Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-25230 State: PUBLISHED Published: 2025-04-16T21:29:50.053Z Last Updated: 2025-04-17T13:17:10.703Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Omnissa Products: Omnissa Horizon Client for Windows Description: Omnissa Horizon Client for Windows contains an LPE Vulnerability. A malicious actor with local access where Horizon Client for Windows is installed may be able to elevate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://static.omnissa.com/sites/default/files/OMSA-2025-0001.pdf - https://www.omnissa.com/omnissa-security-response/
CVE ID: CVE-2025-25231 State: PUBLISHED Published: 2025-08-11T18:12:49.711Z Last Updated: 2025-08-11T18:26:45.876Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Omnissa Products: Omnissa Workspace ONE UEM Description: Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://static.omnissa.com/sites/default/files/OMSA-2025-0004.pdf - https://www.omnissa.com/omnissa-security-response/
CVE ID: CVE-2025-25234 State: PUBLISHED Published: 2025-04-17T14:58:36.397Z Last Updated: 2025-04-17T18:53:19.945Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Omnissa Products: Omnissa Unified Access Gateway (UAG) Description: Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://static.omnissa.com/sites/default/files/OMSA-2025-0002.pdf - https://www.omnissa.com/omnissa-security-response/
CVE ID: CVE-2025-25235 State: PUBLISHED Published: 2025-08-11T21:47:25.510Z Last Updated: 2025-08-12T15:45:31.666Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Omnissa Products: Secure Email Gateway Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in Omnissa Secure Email Gateway (SEG) in SEG prior to 2.32 running on Windows and SEG prior to 2503 running on UAG allows routing of network traffic such as HTTP requests to internal networks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.omnissa.com/omsa-2025-0003/
CVE ID: CVE-2025-25236 State: PUBLISHED Published: 2025-11-12T17:41:57.042Z Last Updated: 2025-11-12T21:04:33.914Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Omnissa Products: Omnissa Workspace ONE UEM Problem Types: CWE-204 Description: Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://static.omnissa.com/sites/default/files/OMSA-2025-0005.pdf - https://www.omnissa
ADP Vulnrichment: References: - https://static.omnissa.com/sites/default/files/OMSA-2025-0005.pdf - https://www.omnissa.com/omnissa-security-response/
CVE ID: CVE-2025-25241 State: PUBLISHED Published: 2025-02-11T00:37:53.612Z Last Updated: 2025-02-18T18:04:01.194Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Fiori Apps Reference Library (My Overtime Requests) Problem Types: CWE-862 Description: Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3532025
pact on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3532025 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-25242 State: PUBLISHED Published: 2025-03-11T00:32:28.733Z Last Updated: 2025-03-11T02:13:11.225Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP Problem Types: CWE-79 Description: SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3562390 - https://url.sap/s
y. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3562390 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-25243 State: PUBLISHED Published: 2025-02-11T00:38:02.558Z Last Updated: 2025-02-18T18:03:33.640Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP Supplier Relationship Management (Master Data Management Catalog) Problem Types: CWE-22 Description: SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me
with no impact to integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3567551 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-25244 State: PUBLISHED Published: 2025-03-11T00:34:42.757Z Last Updated: 2025-03-11T02:12:02.750Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: SAP_SE Products: SAP Business Warehouse (Process Chains) Problem Types: CWE-862 Description: SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results
data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results in business reporting leading to a significant impact on integrity. However, there is no impact on confidentiality or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3552144 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-25245 State: PUBLISHED Published: 2025-03-11T00:34:56.115Z Last Updated: 2025-03-11T02:10:07.773Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) Problem Types: CWE-79 Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a limited impact on confidentiality and integrity within the scope of victim�s browser.
ful exploitation, there could be a limited impact on confidentiality and integrity within the scope of victim�s browser. There is no impact on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3557469 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-25246 State: PUBLISHED Published: 2025-02-05T00:00:00.000Z Last Updated: 2025-02-12T20:51:31.641Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: XR1000, XR1000v2, XR500 Problem Types: CWE-94 Description: NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.netgear.com/000066558/Security-Advisory-for-Unauthenticated-RCE-on-Some-WiFi-Routers-PSV-2023-0039
CVE ID: CVE-2025-25247 State: PUBLISHED Published: 2025-02-10T11:16:59.979Z Last Updated: 2025-02-10T14:40:10.467Z Vendors: Apache Software Foundation Products: Apache Felix Webconsole Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/z47jbf0rbylzd0ktfzdw9c8b5fpyl24m
CVE ID: CVE-2025-25248 State: PUBLISHED Published: 2025-08-12T18:59:39.985Z Last Updated: 2025-08-13T20:14:04.480Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiOS, FortiPAM, FortiProxy Problem Types: CWE-190 Description: An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.
l versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-364
CVE ID: CVE-2025-25250 State: PUBLISHED Published: 2025-06-10T16:36:19.264Z Last Updated: 2025-06-11T14:43:04.625Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiOS Problem Types: CWE-200 Description: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiOS version 7.6.0, version 7.4.7 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions SSL-VPN web-mode may allow an authenticated user to access full SSL-VPN settings via crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-257
CVE ID: CVE-2025-25251 State: PUBLISHED Published: 2025-05-28T07:53:42.390Z Last Updated: 2025-05-29T03:55:41.794Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiClientMac Problem Types: CWE-863 Description: An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local attacker to escalate privileges via crafted XPC messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-016
CVE ID: CVE-2025-25252 State: PUBLISHED Published: 2025-10-14T15:23:08.121Z Last Updated: 2025-10-16T17:16:56.759Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-613 Description: An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record. Additional Analyst Notes
the SAML record of a user session to access or re-open that session via re-use of SAML record. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-487
CVE ID: CVE-2025-25253 State: PUBLISHED Published: 2025-10-14T15:22:56.370Z Last Updated: 2025-10-16T03:57:12.022Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiPAM, FortiOS, FortiProxy Problem Types: CWE-297 Description: An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to th
oxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-457
CVE ID: CVE-2025-25254 State: PUBLISHED Published: 2025-04-08T14:02:44.133Z Last Updated: 2025-04-09T04:00:35.149Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-22 Description: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-474
CVE ID: CVE-2025-25255 State: PUBLISHED Published: 2025-10-14T15:23:09.821Z Last Updated: 2025-10-16T12:34:39.818Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-358 Description: An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0.1 through 7.0.21, and FortiOS 7.6.0 through 7.6.3 explicit web proxy may allow an authenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortigua
ion feature via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-372
CVE ID: CVE-2025-25256 State: PUBLISHED Published: 2025-08-12T18:59:14.863Z Last Updated: 2025-08-16T03:55:46.637Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:X/RC:C) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container
ed code or commands via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-152
CVE ID: CVE-2025-25257 State: PUBLISHED Published: 2025-07-17T15:10:04.532Z Last Updated: 2025-10-21T22:45:22.099Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-89 Description: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and below 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fort
crafted HTTP or HTTPs requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-151
CVE ID: CVE-2025-25264 State: PUBLISHED Published: 2025-06-16T09:45:31.613Z Last Updated: 2025-11-21T11:36:54.281Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: WAGO Products: CC100 0751-9x01, PFC100 G1 0750-810x/xxxx-xxxx, PFC100 G2 0750-811x-xxxx-xxxx, PFC200 G1 750-820x-xxx-xxx, PFC200 G2 750-821x-xxx-xxx, TP600 0762-420x/8000-000x, TP600 0762-430x/8000-000x, TP600 0762-520x/8000-000x, TP600 0762-530x/8000-000x, TP600 0762-620x/8000-000x, TP600 0762-630x/8000-000x, Edge Controller 0752-8303/8000-0002 Problem Types: CWE-942 Description: An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The cur
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-018/
CVE ID: CVE-2025-25265 State: PUBLISHED Published: 2025-06-16T09:46:13.998Z Last Updated: 2025-11-21T11:38:18.852Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: WAGO Products: WAGO CC100 0751-9x01, CC100 0751-9x01, PFC100 G1 0750-810x/xxxx-xxxx, PFC100 G2 0750-811x-xxxx-xxxx, PFC200 G1 750-820x-xxx-xxx, PFC200 G2 750-821x-xxx-xxx, TP600 0762-420x/8000-000x, TP600 0762-430x/8000-000x, TP600 0762-520x/8000-000x, TP600 0762-530x/8000-000x, TP600 0762-620x/8000-000x, TP600 0762-630x/8000-000x, Edge Controller 0752-8303/8000-0002 Problem Types: CWE-306 Description: A web application for configuring the controller is accessible at a specific path. It contains an
: CWE-306 Description: A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-018/
CVE ID: CVE-2025-25266 State: PUBLISHED Published: 2025-03-11T09:48:19.594Z Last Updated: 2025-03-11T14:22:07.380Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: Siemens Products: Tecnomatix Plant Simulation V2302, Tecnomatix Plant Simulation V2404 Problem Types: CWE-552 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict access to the file deletion functionality. This could allow an unauthorized attacker to delete files even when access to the system should be prohibited, resulting
This could allow an unauthorized attacker to delete files even when access to the system should be prohibited, resulting in potential data loss or unauthorized modification of system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-507653.html
CVE ID: CVE-2025-25267 State: PUBLISHED Published: 2025-03-11T09:48:20.909Z Last Updated: 2025-03-11T14:20:34.812Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: Tecnomatix Plant Simulation V2302, Tecnomatix Plant Simulation V2404 Problem Types: CWE-552 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict the scope of files accessible to the simulation model. This could allow an unauthorized attacker to compromise the confidentiality of the system. Additional Analys
tion model. This could allow an unauthorized attacker to compromise the confidentiality of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-507653.html
CVE ID: CVE-2025-25268 State: PUBLISHED Published: 2025-07-08T07:00:27.103Z Last Updated: 2025-07-08T14:29:11.096Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-306 Description: An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-019
CVE ID: CVE-2025-25269 State: PUBLISHED Published: 2025-07-08T07:00:42.749Z Last Updated: 2025-07-08T14:29:03.328Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-78 Description: An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-019
CVE ID: CVE-2025-25270 State: PUBLISHED Published: 2025-07-08T07:00:58.478Z Last Updated: 2025-07-08T14:28:53.445Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-913 Description: An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-019
CVE ID: CVE-2025-25271 State: PUBLISHED Published: 2025-07-08T07:01:33.274Z Last Updated: 2025-07-22T07:50:50.592Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-1188 Description: An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-019
CVE ID: CVE-2025-25273 State: PUBLISHED Published: 2025-08-12T16:59:15.523Z Last Updated: 2025-08-14T03:55:57.145Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) 700 Series Ethernet Problem Types: Escalation of Privilege, CWE-691 Description: Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01335.html
CVE ID: CVE-2025-25274 State: PUBLISHED Published: 2025-03-21T08:24:13.165Z Last Updated: 2025-03-21T17:27:56.172Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates