Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1019 State: PUBLISHED Published: 2025-02-04T13:58:54.064Z Last Updated: 2025-02-05T19:05:20.629Z Vendors: Mozilla Products: Firefox, Thunderbird Problem Types: Fullscreen notification not properly displayed Description: The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability affects Firefox < 135 and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1940162 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1020 State: PUBLISHED Published: 2025-02-04T13:58:56.390Z Last Updated: 2025-02-06T21:07:04.887Z Vendors: Mozilla Products: Firefox, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 135 and Thunderbird 135 Description: Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135 and Thunderbird < 135. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1939063%2C1942169 - https://www.mozilla.org/security
ment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1939063%2C1942169 - https://www.mozilla.org/security/advisories/mfsa2025-07/ - https://www.mozilla.org/security/advisories/mfsa2025-11/
CVE ID: CVE-2025-1021 State: PUBLISHED Published: 2025-04-23T02:49:45.313Z Last Updated: 2025-04-23T13:10:06.150Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-862 Description: Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_25_03
CVE ID: CVE-2025-1022 State: PUBLISHED Published: 2025-02-05T05:00:15.399Z Last Updated: 2025-03-16T13:16:06.494Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P) Vendors: n/a Products: spatie/browsershot Problem Types: CWE-20 Description: Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content. Additional Analyst Notes: - CISA ADP
should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496747 - https://github.com/spatie/browsershot/commit/bcfd608b264fab654bf78e199bdfbb03e9323eb7 - https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72 - https://gist.github.com/mrdgef/a820837c530e09e1dd725e013e0d4341
CVE ID: CVE-2025-1023 State: PUBLISHED Published: 2025-02-18T09:45:26.188Z Last Updated: 2025-02-18T14:27:27.899Z Vendors: ChurchCRM Products: ChurchCRM Problem Types: CWE-89 Description: A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Additional Analyst Notes: - CISA ADP Vulnrichment: R
otentially leading to data exfiltration, modification, or deletion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/7246
CVE ID: CVE-2025-1024 State: PUBLISHED Published: 2025-02-19T08:34:55.967Z Last Updated: 2025-02-19T19:40:43.255Z Vendors: ChurchCRM Products: ChurchCRM Problem Types: CWE-287 Description: A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting (XSS) in the EditEventAttendees.php page. This requires Administration privileges and affects the EID parameter. The flaw allows an attacker to steal session cookies, perform actions on behalf of an authenticated user, and gain unauthorized access to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Chu
rized access to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/7250
CVE ID: CVE-2025-1025 State: PUBLISHED Published: 2025-02-05T05:00:16.269Z Last Updated: 2025-02-05T19:27:09.793Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P) Vendors: n/a Products: cockpit-hq/cockpit Problem Types: CWE-434 Description: Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-COCKPITHQCOCKPIT-8516320 - https://github.com/Cockpit-HQ/Cockpit/commit/becca806c7071ecc732521bb5ad0bb9c64299592 - https://github.com/Cockpit-HQ/Cockpit/commi
hub.com/Cockpit-HQ/Cockpit/commit/becca806c7071ecc732521bb5ad0bb9c64299592 - https://github.com/Cockpit-HQ/Cockpit/commit/984ef9ad270357b843af63c81db95178eae42cae - https://gist.github.com/CHOOCS/fe1227443544d5d74c33982814f290af
CVE ID: CVE-2025-1026 State: PUBLISHED Published: 2025-02-05T05:00:01.940Z Last Updated: 2025-02-12T20:51:31.059Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P) Vendors: n/a Products: spatie/browsershot Problem Types: CWE-20 Description: Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files. **Note:** This is a bypass of the fix for [CVE-2024-21549](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023). Additional Analyst Notes: - CISA ADP Vulnrichment: References:
curity.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533024 - https://gist.github.com/chuajianshen/6291920112fcf1543fa7b43862112be6 - https://github.com/spatie/browsershot/pull/908 - https://gist.github.com/mrdgef/54a8783408220c67c1b859df38a52d65 - https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72
CVE ID: CVE-2025-1028 State: PUBLISHED Published: 2025-02-05T03:21:17.570Z Last Updated: 2025-02-12T20:51:31.280Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: kleor Products: Contact Manager Problem Types: CWE-434 Description: The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to, and including, 8.6.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in specific configurations where the first extension is processed over the final. This
ke remote code execution possible in specific configurations where the first extension is processed over the final. This vulnerability also requires successfully exploiting a race condition in order to exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f51a8e-4a59-4b64-b0c6-2ce3933a1df5?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/contact-manager/tags/8.6.4&new_path=/contact-manager/tags/8.6.5&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1033 State: PUBLISHED Published: 2025-05-15T20:07:25.881Z Last Updated: 2025-05-20T19:11:58.048Z Vendors: Unknown Products: Badgearoo Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cbb63e80-92aa-4e85-9d47-dc68211af97d/
CVE ID: CVE-2025-1035 State: PUBLISHED Published: 2025-02-18T11:30:15.634Z Last Updated: 2025-02-18T14:14:39.617Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Komtera Technolgies Products: KLog Server Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls.This issue affects KLog Server: before 3.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0037 - https://www.klogserver.com/surum-notlari/3-1-1/
CVE ID: CVE-2025-1036 State: PUBLISHED Published: 2025-10-28T12:15:29.573Z Last Updated: 2025-10-28T13:14:18.210Z Vendors: Hitachi Energy Products: TropOS 4th Gen Problem Types: CWE-78 Description: Command injection vulnerability exists in the “Logging” page of the web-based configuration utility. An authenticated user with low privileged network access for the configuration utility can execute arbitrary commands on the underlying OS to obtain root SSH access to the TropOS 4th Gen device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-1037 State: PUBLISHED Published: 2025-10-28T12:16:36.060Z Last Updated: 2025-10-28T13:13:02.115Z Vendors: Hitachi Energy Products: TropOS 4th Gen Problem Types: CWE-269 Description: By making minor configuration changes to the TropOS 4th Gen device, an authenticated user with the ability to run user level shell commands can enable access via secure shell (SSH) to an unrestricted root shell. This is possible through abuse of a particular set of scripts and executables that allow for certain commands to be run as root from an unprivileged context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&
Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-1038 State: PUBLISHED Published: 2025-10-28T12:17:23.182Z Last Updated: 2025-10-28T13:11:10.628Z Vendors: Hitachi Energy Products: TropOS 4th Gen Problem Types: CWE-78 Description: The “Diagnostics Tools” page of the web-based configuration utility does not properly validate user-controlled input, allowing an authenticated user with high privileges to inject commands into the command shell of the TropOS 4th Gen device. The injected commands can be exploited to execute several set-uid (SUID) applications to ultimately gain root access to the TropOS device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000214&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-1039 State: PUBLISHED Published: 2025-02-20T12:41:33.954Z Last Updated: 2025-02-20T13:56:49.684Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: yonifre Products: Lenix Leads Collector Problem Types: CWE-79 Description: The Lenix Elementor Leads addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a URL form field in all versions up to, and including, 1.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29f835c8-769a-47c0-832f-622860b1c59c?source=cve - https://plugins.trac.wordpress.org/changeset/3237538/lenix-elementor-leads-addon
CVE ID: CVE-2025-1040 State: PUBLISHED Published: 2025-03-20T10:11:05.749Z Last Updated: 2025-10-15T12:50:50.369Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: significant-gravitas Products: significant-gravitas/autogpt Problem Types: CWE-1336 Description: AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). The vulnerability arises from the improper handling of user-supplied format strings in the `AgentOutputBlock` implementation, where malicious input is passed to the Jinja2 templating engine without adequate security measures. Attackers can exploit this flaw to execute
is passed to the Jinja2 templating engine without adequate security measures. Attackers can exploit this flaw to execute arbitrary commands on the host system. The issue is fixed in version 0.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/b74ef75f-61d5-4422-ab15-9550c8b4f185 - https://github.com/significant-gravitas/autogpt/commit/6dba31e0215549604bdcc1aed24e3a1714e75ee2
CVE ID: CVE-2025-1041 State: PUBLISHED Published: 2025-06-10T06:05:25.883Z Last Updated: 2025-06-10T20:00:17.556Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Avaya Products: Avaya Call Management System Problem Types: CWE-20 Description: An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.avaya.com/css/public/documents/101093084
CVE ID: CVE-2025-1042 State: PUBLISHED Published: 2025-02-12T15:02:02.171Z Last Updated: 2025-02-12T15:12:26.513Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-552 Description: An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/50849943 - https://hackerone.com/reports/2886976
CVE ID: CVE-2025-1043 State: PUBLISHED Published: 2025-02-20T11:09:30.575Z Last Updated: 2025-02-20T14:17:51.926Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: awsmin Products: Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Problem Types: CWE-918 Description: The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and
Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f8c600-d62d-4f27-ba73-1a77a63859bc?source=cve - https://plugins.trac.wordpress.org/changeset/3242370/embed-any-document
CVE ID: CVE-2025-1044 State: PUBLISHED Published: 2025-02-11T19:55:11.006Z Last Updated: 2025-02-12T14:32:55.170Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-287 Description: Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 443 by default. The issue results from the lack of proper implementation of the authenti
vice, which listens on TCP port 443 by default. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25336. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-085/ - https://support.logsign.net/hc/en-us/articles/22076844908946-18-10-2024-Version-6-4-32-Release-Notes
CVE ID: CVE-2025-1045 State: PUBLISHED Published: 2025-04-23T16:42:57.311Z Last Updated: 2025-04-23T18:35:00.623Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Viewer Problem Types: CWE-122 Description: Luxion KeyShot Viewer KSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from t
icious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24586. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-233/ - https://download.keyshot.com/cert/ksa-113962/ksa-113962.pdf?version=1.0&_gl=1*1x6i3a*_gcl_au*MTU0ODMwNDI4Ny4xNzQzNTUyMjcx
CVE ID: CVE-2025-1046 State: PUBLISHED Published: 2025-04-23T16:43:48.216Z Last Updated: 2025-04-23T18:31:52.023Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Problem Types: CWE-416 Description: Luxion KeyShot SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existen
ile. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23646. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-231/ - https://download.keyshot.com/cert/ksa-113962/ksa-113962.pdf?version=1.0&_gl=1*1x6i3a*_gcl_au*MTU0ODMwNDI4Ny4xNzQzNTUyMjcx
CVE ID: CVE-2025-1047 State: PUBLISHED Published: 2025-04-23T16:44:02.108Z Last Updated: 2025-04-23T18:24:59.949Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Problem Types: CWE-824 Description: Luxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pvs files. The issue results from the lack of prope
pen a malicious file. The specific flaw exists within the parsing of pvs files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23694. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-232/ - https://download.keyshot.com/cert/ksa-113962/ksa-113962.pdf?version=1.0&_gl=1*1x6i3a*_gcl_au*MTU0ODMwNDI4Ny4xNzQzNTUyMjcx
CVE ID: CVE-2025-1048 State: PUBLISHED Published: 2025-04-23T16:44:16.757Z Last Updated: 2025-04-23T18:27:53.552Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sonos Products: Era 300 Problem Types: CWE-416 Description: Sonos Era 300 Speaker libsmb2 Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SMB data. The issue results from the lack of validating the existence of an object prior to performing operations on the
SMB data. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Was ZDI-CAN-25535. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-223/
CVE ID: CVE-2025-1049 State: PUBLISHED Published: 2025-04-23T16:44:33.899Z Last Updated: 2025-04-23T18:19:22.757Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sonos Products: Era 300 Problem Types: CWE-122 Description: Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of ID3 data. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer
esults from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Was ZDI-CAN-25601. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-224/
CVE ID: CVE-2025-1050 State: PUBLISHED Published: 2025-04-23T16:44:54.918Z Last Updated: 2025-04-23T18:15:44.046Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sonos Products: Era 300 Problem Types: CWE-787 Description: Sonos Era 300 Out-of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HLS playlist data. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an alloca