Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
vent rate-limiting or blocking mechanisms. Any organization running a publicly accessible Kanboard instance is affected, especially if relying on IP-based protections like Fail2Ban or CAPTCHA for login rate-limiting. Attackers with access to the login page can exploit this flaw to enumerate valid usernames and bypass IP-based blocking mechanisms, putting all user accounts at higher risk of brute-force or credential stuffing attacks. Version 1.2.46 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-qw57-7cx6-wvp7 - https://github.com/kanboard/kanboard/commit/3079623640dc39f9c7b0c840d2a7
board/security/advisories/GHSA-qw57-7cx6-wvp7 - https://github.com/kanboard/kanboard/commit/3079623640dc39f9c7b0c840d2a79095331051f1 - https://github.com/kanboard/kanboard/blob/cbb7e60fb595ff4572bb8801b275a0b451c4bda0/app/Model/UserLockingModel.php#L101-L104 - https://github.com/kanboard/kanboard/blob/cbb7e60fb595ff4572bb8801b275a0b451c4bda0/app/Subscriber/AuthSubscriber.php#L96-L108
CVE ID: CVE-2025-52577 State: PUBLISHED Published: 2025-07-10T23:24:42.965Z Last Updated: 2025-07-11T13:39:11.777Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: iView Problem Types: CWE-89 Description: A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not properly sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account. Additional Analyst Notes: - CIS
and potentially execute code in the context of the 'nt authority\local service' account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183
CVE ID: CVE-2025-52578 State: PUBLISHED Published: 2025-11-18T03:26:20.887Z Last Updated: 2025-11-19T16:49:32.455Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Gallagher Products: High Sec End of Line Module Problem Types: CWE-335 Description: Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed
.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52578
CVE ID: CVE-2025-52579 State: PUBLISHED Published: 2025-07-10T23:37:21.515Z Last Updated: 2025-07-11T13:55:15.422Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Emerson Products: ValveLink SOLO, ValveLink DTM, ValveLink PRM, ValveLink SNAP-ON Problem Types: CWE-316 Description: Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa
t. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01 - https://www.emerson.com/en-us/support/security-notifications - https://www.emerson.com/en-us/support/software-downloads-drivers
CVE ID: CVE-2025-52580 State: PUBLISHED Published: 2025-07-22T04:49:33.459Z Last Updated: 2025-07-22T15:36:00.332Z Severity: LOW (CVSS 2.4 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Gift Pad Co.,Ltd. Products: "region PAY" App for Android Problem Types: CWE-532 Description: Insertion of sensitive information into log file issue exists in "region PAY" App for Android prior to 1.5.28. If exploited, sensitive user information may be exposed to an attacker who has access to the application logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN07825095/
CVE ID: CVE-2025-52581 State: PUBLISHED Published: 2025-08-25T13:53:48.423Z Last Updated: 2025-11-03T18:13:07.418Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-190 Description: An integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted GDF file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TAL
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2233
CVE ID: CVE-2025-52583 State: PUBLISHED Published: 2025-10-16T10:03:14.116Z Last Updated: 2025-10-16T13:12:49.634Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: NEOJAPAN Inc. Products: desknet's Web Server Problem Types: CWE-79 Description: Reflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.desknets.com/neo/support/mainte/17475/ - https://jvn.jp/en/jp/JVN90757550/
CVE ID: CVE-2025-52584 State: PUBLISHED Published: 2025-08-18T21:09:30.297Z Last Updated: 2025-08-19T13:28:52.752Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt, Xenon, Argon, Lithium, Cobalt Share Problem Types: CWE-122 Description: In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment
ility to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01
CVE ID: CVE-2025-52585 State: PUBLISHED Published: 2025-08-13T14:46:53.883Z Last Updated: 2025-08-13T19:43:53.673Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-476 Description: When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000141436
CVE ID: CVE-2025-52586 State: PUBLISHED Published: 2025-08-08T16:00:43.694Z Last Updated: 2025-09-08T17:06:06.953Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: EG4 Electronics Products: EG4 12kPV, EG4 18kPV, EG4 Flex 21, EG4 Flex 18, EG4 6000XP, EG4 12000XP, EG4 GridBoss Problem Types: CWE-319 Description: The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write operations for voltage, current, and power configuration, operat
e, replay, or forge critical data, including read/write operations for voltage, current, and power configuration, operational status, alarms, telemetry, system reset, or inverter control commands, potentially disrupting power generation or reconfiguring inverter settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07 - https://eg4electronics.com/contact/ - https://eg4electronics.com/wp-content/uploads/2025/09/EG4-Wi-Fi-Dongle-Dongle-Firmware-Update.pdf
CVE ID: CVE-2025-52602 State: PUBLISHED Published: 2025-11-05T14:46:46.537Z Last Updated: 2025-11-12T17:41:31.409Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: BigFix Query Problem Types: CWE-359 Description: HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs). An attacker can use that information to target individuals with phishing or other social-engineering attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?
ineering attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124950
CVE ID: CVE-2025-52614 State: PUBLISHED Published: 2025-10-12T07:52:47.028Z Last Updated: 2025-10-14T14:53:42.958Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: Unica Platform Problem Types: CWE-614 Description: HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417
CVE ID: CVE-2025-52615 State: PUBLISHED Published: 2025-10-12T08:18:20.960Z Last Updated: 2025-10-16T18:10:40.108Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: Unica Platform Problem Types: CWE-693 Description: HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417
CVE ID: CVE-2025-52616 State: PUBLISHED Published: 2025-10-12T04:24:59.935Z Last Updated: 2025-10-15T20:52:05.956Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: HCL Software Products: Unica Problem Types: CWE-497 Description: HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124230
CVE ID: CVE-2025-52618 State: PUBLISHED Published: 2025-08-15T22:49:23.810Z Last Updated: 2025-08-18T14:50:10.917Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: HCL Software Products: BigFix SaaS Remediate Problem Types: CWE-89 Description: HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipulate SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330
CVE ID: CVE-2025-52619 State: PUBLISHED Published: 2025-08-15T22:48:40.096Z Last Updated: 2025-08-18T14:51:20.516Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: BigFix SaaS Remediate Problem Types: CWE-209 Description: HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose sensitive version information about the underlying platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330
CVE ID: CVE-2025-52620 State: PUBLISHED Published: 2025-08-15T22:47:49.433Z Last Updated: 2025-08-18T14:52:13.448Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: HCL Software Products: BigFix SaaS Remediate Problem Types: CWE-20 Description: HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the submitted image format. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330
CVE ID: CVE-2025-52621 State: PUBLISHED Published: 2025-08-15T22:45:55.628Z Last Updated: 2025-08-18T19:00:48.752Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: BigFix SaaS Remediate Problem Types: CWE-346 Description: HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330
CVE ID: CVE-2025-52624 State: PUBLISHED Published: 2025-10-10T10:25:32.591Z Last Updated: 2025-10-10T16:21:31.964Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Products: AION Problem Types: CWE-1032 Description: A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444
CVE ID: CVE-2025-52625 State: PUBLISHED Published: 2025-10-10T10:28:53.219Z Last Updated: 2025-10-10T15:51:43.666Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Products: AION Problem Types: CWE-525 Description: A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444
CVE ID: CVE-2025-52630 State: PUBLISHED Published: 2025-10-10T09:55:59.009Z Last Updated: 2025-10-22T20:37:27.200Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Products: AION Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444
CVE ID: CVE-2025-52632 State: PUBLISHED Published: 2025-10-10T10:06:04.509Z Last Updated: 2025-10-10T16:34:12.221Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: HCL Products: AION Problem Types: CWE-614 Description: A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444
CVE ID: CVE-2025-52634 State: PUBLISHED Published: 2025-10-10T09:40:05.014Z Last Updated: 2025-10-10T16:48:51.629Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Products: HCL AION Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444
CVE ID: CVE-2025-52635 State: PUBLISHED Published: 2025-10-10T10:21:30.433Z Last Updated: 2025-10-10T16:27:41.610Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Products: AION Problem Types: CWE-1032 Description: A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444
CVE ID: CVE-2025-52639 State: PUBLISHED Published: 2025-11-18T18:58:06.174Z Last Updated: 2025-11-18T20:21:35.778Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: Connections Problem Types: CWE-201 Description: HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124241
CVE ID: CVE-2025-52647 State: PUBLISHED Published: 2025-10-10T22:14:50.101Z Last Updated: 2025-10-14T15:00:24.739Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: HCL Software Products: BigFix WebUI Problem Types: CWE-644 Description: The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124562
CVE ID: CVE-2025-52650 State: PUBLISHED Published: 2025-10-10T09:30:14.115Z Last Updated: 2025-10-10T13:36:18.603Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: HCL Products: HCL AION Problem Types: CWE-1032 Description: Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444
CVE ID: CVE-2025-52653 State: PUBLISHED Published: 2025-10-03T17:59:44.591Z Last Updated: 2025-10-03T18:33:23.718Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H) Vendors: HCL Products: HCL MyXalytics Problem Types: CWE-79 Description: HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
CVE ID: CVE-2025-52654 State: PUBLISHED Published: 2025-10-03T18:11:20.450Z Last Updated: 2025-10-10T13:40:06.170Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: HCL MyXalytics Problem Types: CWE-80 Description: HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
CVE ID: CVE-2025-52655 State: PUBLISHED Published: 2025-10-10T08:55:40.033Z Last Updated: 2025-10-10T13:46:15.359Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: HCL Products: HCL MyXalytics Problem Types: CWE-829 Description: Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
CVE ID: CVE-2025-52656 State: PUBLISHED Published: 2025-10-03T18:20:18.752Z Last Updated: 2025-10-03T18:43:17.842Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: HCL Products: HCL MyXalytics Problem Types: CWE-915 Description: HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
CVE ID: CVE-2025-52658 State: PUBLISHED Published: 2025-10-03T18:16:00.261Z Last Updated: 2025-10-10T14:36:15.317Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: MyXalytics Problem Types: CWE-1104 Description: HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
CVE ID: CVE-2025-52662 State: PUBLISHED Published: 2025-11-07T00:43:27.913Z Last Updated: 2025-11-07T18:39:49.230Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: Vercel Products: Nuxt Devtools Description: A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nuxt/devtools/commit/7cadbbe9 - https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtool
es: - https://github.com/nuxt/devtools/commit/7cadbbe9 - https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools
CVE ID: CVE-2025-52663 State: PUBLISHED Published: 2025-10-30T23:30:28.298Z Last Updated: 2025-11-03T15:36:24.687Z Vendors: Ubiquiti Inc Products: UniFi Talk Touch, UniFi Talk Touch Max, UniFi Talk G3 Phones Description: A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations through the device API. Affected Products: UniFi Talk Touch (Version 1.21.16 and earlier) UniFi Talk Touch Max (Version 2.21.22 and earlier) UniFi Talk G3 Phones (Version 3.21.26 and earlier) Mitigation: Update the UniFi Talk
h Max (Version 2.21.22 and earlier) UniFi Talk G3 Phones (Version 3.21.26 and earlier) Mitigation: Update the UniFi Talk Touch to Version 1.21.17 or later. Update the UniFi Talk Touch Max to Version 2.21.23 or later. Update the UniFi Talk G3 Phones to Version 3.21.27 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-055-055/9b65527b-489c-4f16-ac34-2b887754db1e