Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
om/invoiceninja/invoiceninja/commit/2a9bf353b432d7060e85487b617151ecbc36247d - https://vulncheck.com/advisories/invoice-ninja-ssrf - https://github.com/invoiceninja/invoiceninja/compare/97ae948618230c1812f3223b80bf22dcb0382dc5..435780932fe19063001d79ba518815df62773d71
CVE ID: CVE-2025-0475 State: PUBLISHED Published: 2025-03-03T10:30:47.570Z Last Updated: 2025-03-03T12:07:55.921Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/513142 - https://hackerone.com/reports/2932309
CVE ID: CVE-2025-0476 State: PUBLISHED Published: 2025-01-15T23:44:45.934Z Last Updated: 2025-01-16T14:22:23.004Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-1287 Description: Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any user who opened a channel containing the specially crafted attachment Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-0477 State: PUBLISHED Published: 2025-01-30T17:49:03.933Z Last Updated: 2025-02-12T19:51:11.151Z Vendors: Rockwell Automation Products: FactoryTalk® AssetCentre Problem Types: CWE-522 Description: An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak encryption methodology and could allow a threat actor to extract passwords belonging to other users of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html
CVE ID: CVE-2025-0478 State: PUBLISHED Published: 2025-03-24T11:37:29.200Z Last Updated: 2025-03-24T13:39:13.462Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-280 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform, altering their behaviour. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-0479 State: PUBLISHED Published: 2025-01-20T11:37:13.747Z Last Updated: 2025-01-21T20:10:36.388Z Vendors: CP Plus Products: CP-XR-DE21-S Router Problem Types: CWE-1004, CWE-614 Description: This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and compromise the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMain
the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0005
CVE ID: CVE-2025-0480 State: PUBLISHED Published: 2025-01-15T17:31:07.952Z Last Updated: 2025-01-15T20:14:17.602Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: wuzhicms Problem Types: CWE-918 Description: A vulnerability classified as problematic has been found in wuzhicms 4.1.0. This affects the function test of the file coreframe/app/search/admin/config.php. The manipulation of the argument sphinxhost/sphinxport leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291915 - https://vuldb.com/?ctiid.291915 - https://vuldb.com/?submit.474965 - https://github.com/wuzhicms/wuzhicms/issues/212 - https://github.com/wuzhicms/wuzhicms/issues/212#issue-2769226216
CVE ID: CVE-2025-0481 State: PUBLISHED Published: 2025-01-15T19:00:13.869Z Last Updated: 2025-01-15T20:02:35.923Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: D-Link Products: DIR-878 Problem Types: CWE-200, CWE-284 Description: A vulnerability classified as problematic has been found in D-Link DIR-878 1.03. Affected is an unknown function of the file /dllog.cgi of the component HTTP POST Request Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291924 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291924 - https://vuldb.com/?ctiid.291924 - https://vuldb.com/?submit.475011 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-878/dllog.md - https://www.dlink.com/
CVE ID: CVE-2025-0482 State: PUBLISHED Published: 2025-01-15T19:31:04.741Z Last Updated: 2025-01-15T20:19:48.835Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-1392 Description: A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd.php. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291927 - https://vuldb.com/?ctiid.291
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291927 - https://vuldb.com/?ctiid.291927 - https://vuldb.com/?submit.475237 - https://github.com/Fanli2012/native-php-cms/issues/4 - https://github.com/Fanli2012/native-php-cms/issues/4#issue-2769866348
CVE ID: CVE-2025-0483 State: PUBLISHED Published: 2025-01-15T19:31:06.230Z Last Updated: 2025-01-15T20:06:38.296Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Fanli2012 native-php-cms 1.0 and classified as problematic. This vulnerability affects unknown code of the file /fladmin/jump.php. The manipulation of the argument message/error leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291928 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291928 - https://vuldb.com/?ctiid.291928 - https://vuldb.com/?submit.475240 - https://github.com/Fanli2012/native-php-cms/issues/5 - https://github.com/Fanli2012/native-php-cms/issues/5#issue-2769894596
CVE ID: CVE-2025-0484 State: PUBLISHED Published: 2025-01-15T20:00:17.327Z Last Updated: 2025-01-15T20:43:01.887Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfig_doedit.php of the component Backend. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291929 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291929 - https://vuldb.com/?ctiid.291929 - https://vuldb.com/?submit.475245 - https://github.com/Fanli2012/native-php-cms/issues/6 - https://github.com/Fanli2012/native-php-cms/issues/6#issue-2769903928
CVE ID: CVE-2025-0485 State: PUBLISHED Published: 2025-01-15T20:00:18.997Z Last Updated: 2025-01-15T20:28:57.910Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been classified as problematic. Affected is an unknown function of the file /fladmin/sysconfig_doedit.php. The manipulation of the argument info leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291930 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291930 - https://vuldb.com/?ctiid.291930 - https://vuldb.com/?submit.475247 - https://github.com/Fanli2012/native-php-cms/issues/7 - https://github.com/Fanli2012/native-php-cms/issues/7#issue-2769919832
CVE ID: CVE-2025-0486 State: PUBLISHED Published: 2025-01-15T20:31:05.147Z Last Updated: 2025-01-15T21:40:02.509Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /fladmin/login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291931 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291931 - https://vuldb.com/?ctiid.291931 - https://vuldb.com/?submit.475249 - https://github.com/Fanli2012/native-php-cms/issues/8 - https://github.com/Fanli2012/native-php-cms/issues/8#issue-2769942639
CVE ID: CVE-2025-0487 State: PUBLISHED Published: 2025-01-15T20:31:06.781Z Last Updated: 2025-01-15T21:40:57.392Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /fladmin/cat_edit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291932 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291932 - https://vuldb.com/?ctiid.291932 - https://vuldb.com/?submit.475254 - https://github.com/Fanli2012/native-php-cms/issues/9 - https://github.com/Fanli2012/native-php-cms/issues/9#issue-2769962332
CVE ID: CVE-2025-0488 State: PUBLISHED Published: 2025-01-15T21:00:17.899Z Last Updated: 2025-01-16T16:03:19.217Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file product_list.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291933 - https://vuldb.com/?ctiid.291933 -
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291933 - https://vuldb.com/?ctiid.291933 - https://vuldb.com/?submit.475255 - https://github.com/Fanli2012/native-php-cms/issues/10 - https://github.com/Fanli2012/native-php-cms/issues/10#issue-2769983658
CVE ID: CVE-2025-0489 State: PUBLISHED Published: 2025-01-15T21:31:05.803Z Last Updated: 2025-01-16T15:55:02.947Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0. This vulnerability affects unknown code of the file /fladmin/friendlink_dodel.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291934 - https://vuldb.com/?ctiid.2
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291934 - https://vuldb.com/?ctiid.291934 - https://vuldb.com/?submit.475256 - https://github.com/Fanli2012/native-php-cms/issues/11 - https://github.com/Fanli2012/native-php-cms/issues/11#issue-2769999157
CVE ID: CVE-2025-0490 State: PUBLISHED Published: 2025-01-15T21:31:07.358Z Last Updated: 2025-01-16T15:51:35.956Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0. This issue affects some unknown processing of the file /fladmin/article_dodel.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291935 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291935 - https://vuldb.com/?ctiid.291935 - https://vuldb.com/?submit.475258 - https://github.com/Fanli2012/native-php-cms/issues/12 - https://github.com/Fanli2012/native-php-cms/issues/12#issue-2770013163
CVE ID: CVE-2025-0491 State: PUBLISHED Published: 2025-01-15T22:00:14.715Z Last Updated: 2025-01-16T18:43:55.724Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Fanli2012 Products: native-php-cms Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. Affected is an unknown function of the file /fladmin/cat_dodel.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291936 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291936 - https://vuldb.com/?ctiid.291936 - https://vuldb.com/?submit.475260 - https://github.com/Fanli2012/native-php-cms/issues/13 - https://github.com/Fanli2012/native-php-cms/issues/13#issue-2770022466
CVE ID: CVE-2025-0492 State: PUBLISHED Published: 2025-01-15T22:00:17.134Z Last Updated: 2025-02-12T20:31:20.822Z Severity: N/A (CVSS 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C) Vendors: D-Link Products: DIR-823X Problem Types: CWE-476, CWE-404 Description: A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291937 - https://vuldb.com/?ctiid.291937 - https://vuldb.com/?s
SA ADP Vulnrichment: References: - https://vuldb.com/?id.291937 - https://vuldb.com/?ctiid.291937 - https://vuldb.com/?submit.475301 - https://tasty-foxtrot-3a8.notion.site/D-link-DIR-823X-FUN_00412244-NULL-Pointer-Dereference-1730448e619580fcb7f9d871c6e7190a - https://www.dlink.com/
CVE ID: CVE-2025-0493 State: PUBLISHED Published: 2025-01-31T04:21:47.156Z Last Updated: 2025-01-31T16:25:41.480Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wcmp Products: MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution Problem Types: CWE-22 Description: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all versions up to, and including, 4.2.14 via the tabname parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to
attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/812029d9-95d6-4bc9-98b2-700f462163b3?source=cve - https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.14/classes/class-mvx-ajax.php#L661 - https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.15/classes/class-mvx-ajax.php#L661
CVE ID: CVE-2025-0495 State: PUBLISHED Published: 2025-03-17T19:21:11.295Z Last Updated: 2025-03-18T16:25:42.668Z Vendors: docker Products: buildx Problem Types: CWE-532 Description: Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records. This vulnerability does not impact secrets passed to the Github cache backend
ved in BuildKit daemon's history records. This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/docker/buildx
CVE ID: CVE-2025-0497 State: PUBLISHED Published: 2025-01-30T17:40:51.775Z Last Updated: 2025-02-12T19:51:11.273Z Vendors: Rockwell Automation Products: FactoryTalk® AssetCentre Problem Types: CWE-522 Description: A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to storing credentials in the configuration file of EventLogAttachmentExtractor, ArchiveExtractor, LogCleanUp, or ArchiveLogCleanUp packages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html
CVE ID: CVE-2025-0498 State: PUBLISHED Published: 2025-01-30T17:36:12.542Z Last Updated: 2025-02-12T19:51:11.392Z Vendors: Rockwell Automation Products: FactoryTalk® AssetCentre Problem Types: CWE-522 Description: A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to insecure storage of FactoryTalk® Security user tokens, which could allow a threat actor to steal a token and, impersonate another user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1721.html
CVE ID: CVE-2025-0499 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:04:59.728Z Description: No description available.
CVE ID: CVE-2025-0500 State: PUBLISHED Published: 2025-01-15T18:20:33.468Z Last Updated: 2025-10-14T18:54:46.403Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Amazon Products: WorkSpaces Client, AppStream 2.0 Client, DCV Client Problem Types: CWE-295 Description: An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2025-001/ - https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-w
.amazon.com/security/security-bulletins/AWS-2025-001/ - https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes - https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notes - https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes - https://docs.aws.amazon.com/appstream2/latest/developerguide/client-release-versions.html - https://docs.aws.amazon.com/dcv/latest/adminguide/doc-history-release-notes.html#dcv-2023-1-16388jul
CVE ID: CVE-2025-0501 State: PUBLISHED Published: 2025-01-15T18:21:08.166Z Last Updated: 2025-10-14T18:51:31.114Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Amazon Products: WorkSpaces Client Problem Types: CWE-295 Description: An issue in the native clients for Amazon WorkSpaces (when running PCoIP protocol) may allow an attacker to access remote sessions via man-in-the-middle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2025-001/ - https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes - https://docs.aws.amazon.com/wor
orkspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes - https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notes - https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes - https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-android-client.html#android-release-notes
CVE ID: CVE-2025-0502 State: PUBLISHED Published: 2025-01-15T17:47:51.440Z Last Updated: 2025-01-15T20:07:34.768Z Vendors: CrafterCMS Products: CrafterCMS Problem Types: CWE-402 Description: Transmission of Private Resources into a New Sphere ('Resource Leak') vulnerability in CrafterCMS Engine on Linux, MacOS, x86, Windows, 64 bit, ARM allows Directory Indexing, Resource Leak Exposure.This issue affects CrafterCMS: from 4.0.0 before 4.0.8, from 4.1.0 before 4.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://craftercms.com/docs/current/security/advisory.html#cv-2025011501
CVE ID: CVE-2025-0503 State: PUBLISHED Published: 2025-02-14T17:52:17.895Z Last Updated: 2025-02-14T18:09:02.166Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-754 Description: Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates