Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
a Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service and Unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE ID: CVE-2025-43938 State: PUBLISHED Published: 2025-09-10T16:03:38.951Z Last Updated: 2025-09-10T18:04:13.097Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: Dell Products: PowerProtect Data Manager Problem Types: CWE-256 Description: Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to gain unauthorized access with privileges of the compromised account. Additional Analyst Notes:
e exposed credentials to gain unauthorized access with privileges of the compromised account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE ID: CVE-2025-43939 State: PUBLISHED Published: 2025-10-30T14:10:14.508Z Last Updated: 2025-10-31T03:55:21.085Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-updat
s: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2025-43940 State: PUBLISHED Published: 2025-10-30T14:05:17.818Z Last Updated: 2025-10-31T03:55:21.915Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-updat
CVE ID: CVE-2025-43941 State: PUBLISHED Published: 2025-10-30T13:57:25.065Z Last Updated: 2025-10-31T03:55:29.572Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary command with root privileges. This vulnerability only affects systems without a valid license install. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.d
systems without a valid license install. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2025-43942 State: PUBLISHED Published: 2025-10-30T14:23:26.312Z Last Updated: 2025-10-31T03:55:22.772Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-updat
CVE ID: CVE-2025-43943 State: PUBLISHED Published: 2025-09-25T15:22:10.962Z Last Updated: 2025-09-25T16:06:17.102Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Cloud Disaster Recovery Problem Types: CWE-78 Description: Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/0003
ivileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000372457/dsa-2025-354-security-update-for-dell-cloud-disaster-recovery-rce-vulnerability
CVE ID: CVE-2025-43946 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-25T14:50:18.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: TCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload (combined with Path Traversal). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tcpwave.com/ddi-dns-dhcp-ipam - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-43946
CVE ID: CVE-2025-43947 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T20:46:28.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to perform all the actions that an admin can perform, such as modifying the configuration, creating a user, uploading files, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://de.linkedin.com/company/codemers - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-43947
CVE ID: CVE-2025-43948 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T20:45:27.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier (such as for sorting), which will get executed on the server side. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://de.linkedin.com/company/codemers - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-43948
CVE ID: CVE-2025-43949 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T13:26:52.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: MuM (aka Mensch und Maschine) MapEdit (aka mapedit-web) 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious SQL statements that control a web application's database server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mum.de/produkte/mum-mapedit - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-43949
CVE ID: CVE-2025-43950 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T13:25:01.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: DPMAdirektPro 4.1.5 is vulnerable to DLL Hijacking. It happens by placing a malicious DLL in a directory (in the absence of a legitimate DLL), which is then loaded by the application instead of the legitimate DLL. This causes the malicious DLL to load with the same privileges as the application, thus causing a privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dpma.de/english/services/efiling/dpmadirekt/downloads/index.html - https://github.com/Henkel-CyberVM/CVEs/tree/main
/www.dpma.de/english/services/efiling/dpmadirekt/downloads/index.html - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-43950
CVE ID: CVE-2025-43951 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T13:22:33.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via the objectname request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.labvantage.com/informatics/lims/ - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-43951
CVE ID: CVE-2025-43952 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T20:30:56.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0 (440). It allows an attacker to inject malicious scripts via the IW_SessionID_ parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mt.com/FreeWeighNet - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-43952
CVE ID: CVE-2025-43953 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-22T17:52:41.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: In 2wcom IP-4c 2.16, the web interface allows admin and manager users to execute arbitrary code as root via a ping or traceroute field on the TCP/IP screen. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://2wcom.com - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-43953
CVE ID: CVE-2025-43954 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-04-21T13:43:34.198Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Quasar Products: QMarkdown Problem Types: CWE-79 Description: QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/quasarframework/quasar-ui-qmarkdown/commit/b61dff84851c45369cf931db5bd93db177c657f6 - https://github.com/quasarframework/quasar-ui-qmarkdown/compare/v2.0.4...v2.0.5
CVE ID: CVE-2025-43955 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-04-21T13:32:03.357Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Convertigo Products: Convertigo Problem Types: CWE-749 Description: TwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/convertigo/convertigo/issues/898
CVE ID: CVE-2025-43960 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-25T13:39:13.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manu
e the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vrana/adminer/compare/v4.8.1...v4.8.2 - https://www.adminer.org - https://github.com/Seldaek/monolog - https://github.com/far00t01/CVE-2025-43960
CVE ID: CVE-2025-43961 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-11-03T20:04:07.425Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: LibRaw Products: LibRaw Problem Types: CWE-125 Description: In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libraw.org/news/libraw-0-21-4-release - https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 - https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2
CVE ID: CVE-2025-43962 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-11-03T20:04:08.805Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: LibRaw Products: LibRaw Problem Types: CWE-125 Description: In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libraw.org/news/libraw-0-21-4-release - https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 - https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd6
ase - https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 - https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2
CVE ID: CVE-2025-43963 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-11-03T20:04:10.173Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: LibRaw Products: LibRaw Problem Types: CWE-125 Description: In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libraw.org/news/libraw-0-21-4-release - https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 - https://github.com/LibRaw/LibRaw/commit/be26e7639ecf8beb55f124ce
ps://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 - https://github.com/LibRaw/LibRaw/commit/be26e7639ecf8beb55f124ce780e99842de2e964
CVE ID: CVE-2025-43964 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-11-03T20:04:11.572Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: LibRaw Products: LibRaw Problem Types: CWE-1284 Description: In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libraw.org/news/libraw-0-21-4-release - https://github.com/LibRaw/LibRaw/compare/0.21.3...0.21.4 - https://github.com/LibRaw/LibRaw/commit/a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0
CVE ID: CVE-2025-43965 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-26T23:03:02.375Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-131 Description: In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22 - https://github.com/ImageMagick/ImageMagick/commit/bac413a26073923d3ffb258adaab07fb3fe8fdc9
CVE ID: CVE-2025-43966 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-04-21T02:11:39.099Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: struktur Products: libheif Problem Types: CWE-476 Description: libheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/strukturag/libheif/commit/b38555387e4b5dcf036fe45b0c440aca19b7b69c - https://github.com/strukturag/libheif/compare/v1.19.5...v1.19.6
CVE ID: CVE-2025-43967 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-04-21T02:10:32.788Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: struktur Products: libheif Problem Types: CWE-476 Description: libheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image-items/grid.cc because a grid image can reference a nonexistent image item. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/strukturag/libheif/compare/v1.19.5...v1.19.6 - https://github.com/strukturag/libheif/issues/1455 - https://github.com/strukturag/libheif/commit/6e35af7b0ff9fb6cc952a1539590d160db32f671
CVE ID: CVE-2025-43970 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T01:56:11.101Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: GoBGP Products: GoBGP Problem Types: CWE-1284 Description: An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0 - https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0
CVE ID: CVE-2025-43971 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T01:55:21.073Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: GoBGP Products: GoBGP Problem Types: CWE-193 Description: An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0 - https://github.com/osrg/gobgp/commit/08a001e06d90e8bcc190084c66992f46f62c0986
CVE ID: CVE-2025-43972 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T01:54:34.786Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: GoBGP Products: GoBGP Problem Types: CWE-1284 Description: An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0 - https://github.com/osrg/gobgp/commit/ca7383f450f7b296c5389feceef2467de5ab6e5a
CVE ID: CVE-2025-43973 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T01:52:59.432Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: GoBGP Products: GoBGP Problem Types: CWE-193 Description: An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0 - https://github.com/osrg/gobgp/commit/5693c58a4815cc6327b8d3b6980f0e5aced28abe
CVE ID: CVE-2025-43976 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T15:51:13.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: The com.enflick.android.tn2ndLine application through 24.17.1.0 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.enflick.android.tn2ndLine - https://github.com/actuator/com.enflick.android.tn2ndLine - https://github.com/actuator/com.enflick.andr
oid.tn2ndLine - https://github.com/actuator/com.enflick.android.tn2ndLine - https://github.com/actuator/com.enflick.android.tn2ndLine/blob/main/CVE-2025-43976
CVE ID: CVE-2025-43977 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T15:51:32.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: The com.skt.prod.dialer application through 12.5.0 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.skt.prod.dialer.activities.outgoingcall.OutgoingCallInternalBroadcaster component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.skt.prod.dialer - https://github.com/actuator/com.skt.prod.dialer - https://github.com/actuator/com.skt.prod.dialer/blob/ma
.prod.dialer - https://github.com/actuator/com.skt.prod.dialer - https://github.com/actuator/com.skt.prod.dialer/blob/main/CVE-2025-43977
CVE ID: CVE-2025-43978 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-05T19:59:14.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=set_WPS_pin and /ubus/?flag=netAppStar1 and /ubus/?flag=set_wifi_cfgs. This allows an authenticated attacker to execute arbitrary OS commands with root privileges via crafted inputs to the SSID, WPS, Traceroute, and Ping fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jointelli.com/cpe/5g-cpe-evo-4.html - https://github.com/actuator/cve
- CISA ADP Vulnrichment: References: - https://www.jointelli.com/cpe/5g-cpe-evo-4.html - https://github.com/actuator/cve/tree/main/Jointelli - https://www.jointelli.com/product/25H01 - https://github.com/actuator/cve/blob/main/Jointelli/CVE-2025-43978.txt
CVE ID: CVE-2025-43979 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-05T19:57:59.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system commands with root privileges via crafted payloads to the xml_action.cgi?method= endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/tree/main/Firstnum - https://github.com/actuator/cve/blob/main/Firstnum/CVE-2025-43979.txt
CVE ID: CVE-2025-43980 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-05T20:00:21.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. They enable the SSH service by default with the credentials of root/admin. The GUI doesn't offer a way to disable the account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/tree/main/Firstnum - https://github.com/actuator/cve/blob/main/Firstnum/CVE-2025-43980.txt
CVE ID: CVE-2025-43982 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-14T14:04:16.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be disabled in the GUI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/tree/main/Tuoshi - https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2025-43982.txt