Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-31120 State: PUBLISHED Published: 2025-04-18T15:52:57.791Z Last Updated: 2025-04-18T20:01:03.192Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: NamelessMC Products: Nameless Problem Types: CWE-565 Description: NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum page allows an unauthenticated attacker to artificially increase the view count. The application relies on a client-side cookie (nl-topic-[tid]) (or session variable for guests) to determine if a view should be counted. When a client does not provide the cookie, every page requ
ariable for guests) to determine if a view should be counted. When a client does not provide the cookie, every page request increments the counter, leading to incorrect view metrics. This issue has been patched in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NamelessMC/Nameless/security/advisories/GHSA-8jv7-77jw-h646 - https://github.com/NamelessMC/Nameless/commit/9b112c0beab346a38b6f5a51e7773b38c6fc52e7 - https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0
CVE ID: CVE-2025-31121 State: PUBLISHED Published: 2025-04-01T14:53:03.469Z Last Updated: 2025-04-01T16:13:34.453Z Vendors: openemr Products: openemr Problem Types: CWE-79 Description: OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR is vulnerable to cross-site scripting attacks via the EXIF title in an image. This vulnerability is fixed in 7.0.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openemr/openemr/security/advisories/GHSA-2w94-qmj6-3qxx
CVE ID: CVE-2025-31122 State: PUBLISHED Published: 2025-03-31T16:58:19.115Z Last Updated: 2025-03-31T18:24:55.778Z Vendors: Scratch-Coding-Hut Products: Scratch-Coding-Hut Problem Types: CWE-287, CWE-290 Description: scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the username in the username field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut/security/advisories/GHSA-mmg3-567w-v9j2 - https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/issues/56
CVE ID: CVE-2025-31123 State: PUBLISHED Published: 2025-03-31T19:31:40.507Z Last Updated: 2025-03-31T22:38:38.383Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-324 Description: Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to obtain valid access tokens. This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspe
This vulnerability does not affect the use of JWT Profile for OAuth 2.0 Client Authentication on the Token and Introspection endpoints, which correctly reject expired keys. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-h3q7-347g-qwhf - https://github.com/zitadel/zitadel/commit/315503beabd679f2e6aec0c004f0f9d2f5b53ed3 - https://github.com/zitadel/zitadel/releases/tag/v2.63.9 - https://github.com/zitadel/zitadel/releases/tag/v2.64.6 - https://github.com/zitadel/zitadel/releases/tag/v2.65.7 - https://github.c
ub.com/zitadel/zitadel/releases/tag/v2.64.6 - https://github.com/zitadel/zitadel/releases/tag/v2.65.7 - https://github.com/zitadel/zitadel/releases/tag/v2.66.16 - https://github.com/zitadel/zitadel/releases/tag/v2.67.13 - https://github.com/zitadel/zitadel/releases/tag/v2.68.9 - https://github.com/zitadel/zitadel/releases/tag/v2.69.9 - https://github.com/zitadel/zitadel/releases/tag/v2.70.8 - https://github.com/zitadel/zitadel/releases/tag/v2.71.6
CVE ID: CVE-2025-31124 State: PUBLISHED Published: 2025-03-31T19:38:12.235Z Last Updated: 2025-03-31T22:26:39.989Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-203, CWE-204, CWE-200 Description: Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. If enabled, ZITADEL will show the password prompt even if the user doesn't exist and report "Username or Password invalid". While the setting was correctly respected during the login flow, the user's username was norma
ame or Password invalid". While the setting was correctly respected during the login flow, the user's username was normalized leading to a disclosure of the user's existence. This vulnerability is fixed in 2.71.6, 2.70.8, 2.69.9, 2.68.9, 2.67.13, 2.66.16, 2.65.7, 2.64.6, and 2.63.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-67m4-8g4w-633q - https://github.com/zitadel/zitadel/commit/14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c - https://github.com/zitadel/zitadel/releases/tag/v2.63.9 - https://github.com/zitadel/zitadel/releases/tag/v2.64.6 - https://github.com/zitadel/zitadel/releases/tag/v2.65.7 - https://github.
hub.com/zitadel/zitadel/releases/tag/v2.64.6 - https://github.com/zitadel/zitadel/releases/tag/v2.65.7 - https://github.com/zitadel/zitadel/releases/tag/v2.66.16 - https://github.com/zitadel/zitadel/releases/tag/v2.67.13 - https://github.com/zitadel/zitadel/releases/tag/v2.68.9 - https://github.com/zitadel/zitadel/releases/tag/v2.69.9 - https://github.com/zitadel/zitadel/releases/tag/v2.70.8 - https://github.com/zitadel/zitadel/releases/tag/v2.71.6
CVE ID: CVE-2025-31125 State: PUBLISHED Published: 2025-03-31T17:06:30.704Z Last Updated: 2025-03-31T17:59:26.675Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: vitejs Products: vite Problem Types: CWE-200, CWE-284 Description: Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vitejs/vite/security/adv
and 4.5.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8 - https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949
CVE ID: CVE-2025-31126 State: PUBLISHED Published: 2025-04-03T17:54:27.901Z Last Updated: 2025-04-07T18:24:07.364Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: element-hq Products: element-x-ios Problem Types: CWE-200 Description: Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/element-x-ios/secur
03.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/element-x-ios/security/advisories/GHSA-69qf-p24v-rf8j - https://github.com/element-hq/element-meta/issues/2441
CVE ID: CVE-2025-31127 State: PUBLISHED Published: 2025-04-03T17:54:22.695Z Last Updated: 2025-04-07T18:24:45.777Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: element-hq Products: element-x-android Problem Types: CWE-200 Description: Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq
lity is fixed in 25.03.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/element-x-android/security/advisories/GHSA-x2g5-f28j-p7w6 - https://github.com/element-hq/element-meta/issues/2441
CVE ID: CVE-2025-31128 State: PUBLISHED Published: 2025-03-31T18:47:32.369Z Last Updated: 2025-06-12T21:03:34.814Z Vendors: rubentd Products: gifplayer Problem Types: CWE-79 Description: gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS) vulnerability. This vulnerability is fixed in 0.3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rubentd/gifplayer/security/advisories/GHSA-gr7w-hmch-25g7 - https://github.com/rubentd/gifplayer/commit/2966193d4d066e5a6ba09dbdf1e1c7f8238630c8
CVE ID: CVE-2025-31129 State: PUBLISHED Published: 2025-03-31T19:10:57.599Z Last Updated: 2025-04-01T13:53:56.983Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: jooby-project Products: jooby Problem Types: CWE-502 Description: Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jooby-project/jooby/security/advisories/GHSA-7c5v-895v-w4q5 - https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692 - https:
es/GHSA-7c5v-895v-w4q5 - https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692 - https://github.com/jooby-project/jooby/blob/v2.x/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L39-L45 - https://github.com/jooby-project/jooby/blob/v3.6.1/modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java#L77-L84
CVE ID: CVE-2025-31130 State: PUBLISHED Published: 2025-04-04T14:41:56.355Z Last Updated: 2025-04-04T14:51:51.207Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: GitoxideLabs Products: gitoxide Problem Types: CWE-328 Description: gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrit
acks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6 - https://github.com/GitoxideLabs/gitoxide/commit/4660f7a6f71873311f68f170b0f1f6659a02829d
CVE ID: CVE-2025-31131 State: PUBLISHED Published: 2025-04-01T14:56:45.222Z Last Updated: 2025-04-01T16:11:20.111Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: YesWiki Products: yeswiki Problem Types: CWE-22 Description: YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w34w-fvp3-68xm - https://github.com/YesWiki/yeswiki/commit/f78c915369a60c74ab8f38561ae93a4aaca9b989
CVE ID: CVE-2025-31132 State: PUBLISHED Published: 2025-04-01T15:06:36.426Z Last Updated: 2025-04-01T15:46:48.578Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: The-Commit-Company Products: raven Problem Types: CWE-20 Description: Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerability is fixed in 2.1.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/The-Commit-Company/raven/security/advisories/GHSA-wmrr-3mrv-2p57
CVE ID: CVE-2025-31133 State: PUBLISHED Published: 2025-11-06T18:47:47.335Z Last Updated: 2025-11-06T19:22:22.047Z Vendors: opencontainers Products: runc Problem Types: CWE-61, CWE-363 Description: runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service,
xposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2 - https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522 - https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66 - https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f - https://github.com/opencontainers/runc/commit/db19bbed53
ntainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f - https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
CVE ID: CVE-2025-31134 State: PUBLISHED Published: 2025-06-04T19:35:55.749Z Last Updated: 2025-06-04T20:07:03.452Z Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-201 Description: FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server and potentially use that information to further attack the server. Version 1.26.2 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS
tch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jjm2-4hf7-9x65 - https://github.com/FreshRSS/FreshRSS/commit/4568111c00813756a3a34a381d684b8354fc4438
CVE ID: CVE-2025-31135 State: PUBLISHED Published: 2025-04-01T22:03:09.405Z Last Updated: 2025-04-02T13:48:00.609Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: phires Products: go-guerrilla Problem Types: CWE-20 Description: Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is considered part of the exchange between client and server, so the client is free to send further PROXY commands with whatever data it pleases. go-g
ange between client and server, so the client is free to send further PROXY commands with whatever data it pleases. go-guerrilla will treat these as coming from the reverse proxy, allowing a client to spoof its IP address. This vulnerability is fixed in 1.6.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c - https://github.com/phires/go-guerrilla/commit/7673947f2d5204a135d7ae0b7f80759e548abee6
CVE ID: CVE-2025-31136 State: PUBLISHED Published: 2025-06-04T19:42:15.077Z Last Updated: 2025-06-04T20:18:02.553Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-79 Description: FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting (XSS) issue that occurs in `f.php` when SVG favicons are downloaded from an attacker-controlled feed containing `<script>` tags inside of them that aren't sanitized, with the lack of CSP in `f.php` by embedding the malicious favicon in an iframe (that has `sa
hem that aren't sanitized, with the lack of CSP in `f.php` by embedding the malicious favicon in an iframe (that has `sandbox="allow-scripts allow-same-origin"` set as its attribute). An attacker needs to control one of the feeds that the victim is subscribed to, and also must have an account on the FreshRSS instance. Other than that, the iframe payload can be embedded as one of two options. The first payload requires user interaction (the user clicking on the malicious feed entry) with default user configuration, and the second payload fires instantly right after the user adds the feed or logs into the account while the feed entry is still visible. This is because of lazy image loading func
adds the feed or logs into the account while the feed entry is still visible. This is because of lazy image loading functionality, which the second payload bypasses. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible to delete all users (cause damage) or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS. Version 1.26.2 has a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-f6r4-jrvc-cfmr - https://github.com/FreshRSS/FreshRSS/commit/426e3054c237c2b98667ebeacbbdb5caa88e7b1f
CVE ID: CVE-2025-31137 State: PUBLISHED Published: 2025-04-01T18:20:32.660Z Last Updated: 2025-04-02T15:11:11.594Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: remix-run Products: react-router Problem Types: CWE-444 Description: React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/Reac
tting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/remix-run/react-router/security/advisories/GHSA-4q56-crqp-v477
CVE ID: CVE-2025-31138 State: PUBLISHED Published: 2025-04-07T14:44:40.370Z Last Updated: 2025-04-07T15:49:04.639Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: AmauriC Products: tarteaucitron.js Problem Types: CWE-1021 Description: tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clic
ugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3 - https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07
CVE ID: CVE-2025-31139 State: PUBLISHED Published: 2025-03-27T11:24:30.733Z Last Updated: 2025-03-27T13:20:29.029Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-532 Description: In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-31140 State: PUBLISHED Published: 2025-03-27T11:24:31.181Z Last Updated: 2025-03-27T13:16:49.211Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-31141 State: PUBLISHED Published: 2025-03-27T11:24:31.688Z Last Updated: 2025-03-27T13:14:14.931Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-209 Description: In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-31144 State: PUBLISHED Published: 2025-04-27T23:57:01.057Z Last Updated: 2025-04-28T14:57:21.467Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: SIOS Technology, Inc. Products: Quick Agent V3, Quick Agent V2 Problem Types: CWE-923 Description: Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpoints. If exploited, a remote unauthenticated attacker may attempt to log in to an arbitrary host via Windows system where the product is running. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mfp-support.sios.jp/hc/ja/articles/45853460006937 - https://siosap
Notes: - CISA ADP Vulnrichment: References: - https://mfp-support.sios.jp/hc/ja/articles/45853460006937 - https://siosapps.sios.jp/agent_info/20250425001.html - https://jvn.jp/en/jp/JVN82536398/
CVE ID: CVE-2025-31146 State: PUBLISHED Published: 2025-11-11T16:50:42.715Z Last Updated: 2025-11-12T20:00:16.772Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel Ethernet Adapter Complete Driver Pack software Problem Types: Denial of Service, CWE-367 Description: Time-of-check time-of-use race condition for some Intel Ethernet Adapter Complete Driver Pack software before version 1.5.1.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attac