Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-29917 State: PUBLISHED Published: 2025-04-10T21:00:05.924Z Last Updated: 2025-04-11T16:03:53.438Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: suricata Problem Types: CWE-770 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64 keyword is not properly limited. Due to this, signatures using the keyword and setting can cause large memory allocations of up to 4 GiB per thread. This vulnerability is fixed in 7.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OISF/suricata/s
y is fixed in 7.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OISF/suricata/security/advisories/GHSA-x8c9-8553-j9px - https://github.com/OISF/suricata/commit/32d0bd2bbb4d486623dec85a94952fde2515f2f0 - https://redmine.openinfosecfoundation.org/issues/7613
CVE ID: CVE-2025-29918 State: PUBLISHED Published: 2025-04-10T21:02:32.646Z Last Updated: 2025-11-03T19:46:43.978Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: suricata Problem Types: CWE-835 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A PCRE rule can be written that leads to an infinite loop when negated PCRE is used. Packet processing thread becomes stuck in infinite loop limiting visibility and availability in inline mode. This vulnerability is fixed in 7.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - htt
ability is fixed in 7.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/OISF/suricata/security/advisories/GHSA-924c-vvm5-9mqx - https://github.com/OISF/suricata/commit/b14c67cbdf25fa6c7ffe0d04ddf3ebe67b12b50b - https://redmine.openinfosecfoundation.org/issues/7526
CVE ID: CVE-2025-29922 State: PUBLISHED Published: 2025-03-20T17:49:57.425Z Last Updated: 2025-03-20T18:16:20.624Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: kcp-dev Products: kcp Problem Types: CWE-285 Description: kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulner
e allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kcp-dev/kcp/security/advisories/GHSA-w2rr-38wv-8rrp - https://github.com/kcp-dev/kcp/pull/3338 - https://github.com/kcp-dev/kcp/commit/614ecb
advisories/GHSA-w2rr-38wv-8rrp - https://github.com/kcp-dev/kcp/pull/3338 - https://github.com/kcp-dev/kcp/commit/614ecbf35f11db00f65391ab6fbb1547ca8b5d38
CVE ID: CVE-2025-29923 State: PUBLISHED Published: 2025-03-20T18:03:14.933Z Last Updated: 2025-03-20T19:43:13.663Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: redis Products: go-redis Problem Types: CWE-20 Description: go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky conne
sues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the vulnerability by setting the flag DisableIndentity to true when constructing the client
, and 9.7.3. You can prevent the vulnerability by setting the flag DisableIndentity to true when constructing the client instance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redis/go-redis/security/advisories/GHSA-92cp-5422-2mw7 - https://github.com/redis/go-redis/pull/3295 - https://github.com/redis/go-redis/commit/d236865b0cfa1b752ea4b7da666b1fdcd0acebb6
CVE ID: CVE-2025-29924 State: PUBLISHED Published: 2025-03-19T17:31:09.666Z Last Updated: 2025-03-19T19:42:06.757Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-269 Description: XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through the REST API - but could also be through another API - when a sub wiki is using "Prevent unregistered users to view pages". The vulnerability only affects subwikis, and it only concerns specific right options such as "Prevent unregistered users to view pages". or "Prevent unregistered users to edit pages". It's possible to detect the vulnerability
gistered users to view pages". or "Prevent unregistered users to edit pages". It's possible to detect the vulnerability by enabling "Prevent unregistered users to view pages" and then trying to access a page through the REST API without using any credentials. The vulnerability has been patched in XWiki 15.10.14, 16.4.6 and 16.10.0RC1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gq32-758c-3wm3 - https://github.com/xwiki/xwiki-platform/commit/5f98bde87288326cf5787604e2bb87836875ed0e - https://jira.xwiki.org/browse/XWIKI-22640
CVE ID: CVE-2025-29925 State: PUBLISHED Published: 2025-03-19T17:36:28.066Z Last Updated: 2025-03-19T19:25:43.966Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-402 Description: XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the en
ugh only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v - https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df - https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206 - https://jira.xwiki.org/browse/XWIKI-22630 - https://jira.xwiki.org/browse/XWIKI-22639
CVE ID: CVE-2025-29926 State: PUBLISHED Published: 2025-03-19T17:40:44.937Z Last Updated: 2025-03-19T18:21:22.357Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-285 Description: XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module. Additional Analyst Notes: - CISA ADP Vulnrichm
been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43 - https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99 - https://jira.xwiki.org/browse/XWIKI-22490
CVE ID: CVE-2025-29927 State: PUBLISHED Published: 2025-03-21T14:34:49.570Z Last Updated: 2025-04-08T15:17:05.315Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: vercel Products: next.js Problem Types: CWE-285 Description: Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from rea
sible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw - https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2 - https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48 - https://github.com/vercel/next.js/releases/tag/v12.3.5 - https://github.com/vercel/next.js/releases/tag/v13.5.9
CVE ID: CVE-2025-29928 State: PUBLISHED Published: 2025-03-28T14:42:39.542Z Last Updated: 2025-03-28T15:41:39.773Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: goauthentik Products: authentik Problem Types: CWE-384 Description: authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have access to authentik. authentik 2025.2.3 and 2024.12.4 fix this issue. Switching to the cache-based session storage until
access to authentik. authentik 2025.2.3 and 2024.12.4 fix this issue. Switching to the cache-based session storage until the authentik instance can be upgraded is recommended. This will however also delete all existing sessions and users will have to re-authenticate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-p6p8-f853-9g2p - https://github.com/goauthentik/authentik/commit/71294b7deb6eb5726a782de83b957eaf25fc4cf6
CVE ID: CVE-2025-29929 State: PUBLISHED Published: 2025-03-31T15:40:58.925Z Last Updated: 2025-03-31T18:35:27.933Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Enalean Products: tuleap Problem Types: CWE-352 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742306712 and Tuleap Enterprise Edition 16.5-5 and 16.4-8. Additional Analyst Notes: - CISA
p Community Edition 16.5.99.1742306712 and Tuleap Enterprise Edition 16.5-5 and 16.4-8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-hqqr-p5f6-26vv - https://github.com/Enalean/tuleap/commit/dce61747f3a169da1f6b585ad5e6e0847fa3c950 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=dce61747f3a169da1f6b585ad5e6e0847fa3c950 - https://tuleap.net/plugins/tracker/?aid=42231
CVE ID: CVE-2025-29930 State: PUBLISHED Published: 2025-03-18T18:53:49.388Z Last Updated: 2025-03-18T19:05:45.893Z Vendors: ImpressModules Products: imfaq Problem Types: CWE-73 Description: imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET['seoOp'] parameter is manipulated to include malicious input (e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php), the application could allow an attacker to read sensitive files on the server (Local File Inclusion, LFI). The $_GET['seoOp'] and $_GET['seoArg'] parameters are directly used without sanitization or validation. This is partly mitigated by the fact that t
T['seoArg'] parameters are directly used without sanitization or validation. This is partly mitigated by the fact that the ImpressCMS sensitive files are stored outside the web root, in a folder with a randomized name. The issue has been resolved in imFaq 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ImpressModules/imfaq/security/advisories/GHSA-vrr3-54vc-vwg3 - https://github.com/ImpressModules/imfaq/commit/63dedd30a8f196db7b340740adf667a39c26a4ac
CVE ID: CVE-2025-29931 State: PUBLISHED Published: 2025-04-17T11:05:57.612Z Last Updated: 2025-04-17T14:43:50.005Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-130 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does not properly validate a length field in a serialized message which it uses to determine the amount of memory to be allocated for deserialization. This could allow an unauthenticated remote attacker to cause the application to allocate exhaustive amounts of memory and subsequently create a partial denial of se
ttacker to cause the application to allocate exhaustive amounts of memory and subsequently create a partial denial of service condition. Successful exploitation is only possible in redundant Telecontrol Server Basic setups and only if the connection between the redundant servers has been disrupted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-395348.html
CVE ID: CVE-2025-29932 State: PUBLISHED Published: 2025-03-25T12:44:20.869Z Last Updated: 2025-03-25T13:08:40.718Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: JetBrains Products: GoLand Problem Types: CWE-611 Description: In JetBrains GoLand before 2025.1 an XXE during debugging was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-29933 State: PUBLISHED Published: 2025-11-24T21:03:48.656Z Last Updated: 2025-11-24T21:17:12.832Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: AMD Products: AMD μProf Problem Types: CWE-787 Description: Improper input validation within AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a crash or denial of service Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html
CVE ID: CVE-2025-29934 State: PUBLISHED Published: 2025-11-21T18:45:16.849Z Last Updated: 2025-11-23T17:30:46.143Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: AMD Products: AMD EPYC™ 9004 Series Processors, AMD EPYC™ 9005 Series Processors, AMD EPYC™ 8004 Series Processors, AMD EPYC™ Embedded 7003 Series Processors, AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa"), AMD EPYC™ Embedded 9005 Series Processors, AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo"), AMD EPYC™ Embedded 8004 Series Processors Problem Types: CWE-459 Description: A bug within some AMD CPUs could allow a local admin-privileged attacker to r
essors Problem Types: CWE-459 Description: A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3029.html
CVE ID: CVE-2025-29953 State: PUBLISHED Published: 2025-04-18T15:23:31.658Z Last Updated: 2025-04-23T15:39:08.654Z Vendors: Apache Software Foundation Products: Apache ActiveMQ NMS OpenWire Client Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature
execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed. The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether. Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/vc1sj9y305
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/vc1sj9y3056d3kkhcvrs9fyw5w8kpmlx
CVE ID: CVE-2025-29954 State: PUBLISHED Published: 2025-05-13T16:59:04.362Z Last Updated: 2025-09-10T00:09:54.302Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Serv
7, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-400 Description: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29954
CVE ID: CVE-2025-29955 State: PUBLISHED Published: 2025-05-13T16:59:05.062Z Last Updated: 2025-09-10T00:09:38.541Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-20 Description: Improper input validation in Windows Hyper-V allows an unauthorized attacker to deny service locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29955
CVE ID: CVE-2025-29956 State: PUBLISHED Published: 2025-05-13T16:59:05.599Z Last Updated: 2025-09-10T00:09:39.102Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-126 Description: Buffer over-read in Windows SMB allows an authorized attacker to disclose information over a network. Additional An
ion: Buffer over-read in Windows SMB allows an authorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29956
CVE ID: CVE-2025-29957 State: PUBLISHED Published: 2025-05-13T16:59:06.275Z Last Updated: 2025-09-10T00:09:39.670Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-400 Description: Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service lo
ion: Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29957