Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-0293 State: PUBLISHED Published: 2025-07-08T15:33:05.165Z Last Updated: 2025-07-08T16:02:46.037Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-93 Description: CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE ID: CVE-2025-0294 State: PUBLISHED Published: 2025-01-07T13:31:05.577Z Last Updated: 2025-01-07T14:16:44.983Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Home Clean Services Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SourceCodester Home Clean Services Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /public_html/admin/process.php. The manipulation of the argument type/length/business leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters mig
The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290443 - https://vuldb.com/?ctiid.290443 - https://vuldb.com/?submit.475076 - https://github.com/xiaosguang/cve/blob/main/Home%20Clean%20Services%20Management/Home%20Clean%20Services%20Management%20System%20process.php%20id%20SQL%20injection.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-0295 State: PUBLISHED Published: 2025-01-07T14:00:13.906Z Last Updated: 2025-08-26T18:47:05.375Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Online Book Shop Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Online Book Shop 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /booklist.php?subcatid=1. The manipulation of the argument subcatnm leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290444 - https://vuldb.com/?ctiid.290444 - https://vuldb.com/?submit.475134 - https://gist.github.com/th4s1s/19d21e7fdbaf3512fccfd75df3080657 - https://code-projects.org/
CVE ID: CVE-2025-0296 State: PUBLISHED Published: 2025-01-07T14:31:05.183Z Last Updated: 2025-08-26T18:47:26.523Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Book Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. The manipulation of the argument subcatid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290445 - https://vuld
ay be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290445 - https://vuldb.com/?ctiid.290445 - https://vuldb.com/?submit.475135 - https://gist.github.com/th4s1s/4ebf1c60bbec213119f2eaac9cd29118 - https://code-projects.org/
CVE ID: CVE-2025-0297 State: PUBLISHED Published: 2025-01-07T15:00:13.864Z Last Updated: 2025-08-28T14:33:50.005Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Book Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Book Shop 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /detail.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290446 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290446 - https://vuldb.com/?ctiid.290446 - https://vuldb.com/?submit.475138 - https://gist.github.com/th4s1s/782f2e19784f48bb80e4d658a49bd680 - https://code-projects.org/
CVE ID: CVE-2025-0298 State: PUBLISHED Published: 2025-01-07T16:00:08.845Z Last Updated: 2025-01-07T17:00:24.499Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Book Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Book Shop 1.0. It has been rated as critical. This issue affects some unknown processing of the file /process_login.php. The manipulation of the argument usernm leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290447 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290447 - https://vuldb.com/?ctiid.290447 - https://vuldb.com/?submit.475159 - https://gist.github.com/th4s1s/5435e605e6e9f14a5b76c313483eb58a - https://code-projects.org/
CVE ID: CVE-2025-0299 State: PUBLISHED Published: 2025-01-07T16:31:06.280Z Last Updated: 2025-01-07T18:25:16.659Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Book Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Online Book Shop 1.0. Affected is an unknown function of the file /search_result.php. The manipulation of the argument s leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290448 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290448 - https://vuldb.com/?ctiid.290448 - https://vuldb.com/?submit.475285 - https://gist.github.com/th4s1s/b30a06e83b98ddcbc69b9038c145d8cd - https://code-projects.org/
CVE ID: CVE-2025-0300 State: PUBLISHED Published: 2025-01-07T17:00:20.613Z Last Updated: 2025-01-07T17:33:49.338Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Book Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Online Book Shop 1.0. Affected by this vulnerability is an unknown functionality of the file /subcat.php. The manipulation of the argument cat leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290449 - https://vuldb
y be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290449 - https://vuldb.com/?ctiid.290449 - https://vuldb.com/?submit.475286 - https://gist.github.com/th4s1s/21abb650b4b70fe8392d8449445703f7 - https://code-projects.org/
CVE ID: CVE-2025-0301 State: PUBLISHED Published: 2025-01-07T18:00:13.626Z Last Updated: 2025-01-07T18:38:50.602Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Online Book Shop Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in code-projects Online Book Shop 1.0. Affected by this issue is some unknown functionality of the file /subcat.php. The manipulation of the argument catnm leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290450 - https://vuldb.com/?ctiid.290450 - https://vuldb.com/?submit.475287 - https://gist.github.com/th4s1s/03262c6ce877137b61d745a2e4fe8a63 - https://code-projects.org/
CVE ID: CVE-2025-0302 State: PUBLISHED Published: 2025-02-07T09:21:03.819Z Last Updated: 2025-02-12T19:41:07.414Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-190 Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through integer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-02.md
CVE ID: CVE-2025-0303 State: PUBLISHED Published: 2025-02-07T09:21:09.442Z Last Updated: 2025-02-12T19:41:07.278Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-120 Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-02.md
CVE ID: CVE-2025-0304 State: PUBLISHED Published: 2025-02-07T09:21:13.883Z Last Updated: 2025-02-12T19:41:07.045Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-02.md
CVE ID: CVE-2025-0305 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:36.855Z Description: No description available.
CVE ID: CVE-2025-0306 State: PUBLISHED Published: 2025-01-09T04:05:42.194Z Last Updated: 2025-11-06T23:18:53.953Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Storage 3 Problem Types: CWE-385 Description: A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service. Additional Analyst Notes: - CISA ADP V
signatures by exchanging a large number of messages with the vulnerable service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2025-0306 - https://bugzilla.redhat.com/show_bug.cgi?id=2336100
CVE ID: CVE-2025-0307 State: REJECTED Published: N/A Last Updated: 2025-02-07T18:00:50.552Z Description: No description available.
CVE ID: CVE-2025-0308 State: PUBLISHED Published: 2025-01-18T05:33:50.432Z Last Updated: 2025-01-21T21:40:55.235Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ultimatemember Products: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Problem Types: CWE-89 Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa
ons up to, and including, 2.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e5bb98-2652-499a-b8cd-4ebfe1c1d890?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.9.1/includes/core/class-member-directory.php#L1877
CVE ID: CVE-2025-0309 State: PUBLISHED Published: 2025-08-14T04:35:15.287Z Last Updated: 2025-08-15T12:58:27.857Z Vendors: Netskope Products: Netskope Client Description: An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.amberwolf.com/blog/2025/august/breaking-into-your-network-zer0-effort/ - https://www.netskope.com/company/security-compliance-and-assu
blog/2025/august/breaking-into-your-network-zer0-effort/ - https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-002
CVE ID: CVE-2025-0311 State: PUBLISHED Published: 2025-01-10T06:43:16.199Z Last Updated: 2025-01-10T14:51:18.915Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Orbit Fox by ThemeIsle Problem Types: CWE-79 Description: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d17a3a0-3c09-4d67-96d6-d97bde92f100?source=cve - https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/obfx_modules/elementor-extra-widgets/widgets/elementor/pricing-table.php#L1024 - https://wordpress.org/plugins/themeisle-companion/#developers - https://plugins.trac.wordpress.org/changeset/3219568/ - https://github.com/Codeinwp/themeisle-companion/commit/47a17c86934cebbfc3f1a812f1afcaa20515c1f7 - https
geset/3219568/ - https://github.com/Codeinwp/themeisle-companion/commit/47a17c86934cebbfc3f1a812f1afcaa20515c1f7 - https://github.com/Codeinwp/themeisle-companion/commit/c311050b372cf38e82d8ec9deadf4f21a8931487
CVE ID: CVE-2025-0312 State: PUBLISHED Published: 2025-03-20T10:10:53.551Z Last Updated: 2025-03-20T18:15:26.946Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ollama Products: ollama/ollama Problem Types: CWE-476 Description: A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a customized GGUF model file that, when uploaded and created on the Ollama server, can cause a crash due to an unchecked null pointer dereference. This can lead to a Denial of Service (DoS) attack via remote network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/522c87b6-a7ac-41b2-84f3-62fd58921f21
CVE ID: CVE-2025-0313 State: REJECTED Published: 2025-03-20T10:11:11.766Z Last Updated: 2025-04-15T15:56:56.567Z Description: No description available.
CVE ID: CVE-2025-0314 State: PUBLISHED Published: 2025-01-24T02:30:44.273Z Last Updated: 2025-02-12T20:41:30.754Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/512118 - https://hackerone.com/reports/2922313
CVE ID: CVE-2025-0315 State: PUBLISHED Published: 2025-03-20T10:09:48.446Z Last Updated: 2025-03-20T18:34:28.748Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ollama Products: ollama/ollama Problem Types: CWE-770 Description: A vulnerability in ollama/ollama <=0.3.14 allows a malicious user to create a customized GGUF model file, upload it to the Ollama server, and create it. This can cause the server to allocate unlimited memory, leading to a Denial of Service (DoS) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/da414d29-b55a-496f-b135-17e0fcec67bc
CVE ID: CVE-2025-0316 State: PUBLISHED Published: 2025-02-08T21:20:58.901Z Last Updated: 2025-02-12T20:51:41.842Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Chimpstudio Products: WP Directorybox Manager Problem Types: CWE-288 Description: The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. Additional Analyst Notes:
any existing user on the site, such as an administrator, if they have access to the username. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee1f412-7555-4dec-ba59-49412471a42f?source=cve - https://themeforest.net/item/directory-multipurpose-wordpress-theme/10480929
CVE ID: CVE-2025-0317 State: PUBLISHED Published: 2025-03-20T10:10:02.331Z Last Updated: 2025-03-20T14:39:00.959Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ollama Products: ollama/ollama Problem Types: CWE-369 Description: A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model file on the Ollama server. This can lead to a division by zero error in the ggufPadding function, causing the server to crash and resulting in a Denial of Service (DoS) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a9951bca-9bd8-49b2-b143-4cd4219f9fa0
CVE ID: CVE-2025-0318 State: PUBLISHED Published: 2025-01-18T05:33:49.324Z Last Updated: 2025-01-22T14:19:41.702Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ultimatemember Products: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Problem Types: CWE-200 Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.9.1 through different error messages in the responses. This makes it possible for unauthenticated attackers to exfiltr
2.9.1 through different error messages in the responses. This makes it possible for unauthenticated attackers to exfiltrate data from wp_usermeta table. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ee149bf-ffa3-4906-8be2-9c3c40b28287?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.9.1/includes/core/um-actions-form.php#L944
CVE ID: CVE-2025-0320 State: PUBLISHED Published: 2025-06-17T13:25:22.351Z Last Updated: 2025-06-18T03:56:03.093Z Vendors: Citrix Products: Secure Access Client for Windows Problem Types: CWE-269 Description: Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694724
CVE ID: CVE-2025-0321 State: PUBLISHED Published: 2025-01-28T07:21:40.701Z Last Updated: 2025-01-28T15:14:27.859Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmet Products: ElementsKit Pro Problem Types: CWE-79 Description: The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/204cfe20-9df1-4f6c-a38c-a21b43dde385?source=cve - https://wpmet.com/plugin/elementskit/ - https://wpmet.com/plugin/elementskit/roadmaps/
CVE ID: CVE-2025-0324 State: PUBLISHED Published: 2025-06-02T07:32:56.772Z Last Updated: 2025-06-02T13:26:30.431Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-791 Description: The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/04/f3/1c/cve-2025-0324pdf-en-US-483807.pdf
CVE ID: CVE-2025-0325 State: PUBLISHED Published: 2025-06-02T07:36:55.800Z Last Updated: 2025-06-02T13:25:19.277Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-1287, CWE-628 Description: A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/d0/ae/fe/cve-2025-0325pdf-en-US-483808.pdf
CVE ID: CVE-2025-0327 State: PUBLISHED Published: 2025-02-13T06:20:26.852Z Last Updated: 2025-02-13T14:56:12.017Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Process Expert, EcoStruxure Process Expert for AVEVA System Platform Problem Types: CWE-269 Description: CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing client request) that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the executable path of the windows serv
ity of engineering workstation when an attacker with standard privilege modifies the executable path of the windows services. To be exploited, services need to be restarted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-042-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-03.pdf