Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1387 State: PUBLISHED Published: 2025-02-17T03:40:45.783Z Last Updated: 2025-02-18T15:52:30.937Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Learning Digital Products: Orca HCM Problem Types: CWE-1390 Description: Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8427-daea8-1.html - https://www.twcert.org.tw/en/cp-139-8428-59a9a-2.html
CVE ID: CVE-2025-1388 State: PUBLISHED Published: 2025-02-17T03:59:13.674Z Last Updated: 2025-02-18T15:51:46.400Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Learning Digital Products: Orca HCM Problem Types: CWE-434 Description: Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8429-07d7e-1.html - https://www.twcert.org.tw/en/cp-139-8430-32513-2.html
CVE ID: CVE-2025-1389 State: PUBLISHED Published: 2025-02-17T04:15:08.540Z Last Updated: 2025-02-18T15:32:37.068Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Learning Digital Products: Orca HCM Problem Types: CWE-89 Description: Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/en/cp-139-8432-4b516-2.html - https://www.twcert.org.tw/tw/cp-132-8431-61e42-1.html
CVE ID: CVE-2025-1390 State: PUBLISHED Published: 2025-02-18T02:34:44.846Z Last Updated: 2025-02-18T19:28:35.503Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: OpenAnolis Products: Anolis OS Problem Types: CWE-284 Description: The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf
kers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.openanolis.cn/show_bug.cgi?id=18804
CVE ID: CVE-2025-1391 State: PUBLISHED Published: 2025-02-17T14:01:35.354Z Last Updated: 2025-11-20T19:58:25.739Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 26.0 Problem Types: CWE-284 Description: A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization t
f an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:2544 - https://access.redhat.com/errata/RHSA-2025:2545 - https://access.redhat.com/security/cve/CVE-2025-1391 - https://bugzilla.redhat.com/show_bug.cgi?id=2346082
CVE ID: CVE-2025-1392 State: PUBLISHED Published: 2025-02-17T15:31:04.473Z Last Updated: 2025-02-18T15:43:27.491Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: D-Link Products: DIR-816 Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/webproc?getpage=html/index.html&var:menu=24gwlan&var:page=24G_basic. The manipulation of the argument SSID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no lo
y. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.296023 - https://vuldb.com/?ctiid.296023 - https://vuldb.com/?submit.501351 - https://www.dlink.com/
CVE ID: CVE-2025-1393 State: PUBLISHED Published: 2025-03-05T08:03:09.239Z Last Updated: 2025-03-05T14:29:03.639Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Weidmueller Products: PROCON-WIN Problem Types: CWE-798 Description: An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-021
CVE ID: CVE-2025-1394 State: PUBLISHED Published: 2025-07-30T08:11:28.403Z Last Updated: 2025-08-08T04:07:18.857Z Vendors: silabs.com Products: Zigbee Stack Problem Types: CWE-252 Description: Failure to handle the error status returned by the buffer management APIs in SiLabs EmberZNet Zigbee stack may result in data leaks or potential Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.silabs.com/documents/public/release-notes/emberznet-release-notes-7.5.0.0.pdf - https://www.silabs.com/documents/public/release-notes/emberznet-release-notes-8.0.3.0.pdf - https://www.silabs.com/documents/public/release-notes/emberznet-release-notes-8.1.0.0.pd
net-release-notes-8.0.3.0.pdf - https://www.silabs.com/documents/public/release-notes/emberznet-release-notes-8.1.0.0.pdf - https://community.silabs.com/068Vm00000SkHNX
CVE ID: CVE-2025-1396 State: PUBLISHED Published: 2025-09-26T07:52:52.297Z Last Updated: 2025-09-30T15:43:31.106Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WSO2 Products: WSO2 Identity Server, WSO2 Open Banking IAM, WSO2 Identity Server as Key Manager Problem Types: CWE-203 Description: A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discre
tting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discrepancies in the application's responses. Exploitation of this vulnerability could aid in brute-force attacks, targeted phishing campaigns, or other social engineering techniques by confirming the validity of user identifiers within the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3983/
CVE ID: CVE-2025-1398 State: PUBLISHED Published: 2025-03-17T14:19:51.718Z Last Updated: 2025-03-31T15:38:58.774Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-426 Description: Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-1399 State: PUBLISHED Published: 2025-05-07T07:04:10.708Z Last Updated: 2025-05-07T14:02:39.411Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: libplctag Products: libplctag Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in unpack_response (session.c) in libplctag from 2.0 through 2.6.3 allows Overread Buffers via network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1399
CVE ID: CVE-2025-1400 State: PUBLISHED Published: 2025-05-07T07:04:29.943Z Last Updated: 2025-05-07T14:02:31.645Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: libplctag Products: libplctag Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in unpack_response (conn.c) in libplctag from 2.0 through 2.6.3 allows Overread Buffers via network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1400
CVE ID: CVE-2025-1401 State: PUBLISHED Published: 2025-03-13T06:00:06.682Z Last Updated: 2025-03-14T16:09:48.349Z Vendors: Unknown Products: WP Click Info Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Click Info WordPress plugin through 2.7.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/072620a2-76db-49d2-aae5-1170c409f7e7/
CVE ID: CVE-2025-1402 State: PUBLISHED Published: 2025-02-21T11:09:34.845Z Last Updated: 2025-02-21T13:23:37.997Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: theeventscalendar Products: Event Tickets and Registration Problem Types: CWE-862 Description: The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary Attendee tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
vel access and above, to delete arbitrary Attendee tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd838b6-7792-4378-8969-a70c6e16ff6a?source=cve - https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.18.1/src/Tribe/Assets.php#L202 - https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.18.1/src/Tribe/Metabox.php#L30 - https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.18.1/src/Tribe/Metabox.php#L490 - https://wordfence.freshdesk.com/a/tickets/375051
CVE ID: CVE-2025-1403 State: PUBLISHED Published: 2025-02-21T16:55:03.802Z Last Updated: 2025-08-26T19:48:05.242Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: IBM Products: Qiskit SDK Problem Types: CWE-502 Description: Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183868
CVE ID: CVE-2025-1404 State: PUBLISHED Published: 2025-03-01T11:22:48.111Z Last Updated: 2025-03-03T20:56:03.895Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ays-pro Products: Secure Copy Content Protection and Content Locking Problem Types: CWE-862 Description: The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_sccp_reports_user_search() function in all versions up to, and including, 4.4.7. This makes it possible for unauthenticated attackers to retrieve a list of registered user emails. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
henticated attackers to retrieve a list of registered user emails. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7363b5de-db30-4b35-b701-5c8f2835ec6c?source=cve - https://wordpress.org/plugins/secure-copy-content-protection/#developers - https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.4.6/admin/class-secure-copy-content-protection-admin.php#L943 - https://plugins.trac.wordpress.org/browser/secure-copy-content-protection/tags/4.4.6/admin/js/secure-copy-content-protection-admin.js - https://plugins.trac.wordpress.org/changeset/3246301
CVE ID: CVE-2025-1405 State: PUBLISHED Published: 2025-02-28T07:03:46.974Z Last Updated: 2025-02-28T14:51:37.854Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: implecode Products: Product Catalog Simple Problem Types: CWE-79 Description: The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_products shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wheneve
d attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2ddd9a2-79d7-4f9c-9832-25c3363d3ce9?source=cve - https://wordpress.org/plugins/post-type-x/#developers - https://plugins.trac.wordpress.org/changeset/3246414/
CVE ID: CVE-2025-1406 State: PUBLISHED Published: 2025-02-21T03:21:22.296Z Last Updated: 2025-02-21T14:44:06.692Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: s56bouya Products: Newpost Catch Problem Types: CWE-79 Description: The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, and including, 1.3.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dbbea6bf-b795-4837-9dc9-7cb8769ab89f?source=cve - https://wordpress.org/plugins/newpost-catch/#developers
CVE ID: CVE-2025-1407 State: PUBLISHED Published: 2025-02-21T03:21:21.909Z Last Updated: 2025-02-21T14:46:43.865Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: amothemo Products: AMO Team Showcase Problem Types: CWE-79 Description: The AMO Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's amoteam_skills shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0950d3-4d7b-457a-8e67-df310d2712d4?source=cve - https://wordpress.org/plugins/amo-team-showcase/#developers
CVE ID: CVE-2025-1408 State: PUBLISHED Published: 2025-03-22T04:22:05.850Z Last Updated: 2025-03-24T15:14:06.836Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: metagauss Products: ProfileGrid – User Profiles, Groups and Communities Problem Types: CWE-862 Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and pm_approve_join_group_request functions in all versions up to, and including, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or
ing, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or decline join group requests which is normally should be available to administrators only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/641f7727-83ba-45c2-b3e1-1ce19f86eac7?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.3/public/class-profile-magic-public.php#L3306 - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.3/public/class-profile-magic-public.php#L3262
CVE ID: CVE-2025-1410 State: PUBLISHED Published: 2025-02-21T08:21:36.853Z Last Updated: 2025-02-21T15:27:23.129Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: apexws Products: Events Calendar Made Simple – Pie Calendar Problem Types: CWE-79 Description: The Events Calendar Made Simple – Pie Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's piecal shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa
it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fcaea2fb-ebf8-49b4-8cd5-0d9208252a90?source=cve - https://wordpress.org/plugins/pie-calendar/#developers - https://plugins.trac.wordpress.org/changeset/3243992/
CVE ID: CVE-2025-1411 State: PUBLISHED Published: 2025-06-15T12:34:16.870Z Last Updated: 2025-08-24T11:52:49.684Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Directory Problem Types: CWE-250 Description: IBM Security Verify Directory Container 10.0.0.0 through 10.0.3.1 could allow a local user to execute commands as root due to execution with unnecessary privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7236658
CVE ID: CVE-2025-1412 State: PUBLISHED Published: 2025-02-24T07:24:47.043Z Last Updated: 2025-02-24T11:23:35.862Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-384 Description: Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-1413 State: PUBLISHED Published: 2025-02-28T08:25:24.641Z Last Updated: 2025-10-03T09:05:06.426Z Vendors: Blackmagic Design Inc Products: DaVinci Resolve Problem Types: CWE-732 Description: DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
affects DaVinci Resolve on MacOS in versions before 19.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/02/CVE-2025-1413/ - https://cert.pl/posts/2025/02/CVE-2025-1413/ - https://apps.apple.com/pl/app/davinci-resolve/id571213070?mt=12
CVE ID: CVE-2025-1414 State: PUBLISHED Published: 2025-02-18T13:39:33.402Z Last Updated: 2025-02-18T20:48:48.218Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 135.0.1 Description: Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1943179 - https://www.mozilla.org/security/advisories/mfsa2025-12/
CVE ID: CVE-2025-1415 State: PUBLISHED Published: 2025-05-21T10:38:05.794Z Last Updated: 2025-05-21T13:31:57.667Z Vendors: Proget Products: Proget Problem Types: CWE-863 Description: A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of the devices like their UUIDs needed for exploitation of CVE-2025-1416. In order to perform the attack, one has to know a task_id, but since it's a low integer and there is no limit of requests an attacker can perform to a vulnerable endpoint, the task_id might be simply brute forced. This issue has been fixed in 2.17.5 version of Konsola Proget (server par
int, the task_id might be simply brute forced. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https://proget.pl/en/mobile-device-management/
CVE ID: CVE-2025-1416 State: PUBLISHED Published: 2025-05-21T13:03:07.286Z Last Updated: 2025-05-21T13:31:23.727Z Vendors: Proget Products: Proget Problem Types: CWE-863 Description: In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Management). For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-1417. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https:/
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/05/CVE-2025-1415 - https://proget.pl/en/mobile-device-management/
CVE ID: CVE-2025-1417 State: PUBLISHED Published: 2025-05-21T13:03:35.249Z Last Updated: 2025-05-21T13:30:21.030Z Vendors: Proget Products: Proget Problem Types: CWE-863 Description: In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). This information include user ids, email addresses, first names, last names and device UUIDs. The last one can be used for exploitation of CVE-2025-1416. Successful exploitation requires UUID of a targeted backup, which cannot be brute forced. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite). Additional Analyst Not