Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-64389 State: PUBLISHED Published: 2025-10-31T14:19:48.833Z Last Updated: 2025-11-03T19:11:41.770Z Vendors: Circutor Products: TCPRS1plus Problem Types: CWE-319 Description: The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cds.thalesgroup.com/es/s21sec - https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./ - https://www.hackrtu.com/blog/cg-0day-en-003/
CVE ID: CVE-2025-64401 State: PUBLISHED Published: 2025-11-12T08:58:18.371Z Last Updated: 2025-11-12T14:50:48.219Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-862 Description: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used "floating frames" linked to external files would load the contents of those frames without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended
prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. The LibreOffice suite reported this issue as CVE-2023-2255 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.openoffice.org/security/cves/CVE-2025-64401.html - https://lists.apache.org/thread/o00dtgvhr9tx8r4y8vf6y2mg7nn6mx6c
CVE ID: CVE-2025-64402 State: PUBLISHED Published: 2025-11-12T09:03:01.604Z Last Updated: 2025-11-12T14:49:16.168Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-862 Description: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used "OLE objects" linked to external files would load the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to up
ting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openoffice.org/security/cves/CVE-2025-64402.html - https://lists.apache.org/thread/tssrl88tygjsgk6csllm6p2fb6tlv8d8
CVE ID: CVE-2025-64403 State: PUBLISHED Published: 2025-11-12T09:04:50.392Z Last Updated: 2025-11-12T14:47:26.507Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-862 Description: Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links to be loaded without prompt. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
1.16, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openoffice.org/security/cves/CVE-2025-64403.html - https://lists.apache.org/thread/t7c6jhvdb00xtgd9vvn7h5sq9f4h5trt
CVE ID: CVE-2025-64404 State: PUBLISHED Published: 2025-11-12T09:08:34.261Z Last Updated: 2025-11-13T16:41:33.471Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-862 Description: Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used background fill images, or bullet images, linked to external files would load the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice:
d the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openoffice.org/security/cves/CVE-2025-64404.html - https://lists.apache.org/thread/08n4mdx0pnhqsllnkc63d27sdgq3tygc
CVE ID: CVE-2025-64405 State: PUBLISHED Published: 2025-11-12T09:10:35.778Z Last Updated: 2025-11-13T16:40:51.632Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-862 Description: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to external files would load the contents of those files without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgra
g the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openoffice.org/security/cves/CVE-2025-64405.html - https://lists.apache.org/thread/0jjftxkcc4l9kt7jjn630hfrh2ygfcbk
CVE ID: CVE-2025-64406 State: PUBLISHED Published: 2025-11-12T09:11:47.133Z Last Updated: 2025-11-12T17:09:01.642Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-787 Description: An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other memory areas. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openoffice.org/security/cves/CVE-2025-64406.html - https://lists.apache.org/threa
ulnrichment: References: - https://www.openoffice.org/security/cves/CVE-2025-64406.html - https://lists.apache.org/thread/py89gpogxfb2yo9c5vwv2h9x3m85pfmm
CVE ID: CVE-2025-64407 State: PUBLISHED Published: 2025-11-12T09:12:48.714Z Last Updated: 2025-11-13T16:32:12.202Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: CWE-862, CWE-201 Description: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. Such links could also be used to transmit system information, such as environment variables or configuration settings. In the affected versions of Apache OpenOffice, documents that used a certain URI scheme linking to external files would load the contents of such file
ache OpenOffice, documents that used a certain URI scheme linking to external files would load the contents of such files without prompting the user for permission to do so. Such URI scheme allows to include system configuration data, that is not supposed to be transmitted externally. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. The LibreOffice suite reported this issue as CVE-2024-12426. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.openoffice.org/security/cves/CVE-2025-64407.html - https://lists.apache.org/thread/4yg1gv71f14fw4ky4ds50o6xjq49594g
CVE ID: CVE-2025-64408 State: PUBLISHED Published: 2025-11-19T10:32:05.808Z Last Updated: 2025-11-20T04:55:22.650Z Vendors: Apache Software Foundation Products: Apache Causeway Problem Types: CWE-502 Description: Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. This issue affects all current versions. Users are recommended to upgrade to version 3.5.0, which fixes the issue. Additional Analyst Notes: - CVE Program Co
ns. Users are recommended to upgrade to version 3.5.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b
CVE ID: CVE-2025-64428 State: PUBLISHED Published: 2025-11-20T17:07:00.575Z Last Updated: 2025-11-21T16:18:57.597Z Vendors: dataease Products: dataease Problem Types: CWE-74 Description: Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-88ph-3236-2m2h - https://github.com/dataease/dataease/commit/b7e585c
thub.com/dataease/dataease/security/advisories/GHSA-88ph-3236-2m2h - https://github.com/dataease/dataease/commit/b7e585c1cc3fc2b73cb289b8680b4b3914be3d53 - https://github.com/dataease/dataease/releases/tag/v2.10.17
CVE ID: CVE-2025-64429 State: PUBLISHED Published: 2025-11-12T21:32:45.663Z Last Updated: 2025-11-13T16:45:43.375Z Vendors: duckdb Products: duckdb Problem Types: CWE-327 Description: DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or IVs. When clearing keys from memory, the compiler may remove the memset() and leave sensitive data on the heap. By modifying the database header, an attacker could downgrade the encryption mode from GCM to CTR to bypa
a on the heap. By modifying the database header, an attacker could downgrade the encryption mode from GCM to CTR to bypass integrity checks. There may be a failure to check return value on call to OpenSSL `rand_bytes()`. An attacker could use public IVs to compromise the internal state of RNG and determine the randomly generated key used to encrypt temporary files, get access to cryptographic keys if they have access to process memory (e.g. through memory leak),circumvent GCM integrity checks, and/or influence the OpenSSL random number generator and DuckDB would not be able to detect a failure of the generator. Version 1.4.2 has disabled the insecure random number generator by no longer usin
to detect a failure of the generator. Version 1.4.2 has disabled the insecure random number generator by no longer using the fallback to write to or create databases. Instead, DuckDB will now attempt to install and load the OpenSSL implementation in the `httpfs` extension. DuckDB now uses secure MbedTLS primitive to clear memory as recommended and requires explicit specification of ciphers without integrity checks like CTR on `ATTACH`. Additionally, DuckDB now checks the return code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/duckdb/duckdb/security/advisories/GHSA-vmp8-hg63-v2hp - https://github.com/duckdb/duckdb/pull/17275 - https://duckdb.org/2025/
/duckdb/security/advisories/GHSA-vmp8-hg63-v2hp - https://github.com/duckdb/duckdb/pull/17275 - https://duckdb.org/2025/09/16/announcing-duckdb-140.html - https://github.com/duckdb/duckdb/blob/029a5b87ff5b1cd22f7f9717d48cd8830d00807c/src/common/random_engine.cpp#L20
CVE ID: CVE-2025-64430 State: PUBLISHED Published: 2025-11-07T17:55:27.768Z Last Updated: 2025-11-07T18:23:02.250Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-918 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions 4.2.0 through 7.5.3, and 8.0.0 through 8.3.1-alpha.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a Parse.File with uri parameter, allowing execution of an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server
ameter, allowing execution of an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A request to the provided URI is executed, but the response is not stored in Parse Server's file storage as the server crashes upon receiving the response. This issue is fixed in versions 7.5.4 and 8.4.0-alpha.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx - https://github.com/parse-community/parse-server/pull/9903 - https://github.com/parse-community/parse-server/pull/9904 - https://github.com/pars
e-community/parse-server/pull/9903 - https://github.com/parse-community/parse-server/pull/9904 - https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51 - https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585
CVE ID: CVE-2025-64431 State: PUBLISHED Published: 2025-11-07T18:09:25.466Z Last Updated: 2025-11-07T18:29:24.551Z Vendors: zitadel Products: zitadel Problem Types: CWE-639 Description: Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is
ame, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-cpf4-pmr4-w6cx - https://github.com/zitadel/zitadel/commit/8dcfff97ed52a8b9fc77ecb1f972744f42cff3ed - https://github.com/zitadel/zitadel/releases/tag/v4.6.3
CVE ID: CVE-2025-64432 State: PUBLISHED Published: 2025-11-07T18:38:33.246Z Last Updated: 2025-11-07T18:54:46.779Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: kubevirt Products: kubevirt Problem Types: CWE-287, CWE-295 Description: KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in
ate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GHSA-38jw-g2qx-4286 - https://
ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GHSA-38jw-g2qx-4286 - https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6a - https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5b - https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074
CVE ID: CVE-2025-64433 State: PUBLISHED Published: 2025-11-07T23:07:31.434Z Last Updated: 2025-11-10T16:52:41.772Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: kubevirt Products: kubevirt Problem Types: CWE-22 Description: KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM. Specifically, if a malicious user has full or partial control over the contents of a PVC, they can create a symbolic link that points to a file within th
has full or partial control over the contents of a PVC, they can create a symbolic link that points to a file within the virt-launcher pod's file system. Since libvirt can treat regular files as block devices, any file on the pod's file system that is symlinked in this way can be mounted into the VM and subsequently read. Although a security mechanism exists where VMs are executed as an unprivileged user with UID 107 inside the virt-launcher container, limiting the scope of accessible resources, this restriction is bypassed due to a second vulnerability. The latter causes the ownership of any file intended for mounting to be changed to the unprivileged user with UID 107 prior to mounting. A
the ownership of any file intended for mounting to be changed to the unprivileged user with UID 107 prior to mounting. As a result, an attacker can gain access to and read arbitrary files located within the virt-launcher pod's file system or on a mounted PVC from within the guest VM. This vulnerability is fixed in 1.5.3 and 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GHSA-qw6q-3pgr-5cwq - https://github.com/kubevirt/kubevirt/commit/09eafa068ec01eca0e96ebafeeb9522a878dbf64 - https://github.com/kubevirt/kubevirt/commit/9dc798cb1efe924a9a2b97b6e016452dec5e3849 - https://github.com/kubevirt/kubevirt/commit/a81b2
om/kubevirt/kubevirt/commit/9dc798cb1efe924a9a2b97b6e016452dec5e3849 - https://github.com/kubevirt/kubevirt/commit/a81b27d4600cf654274dd197119658382affdb08
CVE ID: CVE-2025-64434 State: PUBLISHED Published: 2025-11-07T22:54:04.772Z Last Updated: 2025-11-10T19:03:26.345Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: kubevirt Products: kubevirt Problem Types: CWE-287 Description: KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vul
t other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GHSA-ggp9-c99x-54gp - https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6a - https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5b - https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074
CVE ID: CVE-2025-64435 State: PUBLISHED Published: 2025-11-07T22:57:02.600Z Last Updated: 2025-11-10T19:01:13.977Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: kubevirt Products: kubevirt Problem Types: CWE-703 Description: KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denia
r into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GHSA-9m94-w2vq-hcf9 - https://github.com/kubevirt/kubevirt/commit/9a6f4a3a707992038ef705da4cb3bba8c89d36ba
CVE ID: CVE-2025-64436 State: PUBLISHED Published: 2025-11-07T22:59:47.228Z Last Updated: 2025-11-10T18:53:09.436Z Vendors: kubevirt Products: kubevirt Problem Types: CWE-269, CWE-276 Description: KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could otherwise allow an attacker to mark all nodes as unschedulable, potentially forcing the migration or creation of privileged pods onto a compromised node. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
migration or creation of privileged pods onto a compromised node. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GHSA-7xgm-5prm-v5gc
CVE ID: CVE-2025-64437 State: PUBLISHED Published: 2025-11-07T23:04:10.913Z Last Updated: 2025-11-10T18:50:16.445Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: kubevirt Products: kubevirt Problem Types: CWE-59 Description: KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availabili
with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GHSA-2r4r-5x78-mvqf - https://github.com/kubevirt/kubevirt/commit/3ce9f41c54d04a65f10b23a46771391c00659afb - https://github.com/kubevirt/kubevirt/commit/8644dbe0d04784b0bfa8395b91ecbd6001f88f6b - https://github.com/kubevirt/kubevirt/commit/f59ca63133f25de8fceb3e2
rt/commit/8644dbe0d04784b0bfa8395b91ecbd6001f88f6b - https://github.com/kubevirt/kubevirt/commit/f59ca63133f25de8fceb3e2a0e5cc0b7bdb6a265