Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48958 State: PUBLISHED Published: 2025-06-02T11:18:27.230Z Last Updated: 2025-06-02T16:41:18.444Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: froxlor Products: Froxlor Problem Types: CWE-79 Description: Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without auth
cious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication. Version 2.2.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/froxlor/Froxlor/security/advisories/GHSA-26xq-m8xw-6373 - https://github.com/froxlor/Froxlor/commit/fde43f80600f1035e1e3d2297411b666d805549a - https://github.com/user-attachments/assets/86947633-3e7c-4e10-86cc-92e577761e8e
CVE ID: CVE-2025-48959 State: PUBLISHED Published: 2025-06-04T12:02:56.572Z Last Updated: 2025-06-05T03:55:16.936Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Protect Cloud Agent Problem Types: CWE-276 Description: Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40077. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-8133
CVE ID: CVE-2025-48960 State: PUBLISHED Published: 2025-06-04T13:26:27.062Z Last Updated: 2025-06-04T13:42:31.537Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-326 Description: Weak server key used for TLS encryption. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-6403
CVE ID: CVE-2025-48961 State: PUBLISHED Published: 2025-06-04T13:26:51.567Z Last Updated: 2025-06-04T13:42:03.744Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-732 Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-8000
CVE ID: CVE-2025-48962 State: PUBLISHED Published: 2025-06-04T13:27:43.266Z Last Updated: 2025-06-04T13:41:16.377Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 16 Problem Types: CWE-918 Description: Sensitive information disclosure due to SSRF. The following products are affected: Acronis Cyber Protect 16 (Windows, Linux) before build 39938. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-8514
CVE ID: CVE-2025-48963 State: PUBLISHED Published: 2025-08-28T09:49:57.936Z Last Updated: 2025-08-29T03:55:22.130Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Protect Cloud Agent Problem Types: CWE-610 Description: Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-8568
CVE ID: CVE-2025-48964 State: PUBLISHED Published: 2025-07-22T00:00:00.000Z Last Updated: 2025-08-26T18:49:09.084Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: iputils Products: iputils Problem Types: CWE-190 Description: ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not
e exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/iputils/iputils/issues - https://github.com/iputils/iputils/security/advisories/GHSA-25fr-jw29-74f9 - https://bugzilla.suse.com/show_bug.cgi?id=1243772 - https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c - https://github.com/iputils/iputils/releases/tag/20250602
CVE ID: CVE-2025-48965 State: PUBLISHED Published: 2025-07-20T00:00:00.000Z Last Updated: 2025-11-03T20:04:59.015Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Mbed Products: mbedtls Problem Types: CWE-696 Description: Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/ - https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-6.m
visories/ - https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-6.md
CVE ID: CVE-2025-48976 State: PUBLISHED Published: 2025-06-16T15:00:48.140Z Last Updated: 2025-11-03T20:05:02.486Z Vendors: Apache Software Foundation Products: Apache Commons FileUpload Problem Types: Allocation of resources with insufficient limits Description: Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/fbs3
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12
CVE ID: CVE-2025-48978 State: PUBLISHED Published: 2025-08-21T00:01:24.208Z Last Updated: 2025-08-21T14:16:25.992Z Vendors: Ubiquiti Inc Products: EdgeMAX EdgeSwitch Description: An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network. Affected Products: EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) Mitigation: Update the EdgeMAX EdgeSwitch to Version 1.11.1 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-054-054/3033f0b7-aca6-4d70-8c51-d3e706bd0ca7
CVE ID: CVE-2025-48979 State: PUBLISHED Published: 2025-08-28T23:07:04.604Z Last Updated: 2025-08-29T13:17:04.074Z Vendors: Ubiquiti Inc Products: UISP Application Description: An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-053/b0c4aa38-90aa-412d-b5b9-6395e057d822
CVE ID: CVE-2025-48980 State: PUBLISHED Published: 2025-10-30T23:29:44.075Z Last Updated: 2025-10-31T14:48:00.254Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Brave Products: Desktop Browser Description: In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute. Therefore SameSite=Strict cookies would be sent on a cross-site navigation using this method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/3253725
CVE ID: CVE-2025-48981 State: PUBLISHED Published: 2025-10-08T00:49:16.646Z Last Updated: 2025-10-09T01:06:32.695Z Vendors: CompuGroup Medical Products: CGM MEDICO Description: An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cgm.com/deu_de/allgemein/cybersecurity-en/security-advisoriy.html
CVE ID: CVE-2025-48982 State: PUBLISHED Published: 2025-10-30T23:33:01.695Z Last Updated: 2025-11-01T03:55:49.438Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Agent for Microsoft Windows Description: This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4771
CVE ID: CVE-2025-48983 State: PUBLISHED Published: 2025-10-30T23:33:01.993Z Last Updated: 2025-11-01T03:55:50.741Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Backup and Replication Description: A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4771
CVE ID: CVE-2025-48984 State: PUBLISHED Published: 2025-10-30T23:31:34.218Z Last Updated: 2025-11-01T03:55:51.554Z Vendors: Veeam Products: Backup and Replication Description: A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4771
CVE ID: CVE-2025-48985 State: PUBLISHED Published: 2025-11-07T00:43:28.027Z Last Updated: 2025-11-07T18:35:24.238Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Vercel Products: AI SDK Description: A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade. More details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed - https://ve
DP Vulnrichment: References: - https://github.com/vercel/ai/commit/930399bb9839a8baf3d349614106d78268775eed - https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk
CVE ID: CVE-2025-48986 State: PUBLISHED Published: 2025-11-20T19:11:36.449Z Last Updated: 2025-11-20T21:38:49.611Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Revive Products: Revive Adserver Description: Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/3398283
CVE ID: CVE-2025-48987 State: PUBLISHED Published: 2025-11-20T19:11:36.436Z Last Updated: 2025-11-20T21:39:46.821Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Revive Products: Revive Adserver Description: Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/3399191
CVE ID: CVE-2025-48988 State: PUBLISHED Published: 2025-06-16T14:13:40.457Z Last Updated: 2025-11-03T20:05:03.939Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. Additional Analyst
ffected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18
CVE ID: CVE-2025-48989 State: PUBLISHED Published: 2025-08-13T12:11:26.124Z Last Updated: 2025-11-04T21:11:10.863Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-404 Description: Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - htt
0.108 which fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf
CVE ID: CVE-2025-48990 State: PUBLISHED Published: 2025-06-02T11:21:48.580Z Last Updated: 2025-06-02T16:39:42.539Z Vendors: nekernel-org Products: nekernel Problem Types: CWE-122 Description: NeKernal is a free and open-source operating system stack. Version 0.0.2 has a 1-byte heap overflow in `rt_copy_memory`, which unconditionally wrote a null terminator at `dst[len]`. When `len` equals the size of the destination buffer (256 bytes), that extra `'\0'` write overruns the buffer by one byte. To avoid breaking existing callers or changing the public API, the patch in commit fb7b7f658327f659c6a6da1af151cb389c2ca4ee takes a minimal approach: it simply removes the overflow-causing line without a
fb7b7f658327f659c6a6da1af151cb389c2ca4ee takes a minimal approach: it simply removes the overflow-causing line without adding bounds checks or altering the function signature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nekernel-org/nekernel/security/advisories/GHSA-jvvh-fp57-2p32 - https://github.com/nekernel-org/nekernel/commit/fb7b7f658327f659c6a6da1af151cb389c2ca4ee
CVE ID: CVE-2025-48991 State: PUBLISHED Published: 2025-06-25T14:07:47.416Z Last Updated: 2025-06-25T14:16:19.378Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Enalean Products: tuleap Problem Types: CWE-352 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1748845907, Tuleap Enterprise Edition 16.8-3, and Tuleap Enterprise Edition 16.7-5
es. Tuleap Community Edition 16.8.99.1748845907, Tuleap Enterprise Edition 16.8-3, and Tuleap Enterprise Edition 16.7-5 contain a fix for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-px9r-875r-w534 - https://github.com/Enalean/tuleap/commit/cbf9b2a38e33dfd755dc2ccf074126b598a78274 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=cbf9b2a38e33dfd755dc2ccf074126b598a78274 - https://tuleap.net/plugins/tracker/?aid=43326
CVE ID: CVE-2025-48992 State: PUBLISHED Published: 2025-06-16T22:17:28.511Z Last Updated: 2025-06-17T13:51:00.396Z Vendors: Intermesh Products: groupoffice Problem Types: CWE-79, CWE-87 Description: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books. This issue has been patched in versions 6.8.123 and 25.0.27. Additional Analyst Notes: - CISA ADP Vulnrichmen
ess books. This issue has been patched in versions 6.8.123 and 25.0.27. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Intermesh/groupoffice/security/advisories/GHSA-j35g-q5mc-jwgp - https://github.com/Intermesh/groupoffice/commit/2e3695db9cdef1da7a9d754ff4d98f49f6924e2d
CVE ID: CVE-2025-48993 State: PUBLISHED Published: 2025-06-17T00:43:35.194Z Last Updated: 2025-06-17T13:45:06.357Z Vendors: Intermesh Products: groupoffice Problem Types: CWE-79 Description: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27. Additional Analyst Notes: - CISA ADP Vulnrichment:
attack. This issue has been patched in versions 6.8.123 and 25.0.27. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Intermesh/groupoffice/security/advisories/GHSA-xv2x-v374-92gv - https://github.com/Intermesh/groupoffice/commit/1e2a2450f204174f87a93217838d74718996dcdd - https://github.com/Intermesh/groupoffice/commit/a9031884f6a6fbd0f08a8b7790514b5bc0937c11
CVE ID: CVE-2025-48994 State: PUBLISHED Published: 2025-06-02T16:22:08.966Z Last Updated: 2025-06-02T16:30:51.717Z Vendors: XML-Security Products: signxml Problem Types: CWE-303 Description: SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature algorithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may supply a signature unexpected
orithms using the `signxml.XMLVerifier.verify(expect_config=...)` setting, an attacker may supply a signature unexpectedly signed with a key other than the provided HMAC key, using a different (asymmetric key) signature algorithm. Starting with SignXML 4.0.4, specifying `hmac_key` causes the set of accepted signature algorithms to be restricted to HMAC only, if not already restricted by the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/XML-Security/signxml/security/advisories/GHSA-6vx8-pcwv-xhf4 - https://github.com/XML-Security/signxml/commit/e3c0c2b82a3329a65d917830657649c98b8c7600
CVE ID: CVE-2025-48995 State: PUBLISHED Published: 2025-06-02T16:23:27.706Z Last Updated: 2025-06-02T16:41:13.270Z Vendors: XML-Security Products: signxml Problem Types: CWE-208 Description: SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing it with the user supplied hash, allowing users to reconstruct the correct HMAC for any data. Additional Analyst Notes: -
t with the user supplied hash, allowing users to reconstruct the correct HMAC for any data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/XML-Security/signxml/security/advisories/GHSA-gmhf-gg8w-jw42 - https://github.com/XML-Security/signxml/commit/1b501faaacf34cf978a52dbc6915ec11e27611cd
CVE ID: CVE-2025-48996 State: PUBLISHED Published: 2025-06-02T19:24:44.860Z Last Updated: 2025-06-03T02:04:15.413Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: haxtheweb Products: issues Problem Types: CWE-201 Description: HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the `haxPsuUsage` API endpoint, related to a flat present in open-apis versions up to and including 10.0.2. This allows any remote unauthenticated user to retrieve a full list of PSU website
versions up to and including 10.0.2. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues (e.g., HAX-3), this could assist in targeted attacks such as unauthorized content modification or deletion. Commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 patches the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haxtheweb/issues/security/advisories/GHSA-fvx2-x7ff-fc56 - https://github.com/haxtheweb/open-apis/commit/06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7
CVE ID: CVE-2025-48997 State: PUBLISHED Published: 2025-06-03T18:21:59.527Z Last Updated: 2025-06-03T18:30:13.178Z Vendors: expressjs Products: multer Problem Types: CWE-248 Description: Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
o receive a patch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg - https://github.com/expressjs/multer/issues/1233 - https://github.com/expressjs/multer/pull/1256 - https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9
CVE ID: CVE-2025-48998 State: PUBLISHED Published: 2025-06-03T18:27:43.310Z Last Updated: 2025-06-03T20:11:35.811Z Vendors: dataease Products: dataease Problem Types: CWE-89, CWE-862 Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.10. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-2wfc-qwx7-w692 - https://github.com/dataease