Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ault configurations. Version 2.4.13 contains a patch for CVE-2025-58364. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OpenPrinting/cups/security/advisories/GHSA-7qx3-r744-6qv4 - https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d
CVE ID: CVE-2025-58365 State: PUBLISHED Published: 2025-09-08T21:19:09.381Z Last Updated: 2025-09-09T13:37:45.479Z Vendors: xwiki-contrib Products: application-blog Problem Types: CWE-95 Description: The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, the blog application in XWiki allowed remote code execution for any user who has edit right on any page. Normally, these are all logged-in users as they can edit their own user profile. For an exploit, it is sufficient to add an object of type `Blog.BlogPostClass` to any page and to add some script macro with the exploit code to the "Content" field of that object. The vulnerabili
s` to any page and to add some script macro with the exploit code to the "Content" field of that object. The vulnerability has been patched in the blog application version 9.14 by executing the content of blog posts with the rights of the appropriate author. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki-contrib/application-blog/security/advisories/GHSA-gwj6-xpfg-pxwr - https://github.com/xwiki-contrib/application-blog/commit/b98ab6f17da3029576f42d12b4442cd555c7e0b4 - https://jira.xwiki.org/browse/BLOG-191
CVE ID: CVE-2025-58366 State: PUBLISHED Published: 2025-09-05T21:29:46.796Z Last Updated: 2025-09-08T20:06:36.035Z Vendors: InseeFrLab Products: onyxia Problem Types: CWE-522 Description: Onyxia is a data science environment for kubernetes. In versions 4.6.0 through 4.8.0, Onyxia-API leaked the credentials of private helm repositories in the public (unauthenticated) /public/catalogs endpoint.vOnly instances using private helm repositories (i.e setting username & password in the catalogs configuration) are affected. This is fixed in version 4.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-m773-6vm8-8x6q - htt
CISA ADP Vulnrichment: References: - https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-m773-6vm8-8x6q - https://github.com/InseeFrLab/onyxia-api/pull/613 - https://github.com/InseeFrLab/onyxia-api/releases/tag/v4.9.0
CVE ID: CVE-2025-58367 State: PUBLISHED Published: 2025-09-05T21:52:31.743Z Last Updated: 2025-09-08T20:08:37.812Z Vendors: seperman Products: deepdiff Problem Types: CWE-915 Description: DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization) exploitation. The gadget available in DeepDiff allows `deepdiff.serialization.SAFE_TO_IMPORT` to be modified to allow dangerous classes such as posix.system, and then perform insecure
.serialization.SAFE_TO_IMPORT` to be modified to allow dangerous classes such as posix.system, and then perform insecure Pickle deserialization via the Delta class. This potentially allows any Python code to be executed, given that the input to Delta is user-controlled. Depending on the application where DeepDiff is used, this can also lead to other vulnerabilities. This is fixed in version 8.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/seperman/deepdiff/security/advisories/GHSA-mw26-5g2v-hqw3 - https://github.com/seperman/deepdiff/commit/c69c06c13f75e849c770ade3f556cd16209fd183 - https://github.com/seperman/deepdiff/releases/tag/8.6.1
CVE ID: CVE-2025-58369 State: PUBLISHED Published: 2025-09-05T21:59:58.981Z Last Updated: 2025-11-07T11:52:43.148Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: typelevel Products: fs2 Problem Types: CWE-400 Description: fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When establishing a TLS session, if one side of the connection shuts down `write` while the peer side is awaiting more data to progress the TLS handshake, the peer side w
e connection shuts down `write` while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. The CPU is consumed until the overall connection is closed, potentially shutting down a fs2-io powered server. This issue is fixed in versions 2.5.13, 3.12.1, and 3.13.0-M7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/typelevel/fs2/security/advisories/GHSA-rrw2-px9j-qffj - https://github.com/typelevel/fs2/issues/3590 - https://github.com/typelevel/fs2/commit/46e2dc3abf994dcf3d0b804b2ddb3c10c04d4976 - https://github.com/typelevel/fs2/commit/5c6c4c6c1ef330f7e6b53661ecc63d5f5ba8885
e2dc3abf994dcf3d0b804b2ddb3c10c04d4976 - https://github.com/typelevel/fs2/commit/5c6c4c6c1ef330f7e6b53661ecc63d5f5ba8885c - https://github.com/typelevel/fs2/commit/edf0c4f2e660360d1c1a8c5377ce32294de89238 - https://github.com/typelevel/fs2/releases/tag/v3.12.2 - https://github.com/typelevel/fs2/releases/tag/v3.13.0-M7
CVE ID: CVE-2025-58370 State: PUBLISHED Published: 2025-09-05T22:09:04.786Z Last Updated: 2025-09-08T20:10:12.235Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RooCodeInc Products: Roo-Code Problem Types: CWE-78 Description: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions below 3.26.0 contain a vulnerability in the command parsing logic where the Bash parameter expansion and indirect reference were not handled correctly. If the agent was configured to auto-approve execution of certain commands, an attacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the inten
ttacker able to influence prompts could abuse this weakness to execute additional arbitrary commands alongside the intended one. This is fixed in version 3.26.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-2rm5-cvcm-7592
CVE ID: CVE-2025-58371 State: PUBLISHED Published: 2025-09-05T22:42:59.876Z Last Updated: 2025-09-08T20:10:59.998Z Vendors: RooCodeInc Products: Roo-Code Problem Types: CWE-78 Description: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Code Execution (RCE) on the Actions runner. The workflow runs with broad permissions and access to repository secrets. It is possible for an attacker to execute arbitrary commands on the runner, push or modify code in the repository, access secrets, and
for an attacker to execute arbitrary commands on the runner, push or modify code in the repository, access secrets, and create malicious releases or packages, resulting in a complete compromise of the repository and its associated services. This is fixed in version 3.26.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-xr6r-vj48-29f6 - https://github.com/RooCodeInc/Roo-Code/commit/a0384f35d5ae3b7f66506cc62dda25d9bb673f49
CVE ID: CVE-2025-58372 State: PUBLISHED Published: 2025-09-05T22:51:01.725Z Last Updated: 2025-09-08T20:11:45.799Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RooCodeInc Products: Roo-Code Problem Types: CWE-732, CWE-94 Description: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where certain VS Code workspace configuration files (.code-workspace) are not protected in the same way as the .vscode folder. If the agent was configured to auto-approve file writes, an attacker able to influence prompts (for example via prompt injection) could cause malicious workspace settings or
es, an attacker able to influence prompts (for example via prompt injection) could cause malicious workspace settings or tasks to be written. These tasks could then be executed automatically when the workspace is reopened, resulting in arbitrary code execution. This issue is fixed in version 3.26.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-4pqh-4ggm-jfmm - https://github.com/RooCodeInc/Roo-Code/commit/296edfc829a7c6efc8b5dbe09aa766a9aed79598 - https://github.com/RooCodeInc/Roo-Code/releases/tag/v3.26.0
CVE ID: CVE-2025-58373 State: PUBLISHED Published: 2025-09-05T22:55:54.546Z Last Updated: 2025-09-08T20:12:43.405Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: RooCodeInc Products: Roo-Code Problem Types: CWE-59 Description: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where .rooignore protections could be bypassed using symlinks. This allows an attacker with write access to the workspace to trick the extension into reading files that were intended to be excluded. As a result, sensitive files such as .env or configuration files could be exposed. An attacker able to modif
e excluded. As a result, sensitive files such as .env or configuration files could be exposed. An attacker able to modify files within the workspace could gain unauthorized access to sensitive information by bypassing .rooignore rules. This could include secrets, configuration details, or other excluded project data. This is fixed in version 3.26.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-p76r-7mc3-qh7c - https://github.com/RooCodeInc/Roo-Code/pull/7405 - https://github.com/RooCodeInc/Roo-Code/releases/tag/v3.26.0
CVE ID: CVE-2025-58374 State: PUBLISHED Published: 2025-09-06T02:19:40.112Z Last Updated: 2025-09-08T14:05:33.807Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: RooCodeInc Products: Roo-Code Problem Types: CWE-78 Description: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle scripts, if a repository’s package.json file contains a malicious postinstall script, it would be executed automatically without user approval. This
ackage.json file contains a malicious postinstall script, it would be executed automatically without user approval. This means that enabling auto-approved commands and opening a malicious repo could result in arbitrary code execution. This is fixed in version 3.26.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-c292-qxq4-4p2v - https://github.com/RooCodeInc/Roo-Code/pull/7390/files - https://github.com/RooCodeInc/Roo-Code/releases/tag/v3.26.0
CVE ID: CVE-2025-58375 State: REJECTED Published: N/A Last Updated: 2025-09-05T23:47:21.553Z Description: No description available.
CVE ID: CVE-2025-58384 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T18:40:58.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc administration interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://update.doxense.com/ - https://doc.doxense.com/Watchdoc/J_Securite/cve-2025-58384.htm
CVE ID: CVE-2025-58385 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T15:48:08.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://update.doxense.com/ - https://doc.doxense.com/Watchdoc/J_Securite/cve-2025-58385.htm
CVE ID: CVE-2025-58400 State: PUBLISHED Published: 2025-09-05T05:36:34.661Z Last Updated: 2025-09-05T13:37:08.324Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: RATOC Systems, Inc. Products: RATOC RAID Monitoring Manager for Windows Problem Types: CWE-428 Description: RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ratocsystems.com/topics/userinfo/raidmanager202508/ - https://w
otes: - CISA ADP Vulnrichment: References: - https://www.ratocsystems.com/topics/userinfo/raidmanager202508/ - https://www.ratocsystems.com/dlsoft/dlsoft_storage/dlsoft_hddcase/raidmanager/ - https://jvn.jp/en/jp/JVN98737186/
CVE ID: CVE-2025-58401 State: PUBLISHED Published: 2025-09-05T04:28:24.638Z Last Updated: 2025-09-05T15:49:35.945Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Pierre-Adrien Vasseur Products: Obsidian GitHub Copilot Plugin Problem Types: CWE-312 Description: Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Pierrad/obsidian-github-copilot/releases/tag/1.1.7 - https://jvn.jp/en/jp/JVN41633999/
CVE ID: CVE-2025-58407 State: PUBLISHED Published: 2025-11-17T17:18:18.831Z Last Updated: 2025-11-17T17:35:06.099Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-367 Description: Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trigger a read and/or write of data outside the allotted memory escaping the virtual machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-58410 State: PUBLISHED Published: 2025-11-17T16:57:05.418Z Last Updated: 2025-11-17T20:55:22.714Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-280 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only. This is caused by improper handling of the memory protections for the buffer resource. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-58412 State: PUBLISHED Published: 2025-11-19T09:49:04.525Z Last Updated: 2025-11-20T16:36:14.427Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-80 Description: A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 through 7.6.3, FortiADC 7.4 all versions, FortiADC 7.2 all versions may allow attacker to execute unauthorized code or commands via crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-736
CVE ID: CVE-2025-58413 State: PUBLISHED Published: 2025-11-18T17:01:22.032Z Last Updated: 2025-11-21T08:35:53.129Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C) Vendors: Fortinet Products: FortiSASE, FortiOS Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
rized code or commands via specially crafted packets Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-632
CVE ID: CVE-2025-58414 State: REJECTED Published: N/A Last Updated: 2025-09-02T02:55:09.738Z Description: No description available.
CVE ID: CVE-2025-58415 State: REJECTED Published: N/A Last Updated: 2025-09-02T02:55:09.262Z Description: No description available.
CVE ID: CVE-2025-58416 State: REJECTED Published: N/A Last Updated: 2025-09-02T02:55:08.758Z Description: No description available.
CVE ID: CVE-2025-58417 State: REJECTED Published: N/A Last Updated: 2025-09-02T02:55:08.222Z Description: No description available.
CVE ID: CVE-2025-58418 State: REJECTED Published: N/A Last Updated: 2025-09-02T02:55:07.539Z Description: No description available.
CVE ID: CVE-2025-58419 State: REJECTED Published: N/A Last Updated: 2025-09-02T02:55:07.019Z Description: No description available.
CVE ID: CVE-2025-58420 State: REJECTED Published: N/A Last Updated: 2025-09-02T02:55:06.474Z Description: No description available.
CVE ID: CVE-2025-58421 State: REJECTED Published: N/A Last Updated: 2025-09-02T02:55:05.877Z Description: No description available.
CVE ID: CVE-2025-58422 State: PUBLISHED Published: 2025-09-08T04:43:01.703Z Last Updated: 2025-09-08T18:38:49.856Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Ricoh Company, Ltd. Products: RICOH Streamline NX Problem Types: CWE-348 Description: RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middle attack, they may alter the values of HTTP requests, which could result in tampering with the operation history of the product’s management tool. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000010 - https://jvn.jp/en/jp/JVN75307484/
CVE ID: CVE-2025-58423 State: PUBLISHED Published: 2025-11-06T22:31:02.740Z Last Updated: 2025-11-06T22:31:02.740Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: DeviceOn/iEdge Problem Types: CWE-22 Description: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account. References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-01 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-310-01.json - https://www.advantech.com/emt/contact
CVE ID: CVE-2025-58424 State: PUBLISHED Published: 2025-10-15T13:55:47.303Z Last Updated: 2025-10-16T03:56:32.663Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-340 Description: On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000151297
CVE ID: CVE-2025-58426 State: PUBLISHED Published: 2025-10-16T10:03:40.587Z Last Updated: 2025-10-16T13:39:23.736Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: NEOJAPAN Inc. Products: desknet's NEO Problem Types: CWE-321 Description: desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.desknets.com/neo/support/mainte/17475/ - https://jvn.jp/en/jp/JVN90757550/
CVE ID: CVE-2025-58428 State: PUBLISHED Published: 2025-10-23T19:49:23.232Z Last Updated: 2025-10-23T20:29:27.332Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeder-Root Products: TLS4B Automatic Tank Gauge System Problem Types: CWE-77 Description: The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote command execution, full shell access, and potential lateral movement within the network. Additional Analyst Notes
remote command execution, full shell access, and potential lateral movement within the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-03 - https://www.veeder.com/us/software-downloads - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-03.json - https://www.veeder.com/us/network-security-reminder
CVE ID: CVE-2025-58429 State: PUBLISHED Published: 2025-10-23T22:12:13.384Z Last Updated: 2025-10-24T14:28:32.123Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: AutomationDirect Products: Productivity Suite, Productivity 3000 P3-622 CPU, Productivity 3000 P3-550E CPU, Productivity 3000 P3-530 CPU, Productivity 2000 P2-622 CPU, Productivity 2000 P2-550 CPU, Productivity 1000 P1-550 CPU, Productivity 1000 P1-540 CPU Problem Types: CWE-23 Description: A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simu
4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and delete arbitrary files on the target machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01 - https://www.automationdirect.com/support/software-downloads - https://support.automationdirect.com/docs/securityconsiderations.pdf - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json
CVE ID: CVE-2025-58430 State: PUBLISHED Published: 2025-09-09T19:37:45.468Z Last Updated: 2025-09-10T13:55:42.949Z Vendors: knadh Products: listmonk Problem Types: CWE-80, CWE-352, CWE-79 Description: listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can r
ities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/knadh/listmonk/security/advisories/GHSA-rf24-wg77-gq7w