Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-0221 State: PUBLISHED Published: 2025-01-05T15:00:11.843Z Last Updated: 2025-01-06T14:46:03.877Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IOBit Products: Protected Folder Problem Types: CWE-476, CWE-404 Description: A vulnerability has been found in IOBit Protected Folder up to 1.3.0 and classified as problematic. This vulnerability affects the function 0x22200c in the library pffilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did
e exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290200 - https://vuldb.com/?ctiid.290200 - https://vuldb.com/?submit.466955 - https://shareforall.notion.site/IOBit-Protected-Folder-pffilter-0x22200C-NPD-DOS-15260437bb1e80b2a477d42396d5d06c
CVE ID: CVE-2025-0222 State: PUBLISHED Published: 2025-01-05T15:31:04.500Z Last Updated: 2025-01-06T14:45:15.189Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IObit Products: Protected Folder Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in IObit Protected Folder up to 13.6.0.5 and classified as problematic. This issue affects the function 0x8001E000/0x8001E004 in the library IUProcessFilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure
lly. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290201 - https://vuldb.com/?ctiid.290201 - https://vuldb.com/?submit.466956 - https://shareforall.notion.site/IOBit-Uninstaller-IUProcessFilter-0x8001E000-NPD-DOS-15260437bb1e809c81bbc484c53b17bc
CVE ID: CVE-2025-0223 State: PUBLISHED Published: 2025-01-05T16:00:15.443Z Last Updated: 2025-01-06T14:43:01.650Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IObit Products: Protected Folder Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in IObit Protected Folder up to 13.6.0.5. It has been classified as problematic. Affected is the function 0x8001E000/0x8001E00C/0x8001E004/0x8001E010 in the library IURegistryFilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was con
ss is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290202 - https://vuldb.com/?ctiid.290202 - https://vuldb.com/?submit.466963 - https://shareforall.notion.site/IOBit-Uninstaller-IURegistryFilter-0x8001E000-NPD-DOS-15260437bb1e80e482e0e3c9b22b58d0
CVE ID: CVE-2025-0224 State: PUBLISHED Published: 2025-01-05T16:31:05.127Z Last Updated: 2025-01-06T14:35:35.301Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Provision-ISR Products: SH-4050A-2, SH-4100A-2L(MM), SH-8100A-2L(MM), SH-16200A-2(1U), SH-16200A-5(1U), NVR5-8200PX Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in Provision-ISR SH-4050A-2, SH-4100A-2L(MM), SH-8100A-2L(MM), SH-16200A-2(1U), SH-16200A-5(1U) and NVR5-8200PX up to 20241220. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /server.js. The manipulation leads to information disclosure. The attack can be l
s an unknown functionality of the file /server.js. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290203 - https://vuldb.com/?ctiid.290203 - https://vuldb.com/?submit.467085 - https://netsecfish.notion.site/Sensitive-Device-Information-Disclosure-in-Provision-ISR-DVR-1626b683e67c803881befbc730a93bf6?pvs=4
CVE ID: CVE-2025-0225 State: PUBLISHED Published: 2025-01-05T17:00:15.820Z Last Updated: 2025-01-06T14:35:06.444Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Tsinghua Unigroup Products: Electronic Archives System Problem Types: CWE-25, CWE-23 Description: A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipulation of the argument name leads to path traversal: '/../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
rsal: '/../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290215 - https://vuldb.com/?ctiid.290215 - https://vuldb.com/?submit.474264 - https://github.com/BxYQ/ld/tree/main/file_read4 - https://github.com/BxYQ/ld/blob/main/file_read4/poc.py
CVE ID: CVE-2025-0226 State: PUBLISHED Published: 2025-01-05T17:31:06.041Z Last Updated: 2025-01-06T14:34:19.467Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Tsinghua Unigroup Products: Electronic Archives System Problem Types: CWE-200, CWE-284 Description: A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this issue is the function download of the file /collect/PortV4/downLoad.html. The manipulation of the argument path leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additio
n disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290216 - https://vuldb.com/?ctiid.290216 - https://vuldb.com/?submit.474265 - https://github.com/BxYQ/ld/tree/main/file_read2 - https://github.com/BxYQ/ld/blob/main/file_read2/poc.py
CVE ID: CVE-2025-0227 State: PUBLISHED Published: 2025-01-05T18:00:14.103Z Last Updated: 2025-01-06T15:49:35.183Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Tsinghua Unigroup Products: Electronic Archives System Problem Types: CWE-200, CWE-284 Description: A vulnerability, which was classified as problematic, was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). This affects an unknown part of the file /Logs/Annals/downLoad.html. The manipulation of the argument path leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Note
e to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290217 - https://vuldb.com/?ctiid.290217 - https://vuldb.com/?submit.474266 - https://github.com/BxYQ/ld/tree/main/file_read1 - https://github.com/BxYQ/ld/blob/main/file_read1/poc.py
CVE ID: CVE-2025-0228 State: PUBLISHED Published: 2025-01-05T18:31:04.977Z Last Updated: 2025-01-06T15:01:19.832Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: code-projects Products: Local Storage Todo App Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in code-projects Local Storage Todo App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /js-todo-app/index.html. The manipulation of the argument Add leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290218 - https://vuldb.com/?ctiid.290218 - https://vuldb.com/?submit.474049 - https://code-projects.org/
CVE ID: CVE-2025-0229 State: PUBLISHED Published: 2025-01-05T19:31:04.829Z Last Updated: 2025-01-06T15:00:46.564Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Travel Management System 1.0. This issue affects some unknown processing of the file /enquiry.php. The manipulation of the argument pid/t1/t2/t3/t4/t5/t6/t7 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290225 - https://vuldb.com/?ctiid.290225 - https://vuldb.com/?submit.474572 - https://github.com/Huandtx/cve/blob/main/cve/sql1.md - https://code-projects.org/
CVE ID: CVE-2025-0230 State: PUBLISHED Published: 2025-01-05T21:00:18.888Z Last Updated: 2025-01-06T14:55:19.330Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Responsive Hotel Site Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file /admin/print.php. The manipulation of the argument pid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290226 - http
ic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290226 - https://vuldb.com/?ctiid.290226 - https://vuldb.com/?submit.474581 - https://github.com/Huandtx/cve/blob/main/cve/Responsive%20Hotel%20Site/sql1.md - https://code-projects.org/
CVE ID: CVE-2025-0231 State: PUBLISHED Published: 2025-01-05T21:31:05.496Z Last Updated: 2025-01-06T14:53:58.595Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/submit_payments.php. The manipulation of the argument m_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290227 - https://vuldb.com/?ctiid.290227 - https://vuldb.com/?submit.474596 - https://github.com/gh464646/CVE/issues/1
CVE ID: CVE-2025-0232 State: PUBLISHED Published: 2025-01-05T22:00:15.706Z Last Updated: 2025-01-06T14:49:00.605Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Blood Bank Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips Blood Bank Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /successadmin.php. The manipulation of the argument psw leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2902
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290228 - https://vuldb.com/?ctiid.290228 - https://vuldb.com/?submit.474597 - https://github.com/alc9700jmo/CVE/issues/7
CVE ID: CVE-2025-0233 State: PUBLISHED Published: 2025-01-05T22:31:06.641Z Last Updated: 2025-01-06T14:48:14.955Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Project Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/course.php. The manipulation of the argument course_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290229 - https://vuldb.com/?ctiid.290229 - https://vuldb.com/?submit.474673 - https://github.com/1074923869/CVE/issues/1
CVE ID: CVE-2025-0234 State: PUBLISHED Published: 2025-02-26T01:52:31.822Z Last Updated: 2025-02-26T15:43:00.837Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Canon Inc. Products: Generic PCL6 V4 Printer Driver, Generic UFR II V4 Printer Driver, Generic LIPSLX V4 Printer Driver Problem Types: CWE-787 Description: Out-of-bounds vulnerability in curve segmentation processing of Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2025-002/
CVE ID: CVE-2025-0235 State: PUBLISHED Published: 2025-02-26T01:56:24.945Z Last Updated: 2025-02-26T15:34:43.071Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Canon Inc. Products: Generic PCL6 V4 Printer Driver, Generic UFR II V4 Printer Driver, Generic LIPSLX V4 Printer Driver Problem Types: CWE-787 Description: Out-of-bounds vulnerability due to improper memory release during image rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2025-002/
CVE ID: CVE-2025-0236 State: PUBLISHED Published: 2025-02-26T01:57:43.244Z Last Updated: 2025-02-26T15:34:35.163Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Canon Inc. Products: Generic PCL6 V4 Printer Driver, Generic UFR II V4 Printer Driver, Generic LIPSLX V4 Printer Driver Problem Types: CWE-787 Description: Out-of-bounds vulnerability in slope processing during curve rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2025-002/
CVE ID: CVE-2025-0237 State: PUBLISHED Published: 2025-01-07T16:07:05.787Z Last Updated: 2025-11-03T22:33:35.989Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: WebChannel APIs susceptible to confused deputy attack Description: The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.o
.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1915257 - https://www.mozilla.org/security/advisories/mfsa2025-01/ - https://www.mozilla.org/security/advisories/mfsa2025-02/ - https://www.mozilla.org/security/advisories/mfsa2025-04/ - https://www.mozilla.org/security/advisories/mfsa2025-05/
CVE ID: CVE-2025-0238 State: PUBLISHED Published: 2025-01-07T16:07:06.043Z Last Updated: 2025-11-03T22:33:37.588Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free when breaking lines in text Description: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1915535 - https://www.mozilla.org/security/advisor
Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1915535 - https://www.mozilla.org/security/advisories/mfsa2025-01/ - https://www.mozilla.org/security/advisories/mfsa2025-02/ - https://www.mozilla.org/security/advisories/mfsa2025-03/ - https://www.mozilla.org/security/advisories/mfsa2025-04/ - https://www.mozilla.org/security/advisories/mfsa2025-05/
CVE ID: CVE-2025-0239 State: PUBLISHED Published: 2025-01-07T16:07:06.317Z Last Updated: 2025-11-03T22:33:39.114Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Alt-Svc ALPN validation failure when redirected Description: When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1929156 - https://www.mozilla.org/security/advisories/mfsa2025-01/ - https://www.m
/bugzilla.mozilla.org/show_bug.cgi?id=1929156 - https://www.mozilla.org/security/advisories/mfsa2025-01/ - https://www.mozilla.org/security/advisories/mfsa2025-02/ - https://www.mozilla.org/security/advisories/mfsa2025-04/ - https://www.mozilla.org/security/advisories/mfsa2025-05/
CVE ID: CVE-2025-0240 State: PUBLISHED Published: 2025-01-07T16:07:06.551Z Last Updated: 2025-11-03T22:33:40.588Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Compartment mismatch when parsing JavaScript JSON module Description: Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1929623 - https://www.mozilla.org/security/advisories/mfsa2
: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1929623 - https://www.mozilla.org/security/advisories/mfsa2025-01/ - https://www.mozilla.org/security/advisories/mfsa2025-02/ - https://www.mozilla.org/security/advisories/mfsa2025-04/ - https://www.mozilla.org/security/advisories/mfsa2025-05/
CVE ID: CVE-2025-0241 State: PUBLISHED Published: 2025-01-07T16:07:06.824Z Last Updated: 2025-11-03T22:33:42.156Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory corruption when using JavaScript Text Segmentation Description: When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1933023 - https://www.mozilla.org/security/advisories/mfsa2025-01/ - https://ww
s://bugzilla.mozilla.org/show_bug.cgi?id=1933023 - https://www.mozilla.org/security/advisories/mfsa2025-01/ - https://www.mozilla.org/security/advisories/mfsa2025-02/ - https://www.mozilla.org/security/advisories/mfsa2025-04/ - https://www.mozilla.org/security/advisories/mfsa2025-05/
CVE ID: CVE-2025-0242 State: PUBLISHED Published: 2025-01-07T16:07:07.093Z Last Updated: 2025-11-03T22:33:43.653Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 Description: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 12
ome of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird < 128.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169 - https://www.mozilla.org/security/advisories/mfsa2025-01/ - https://www.mozilla.org/security/advisories/mfsa2025-02/ - https://www.mozilla.org/security/advisories/mfsa2025-03/ - https://www.mozilla.org/security/advisories/mfsa2025-04/ - https://www.mozilla.org/security/advisories/mfsa2025-05/
CVE ID: CVE-2025-0243 State: PUBLISHED Published: 2025-01-07T16:07:07.372Z Last Updated: 2025-11-03T22:33:45.188Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 Description: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Additional Analyst Notes: - CIS
affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1827142%2C1932783 - https://www.mozilla.org/security/advisories/mfsa2025-01/ - https://www.mozilla.org/security/advisories/mfsa2025-02/ - https://www.mozilla.org/security/advisories/mfsa2025-04/ - https://www.mozilla.org/security/advisories/mfsa2025-05/
CVE ID: CVE-2025-0244 State: PUBLISHED Published: 2025-01-07T16:07:04.905Z Last Updated: 2025-01-08T15:24:32.529Z Vendors: Mozilla Products: Firefox Problem Types: Address bar spoofing using an invalid protocol scheme on Firefox for Android Description: When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 134. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1929584 - https://www.mozilla.org/security/advisories/mfsa2025-01/