/22 - https://seralys.com/research/CVE-2025-32975.txt
CVE ID: CVE-2025-32976 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-11-03T19:53:51.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains a logic flaw in its two-factor authentication implementation that allows authenticated users to bypass TOTP-based 2FA requirements. The vulnerability exists in the 2FA validation process and can be exploited to gain elevated access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:
o gain elevated access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978 - https://seclists.org/fulldisclosure/2025/Jun/23 - https://seralys.com/research/CVE-2025-32976.txt
CVE ID: CVE-2025-32977 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-11-03T19:53:53.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to upload backup files to the system. While signature validation is implemented, weaknesses in the validation process can be exploited to upload malicious backup content that could compromise system integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://s
se system integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978 - https://seclists.org/fulldisclosure/2025/Jun/24 - https://seralys.com/research/CVE-2025-32977.txt