Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-32350 State: PUBLISHED Published: 2025-09-04T18:34:03.809Z Last Updated: 2025-09-06T03:56:09.925Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/47424521c49b638334ed676223e7191178074da9 - https://source.android.com/security/
glesource.com/platform/frameworks/base/+/47424521c49b638334ed676223e7191178074da9 - https://source.android.com/security/bulletin/2025-09-01
CVE ID: CVE-2025-32352 State: PUBLISHED Published: 2025-04-05T00:00:00.000Z Last Updated: 2025-04-07T16:21:46.897Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Zend Products: ZendTo Problem Types: CWE-843 Description: A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interpreted as numbers. A solution requires moving from MD5 to bcrypt. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://projectblack.io/blog/zendto-nday-vulnerabilities/
CVE ID: CVE-2025-32353 State: PUBLISHED Published: 2025-07-16T00:00:00.000Z Last Updated: 2025-11-24T15:27:37.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the collector.txt configuration file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://galacticadvisors.com - https://codykretsinger.com - https://www.galacticadvisors.com/release/critical-vulnerabilities-in-network-detective/ - https://www.galacticadvisors.com/release/cve/
CVE ID: CVE-2025-32354 State: PUBLISHED Published: 2025-04-29T00:00:00.000Z Last Updated: 2025-05-06T15:34:54.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying contacts, changing account settings, and accessing sensitive user data when an authenticated user visits a malicious website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Securi
malicious website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes
CVE ID: CVE-2025-32357 State: PUBLISHED Published: 2025-04-05T00:00:00.000Z Last Updated: 2025-04-07T16:13:18.275Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Zammad Products: Zammad Problem Types: CWE-288 Description: In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they have no permission for. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zammad.com/en/advisories/zaa-2025-04
CVE ID: CVE-2025-32358 State: PUBLISHED Published: 2025-04-05T00:00:00.000Z Last Updated: 2025-04-07T16:12:55.755Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Zammad Products: Zammad Problem Types: CWE-918 Description: In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This could be abused by an attacker to cause GET requests for example in the local network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
o cause GET requests for example in the local network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zammad.com/en/advisories/zaa-2025-01
CVE ID: CVE-2025-32359 State: PUBLISHED Published: 2025-04-05T00:00:00.000Z Last Updated: 2025-04-07T16:12:34.420Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Zammad Products: Zammad Problem Types: CWE-602 Description: In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zammad.com/en/advisories/zaa-2025-02
CVE ID: CVE-2025-32360 State: PUBLISHED Published: 2025-04-05T00:00:00.000Z Last Updated: 2025-04-07T16:12:08.839Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Zammad Products: Zammad Problem Types: CWE-402 Description: In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see details about shared drafts for their customer tickets in the browser console, which may contain confidential information, and also to manipulate them via API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zammad.com/en/advisories/zaa-2025-
hem via API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zammad.com/en/advisories/zaa-2025-03
CVE ID: CVE-2025-32363 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T13:47:08.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medidok.de/aktuelles-neuigkeiten/ - https://medidok.de/neueversionen/update-medidok-2-5-18-43-verfugbar/ - https://code-white.com/public-vulnerability-list/#unauthenticated-remote-code-execution-via-deserialization-of-untrusted-data-in-m
CVE ID: CVE-2025-32364 State: PUBLISHED Published: 2025-04-05T00:00:00.000Z Last Updated: 2025-11-03T19:53:22.420Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: freedesktop Products: Poppler Problem Types: CWE-190 Description: A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/-/issues/1574 - https://gitlab.freedesktop.org/poppler/poppler/-/commit/d87bc726c7cc98f8c26b60ece5f20236e9de1bc3
CVE ID: CVE-2025-32365 State: PUBLISHED Published: 2025-04-05T00:00:00.000Z Last Updated: 2025-11-03T19:53:23.763Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: freedesktop Products: Poppler Problem Types: CWE-125 Description: Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/-/issues/1577 - https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1792
CVE ID: CVE-2025-32366 State: PUBLISHED Published: 2025-04-05T00:00:00.000Z Last Updated: 2025-04-15T15:15:06.273Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: ConnMan Products: ConnMan Problem Types: CWE-130 Description: In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen) without a check for whether the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be larger than the amount of remaining packet data in the current state of parsing. Values of stack memory locations may be sent over the network in a response. Additional
n the current state of parsing. Values of stack memory locations may be sent over the network in a response. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n1001 - https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n988 - https://lapis-sawfish-be3.notion.site/0-day-Comman-memory-Leak-190dc00d01d080688472d322c93c4340 - https://web.archive.org/web/20250410130356/https://lapis-sawfish-be3.notion.site/0-day-Comman-memory-Leak-190dc00d01d080688472d322c93c4340
CVE ID: CVE-2025-32367 State: PUBLISHED Published: 2025-04-11T00:00:00.000Z Last Updated: 2025-04-11T17:40:00.539Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Oz Forensics Products: face recognition application Problem Types: CWE-425 Description: The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ozforensics.com/ - https://medium.com/@antonsimonyan7/idor-in-oz-forensics-face-recognition-application-cve-2025-32367-5368
orensics.com/ - https://medium.com/@antonsimonyan7/idor-in-oz-forensics-face-recognition-application-cve-2025-32367-53684ee312ea
CVE ID: CVE-2025-32369 State: PUBLISHED Published: 2025-04-06T00:00:00.000Z Last Updated: 2025-04-07T14:10:54.321Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Kentico Products: Xperience Problem Types: CWE-79 Description: Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious content (for stored XSS) via certain interactions with the media library file upload feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devnet.kentico.com/download/hotfixes
CVE ID: CVE-2025-32370 State: PUBLISHED Published: 2025-04-06T00:00:00.000Z Last Updated: 2025-04-07T14:10:46.825Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: Kentico Products: Xperience Problem Types: CWE-912 Description: Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devnet.kentico.com/download/hotfixes
G or XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devnet.kentico.com/download/hotfixes - https://labs.watchtowr.com/xss-to-rce-by-abusing-custom-file-handlers-kentico-xperience-cms-cve-2025-2748/
CVE ID: CVE-2025-32371 State: PUBLISHED Published: 2025-04-09T15:14:29.025Z Last Updated: 2025-04-09T15:41:55.992Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-451 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that the information is legitimate. This vulnerability is fixed in 9.13.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
ion is legitimate. This vulnerability is fixed in 9.13.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2rrc-g594-rhqw - https://github.com/dnnsoftware/Dnn.Platform/commit/5def7cc2e7931bb1041b21540bde99f96874a5a9
CVE ID: CVE-2025-32372 State: PUBLISHED Published: 2025-04-09T15:14:35.442Z Last Updated: 2025-04-09T15:42:10.913Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-918 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server sen
cent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3f7v-qx94-666m - https://github.com/dnnsoftware/Dnn.Platform/commit/4721dd9eef846936d3b1a3676499e46968d15feb
CVE ID: CVE-2025-32373 State: PUBLISHED Published: 2025-04-09T15:14:43.704Z Last Updated: 2025-04-09T15:42:50.064Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-639 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-vxcm
Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-vxcm-4rwh-chpc
CVE ID: CVE-2025-32374 State: PUBLISHED Published: 2025-04-09T15:14:51.957Z Last Updated: 2025-04-09T15:44:49.820Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-770 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-vc6j-mcqj-rgfp
CVE ID: CVE-2025-32375 State: PUBLISHED Published: 2025-04-09T15:30:03.842Z Last Updated: 2025-04-09T15:40:52.656Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: bentoml Products: BentoML Problem Types: CWE-502 Description: BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerab
erver, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerability is fixed in 1.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bentoml/BentoML/security/advisories/GHSA-7v4r-c989-xh26
CVE ID: CVE-2025-32376 State: PUBLISHED Published: 2025-04-30T14:55:21.473Z Last Updated: 2025-04-30T15:08:52.268Z Vendors: discourse Products: discourse Problem Types: CWE-284 Description: Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-mqqq-h2x3-46fr - https://github.com/disco
References: - https://github.com/discourse/discourse/security/advisories/GHSA-mqqq-h2x3-46fr - https://github.com/discourse/discourse/commit/21a7f3162221c393f9bb13721451aa7f237d881a
CVE ID: CVE-2025-32377 State: PUBLISHED Published: 2025-04-18T19:59:32.286Z Last Updated: 2025-04-18T20:35:41.744Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: RasaHQ Products: rasa-pro-security-advisories Problem Types: CWE-306 Description: Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source.
ls.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticated source. This issue has been patched for audiocodes, audiocodes_stream, and genesys connectors in versions 3.9.20, 3.10.19, 3.11.7 and 3.12.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RasaHQ/security-advisories/security/advisories/GHSA-7xq5-54jp-2mfg
CVE ID: CVE-2025-32378 State: PUBLISHED Published: 2025-04-09T15:37:44.010Z Last Updated: 2025-04-09T20:46:25.559Z Vendors: shopware Products: shopware Problem Types: CWE-799 Description: Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in t
th these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-4h9w-7vfp-px8m
CVE ID: CVE-2025-32379 State: PUBLISHED Published: 2025-04-09T15:56:40.574Z Last Updated: 2025-04-09T20:45:15.899Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: koajs Products: koa Problem Types: CWE-79 Description: Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v - https://github.com/koajs/
richment: References: - https://github.com/koajs/koa/security/advisories/GHSA-x2rg-q646-7m2v - https://github.com/koajs/koa/commit/ff25eb4a7f2392df46481fe86355161067687312
CVE ID: CVE-2025-32380 State: PUBLISHED Published: 2025-04-09T16:05:45.994Z Last Updated: 2025-04-09T20:43:06.645Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: apollographql Products: router Problem Types: CWE-770 Description: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This could lead to excessive resource consumption and denial of service. Apollo Router's usage of Apollo Compiler has been u
could lead to excessive resource consumption and denial of service. Apollo Router's usage of Apollo Compiler has been updated so that validation logic processes each named fragment only once, preventing redundant traversal. This has been remediated in apollo-router versions 1.61.2 and 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/router/security/advisories/GHSA-3j43-9v8v-cp3f - https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564 - https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952
CVE ID: CVE-2025-32381 State: PUBLISHED Published: 2025-04-09T16:00:10.642Z Last Updated: 2025-04-09T20:43:33.169Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: mlc-ai Products: xgrammar Problem Types: CWE-770 Description: XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can be abused to fill up a host's memory and case a denial of service. For example, sending many small requests to an LLM inf
e abused to fill up a host's memory and case a denial of service. For example, sending many small requests to an LLM inference server with unique JSON schemas would eventually cause this denial of service to occur. This vulnerability is fixed in 0.1.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-389x-67px-mjg3 - https://github.com/mlc-ai/xgrammar/pull/243 - https://github.com/vllm-project/vllm/pull/16283
CVE ID: CVE-2025-32382 State: PUBLISHED Published: 2025-04-10T14:40:53.861Z Last Updated: 2025-04-10T15:23:19.566Z Vendors: metabase Products: metabase Problem Types: CWE-532 Description: Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a password or changing password to private key or vice versa), Metabase would not always purge older Snowflake connection details from the application database. In order to remove older and stale connection details, Metabase would try one connection method at a time and purge all the other connection methods from the application database. When Metabase fo
e connection method at a time and purge all the other connection methods from the application database. When Metabase found a connection that worked, it would log (log/infof "Successfully connected, migrating to: %s" (pr-str test-details)) which would then print the username and password to the logger. This is fixed in 52.17.1, 53.9.5 and 54.1.5 in both the OSS and enterprise editions. Versions 51 and lower are not impacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-832j-56xw-5p7f