Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ed. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https://proget.pl/en/mobile-device-management/
CVE ID: CVE-2025-1418 State: PUBLISHED Published: 2025-05-21T13:03:44.656Z Last Updated: 2025-05-21T13:26:07.661Z Vendors: Proget Products: Proget Problem Types: CWE-863 Description: A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which contain details about allowed/prohibited functions. The profiles do not reveal any sensitive information (including their usage in connected devices). This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https://proget.pl/en/mobile-device-managem
Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https://proget.pl/en/mobile-device-management/
CVE ID: CVE-2025-1419 State: PUBLISHED Published: 2025-05-21T13:03:56.937Z Last Updated: 2025-05-21T13:25:12.684Z Vendors: Proget Products: Proget Problem Types: CWE-79 Description: Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https://proget.pl/en/mobile-device-management/
CVE ID: CVE-2025-1420 State: PUBLISHED Published: 2025-05-21T13:04:23.644Z Last Updated: 2025-05-21T13:24:17.340Z Vendors: Proget Products: Proget Problem Types: CWE-79 Description: Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https://proget.pl/en/mobile-device-management/
CVE ID: CVE-2025-1421 State: PUBLISHED Published: 2025-05-21T13:04:37.497Z Last Updated: 2025-05-21T13:24:04.623Z Vendors: Proget Products: Proget Problem Types: CWE-1236 Description: Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https://pro
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https://proget.pl/en/mobile-device-management/
CVE ID: CVE-2025-1424 State: PUBLISHED Published: 2025-03-04T15:25:47.223Z Last Updated: 2025-03-04T15:51:17.649Z Vendors: PocketBook Products: InkPad Color 3 Problem Types: CWE-269 Description: A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if they gain physical access to the device. This issue affects InkPad Color 3 in version U743k3.6.8.3671. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.redguard.ch/blog/2025/03/04/security-advisory-pocketbook-inkpad-color-3/
CVE ID: CVE-2025-1425 State: PUBLISHED Published: 2025-03-04T15:24:42.697Z Last Updated: 2025-03-04T15:52:03.704Z Vendors: PocketBook Products: InkPad Color 3 Problem Types: CWE-269 Description: A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affects InkPad Color 3: U743k3.6.8.3671. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.redguard.ch/blog/2025/03/04/security-advisory-pocketbook-inkpad-color-3/
CVE ID: CVE-2025-1426 State: PUBLISHED Published: 2025-02-19T16:55:31.252Z Last Updated: 2025-02-19T20:09:06.807Z Vendors: Google Products: Chrome Problem Types: CWE-122 Description: Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html - https://issues.chromium.org/issues/383465163
CVE ID: CVE-2025-1427 State: PUBLISHED Published: 2025-03-13T16:46:05.612Z Last Updated: 2025-08-19T12:49:03.122Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-457 Description: A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: -
crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE ID: CVE-2025-1428 State: PUBLISHED Published: 2025-03-13T16:46:22.348Z Last Updated: 2025-08-19T12:49:25.168Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-125 Description: A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA A
read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE ID: CVE-2025-1429 State: PUBLISHED Published: 2025-03-13T16:47:42.309Z Last Updated: 2025-08-19T12:49:52.296Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-122 Description: A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP
ad sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE ID: CVE-2025-1430 State: PUBLISHED Published: 2025-03-13T16:48:13.960Z Last Updated: 2025-08-19T12:50:16.708Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-120 Description: A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE ID: CVE-2025-1431 State: PUBLISHED Published: 2025-03-13T16:48:51.554Z Last Updated: 2025-08-19T12:50:43.475Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-125 Description: A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA AD
ead sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE ID: CVE-2025-1432 State: PUBLISHED Published: 2025-03-13T16:49:14.298Z Last Updated: 2025-08-28T18:10:47.098Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-416 Description: A maliciously crafted 3DM file, when parsed through Autodesk AutoCAD, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnri
itive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE ID: CVE-2025-1433 State: PUBLISHED Published: 2025-03-13T16:51:06.105Z Last Updated: 2025-08-19T12:56:16.723Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D Problem Types: CWE-125 Description: A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP
CVE ID: CVE-2025-1434 State: PUBLISHED Published: 2025-03-11T07:23:50.384Z Last Updated: 2025-03-11T15:43:59.371Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L) Vendors: AREAL SAS Products: Topkapi Vision Webserv2 Problem Types: CWE-79 Description: The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. Disclosure of secrets or other system settings is not affected as well as other spreadsheets still work as expected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.areal-topkapi.com/en/topkapi/security-bulletins - https://www.areal-topka
SA ADP Vulnrichment: References: - https://www.areal-topkapi.com/en/topkapi/security-bulletins - https://www.areal-topkapi.com/topkapi/bulletins-de-securite
CVE ID: CVE-2025-1435 State: PUBLISHED Published: 2025-03-05T08:21:54.291Z Last Updated: 2025-03-05T14:26:56.296Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: johnjamesjacoby Products: bbPress Problem Types: CWE-352 Description: The bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11. This is due to missing or incorrect nonce validation on the bbp_user_add_role_on_register() function. This makes it possible for unauthenticated attackers to elevate their privileges to that of a bbPress Keymaster via a forged request granted they can trick a site administrator into performing an action such a
of a bbPress Keymaster via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Rather than implementing a nonce check to provide protection against this vulnerability, which would break functionality, the plugin no longer makes it possible to select a role during registration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d776d94-8c81-4e88-bae3-946824a75c09?source=cve - https://plugins.trac.wordpress.org/browser/bbpress/trunk/includes/users/signups.php#L151 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3247345%40bbpr
users/signups.php#L151 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3247345%40bbpress&new=3247345%40bbpress&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3247345/bbpress/branches/2.6/includes/users/capabilities.php
CVE ID: CVE-2025-1436 State: PUBLISHED Published: 2025-03-13T06:00:07.220Z Last Updated: 2025-03-14T16:05:53.487Z Vendors: Unknown Products: Limit Bio Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/849ed0a0-be17-43cf-a3a1-ad54dfb33d57/
CVE ID: CVE-2025-1437 State: PUBLISHED Published: 2025-03-26T09:21:41.809Z Last Updated: 2025-03-26T18:38:20.604Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mdempfle Products: Advanced iFrame Problem Types: CWE-79 Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/676b4768-98ea-4e55-87de-ef7ae1d7a113?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255604%40advanced-iframe&new=3255604%40advanced-iframe&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1439 State: PUBLISHED Published: 2025-03-26T09:21:41.438Z Last Updated: 2025-03-26T13:41:21.043Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mdempfle Products: Advanced iFrame Problem Types: CWE-79 Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes through the 'src' attribute when the src supplied returns a header with an injected value . This makes it possible for authenticated attackers, with contributor-level acce
eturns a header with an injected value . This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac1145b-5ab1-47a9-9117-4870c52a70fc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255604%40advanced-iframe&new=3255604%40advanced-iframe&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1440 State: PUBLISHED Published: 2025-03-26T09:21:51.286Z Last Updated: 2025-03-26T17:36:49.548Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: mdempfle Products: Advanced iFrame Problem Types: CWE-20 Description: The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possible for unauthenticated attackers to update the advancediFrameParameterData option with an excessive amount of unvalidated data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
option with an excessive amount of unvalidated data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b92913fa-aa1e-40a0-9a48-d730b2102217?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255604%40advanced-iframe&new=3255604%40advanced-iframe&sfp_email=&sfph_mail=#file1
CVE ID: CVE-2025-1441 State: PUBLISHED Published: 2025-02-19T04:21:28.536Z Last Updated: 2025-02-19T14:57:36.571Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-352 Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wpr_filter_woo_products' function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performi
attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6bc6a436-6df3-4eaf-a16b-d8b3c3ca7d87?source=cve - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1008/classes/modules/wpr-filter-woo-products.php#L1904 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1007/classes/modules/wpr-filter-woo-products.php#L1895
CVE ID: CVE-2025-1445 State: PUBLISHED Published: 2025-03-25T12:38:56.794Z Last Updated: 2025-03-25T13:09:43.952Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: RTU500 Problem Types: CWE-820 Description: A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in specific timing situations, when IEC61850 communication is active. Precondition is that IEC61850 as client or server are configured using TLS on RTU500 device. It affects the CMU the IEC61850 stack is configured on. Additional Analyst Notes: - CISA ADP Vulnrichmen
RTU500 device. It affects the CMU the IEC61850 stack is configured on. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true
CVE ID: CVE-2025-1446 State: PUBLISHED Published: 2025-03-23T06:00:04.960Z Last Updated: 2025-03-24T18:20:06.540Z Vendors: Unknown Products: Pods Problem Types: CWE-89 SQL Injection Description: The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c170fb45-7ed5-40ef-99f6-8da035a23d89/
CVE ID: CVE-2025-1447 State: PUBLISHED Published: 2025-02-19T00:00:15.877Z Last Updated: 2025-02-19T14:50:55.723Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: kasuganosoras Products: Pigeon Problem Types: CWE-918 Description: A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgproxy/index.php. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version 1.0.181 is able to address this issue. The patch is identified as 84cea5fe73141689da2e7ec8676d47435bd6423e. It is recommended to u
able to address this issue. The patch is identified as 84cea5fe73141689da2e7ec8676d47435bd6423e. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296134 - https://vuldb.com/?ctiid.296134 - https://vuldb.com/?submit.501978 - https://github.com/sheratan4/cve/issues/2 - https://github.com/kasuganosoras/Pigeon/commit/84cea5fe73141689da2e7ec8676d47435bd6423e - https://github.com/kasuganosoras/Pigeon/releases/tag/1.0.181
CVE ID: CVE-2025-1448 State: PUBLISHED Published: 2025-02-19T01:31:04.066Z Last Updated: 2025-02-19T14:50:13.515Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Synway Products: SMG Gateway Management Software Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in Synway SMG Gateway Management Software up to 20250204. It has been rated as critical. This issue affects some unknown processing of the file 9-12ping.php. The manipulation of the argument retry leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any wa
closed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296135 - https://vuldb.com/?ctiid.296135 - https://vuldb.com/?submit.494788 - https://github.com/stevenchen0x01/CVE/issues/1