Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310769 - https://vuldb.com/?ctiid.310769 - https://vuldb.com/?submit.584324 - https://github.com/DefaultCh40s/RE016/blob/main/re016.py
CVE ID: CVE-2025-5437 State: PUBLISHED Published: 2025-06-02T08:31:04.779Z Last Updated: 2025-06-02T17:00:54.274Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Multilaser Products: Sirius RE016 Problem Types: CWE-287 Description: A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any
disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310770 - https://vuldb.com/?ctiid.310770 - https://vuldb.com/?submit.584325 - https://github.com/DefaultCh40s/RE016/blob/main/re016.py
CVE ID: CVE-2025-5438 State: PUBLISHED Published: 2025-06-02T09:00:19.465Z Last Updated: 2025-06-02T12:35:17.377Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. Affected by this vulnerability is the function WPS of the file /goform/WPS. The manipulation of the argument PIN leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310777 - https://vuldb.com/?ctiid.310777 - https://vuldb.com/?submit.584360 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_1/1.md - https://www.linksys.com/
CVE ID: CVE-2025-5439 State: PUBLISHED Published: 2025-06-02T09:31:05.517Z Last Updated: 2025-06-02T12:33:27.682Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been rated as critical. Affected by this issue is the function verifyFacebookLike of the file /goform/verifyFacebookLike. The manipulation of the argument uid/accessToken leads to os command injection. The attack may be launched remotely. The exploit has been disclo
argument uid/accessToken leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310778 - https://vuldb.com/?ctiid.310778 - https://vuldb.com/?submit.584361 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_2/2.md - https://www.linksys.com/
CVE ID: CVE-2025-5440 State: PUBLISHED Published: 2025-06-02T10:00:18.531Z Last Updated: 2025-06-02T12:20:59.678Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function NTP of the file /goform/NTP. The manipulation of the argument manual_year_select/manual_month_select/manual_day_select/manual_hour_select/manual_min_select/manual_sec_select leads to os command injection. It is possible
t/manual_day_select/manual_hour_select/manual_min_select/manual_sec_select leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310779 - https://vuldb.com/?ctiid.310779 - https://vuldb.com/?submit.584362 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_3/3.md - https://www.linksys.com/
CVE ID: CVE-2025-5441 State: PUBLISHED Published: 2025-06-02T10:31:04.552Z Last Updated: 2025-06-02T12:10:19.108Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function setDeviceURL of the file /goform/setDeviceURL. The manipulation of the argument DeviceURL leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and ma
leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310780 - https://vuldb.com/?ctiid.310780 - https://vuldb.com/?submit.584363 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_4/4.md - https://www.linksys.com/
CVE ID: CVE-2025-5442 State: PUBLISHED Published: 2025-06-02T11:00:18.937Z Last Updated: 2025-06-02T16:59:31.782Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RP_pingGatewayByBBS of the file /goform/RP_pingGatewayByBBS. The manipulation of the argument ip/nm/gw leads to os command injection. The attack may be initiated remotely. The exploit has been disclose
the argument ip/nm/gw leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310781 - https://vuldb.com/?ctiid.310781 - https://vuldb.com/?submit.584364 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_5/5.md - https://www.linksys.com/
CVE ID: CVE-2025-5443 State: PUBLISHED Published: 2025-06-02T11:31:04.438Z Last Updated: 2025-06-02T16:29:14.101Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function wirelessAdvancedHidden of the file /goform/wirelessAdvancedHidden. The manipulation of the argument ExtChSelector/24GSelector/5GSelector leads to os command injection. It is possible to launch the attack remotely.
gument ExtChSelector/24GSelector/5GSelector leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310782 - https://vuldb.com/?ctiid.310782 - https://vuldb.com/?submit.584365 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_6/6.md - https://www.linksys.com/
CVE ID: CVE-2025-5444 State: PUBLISHED Published: 2025-06-02T12:00:17.752Z Last Updated: 2025-06-02T16:28:16.426Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified as critical. Affected by this vulnerability is the function RP_UpgradeFWByBBS of the file /goform/RP_UpgradeFWByBBS. The manipulation of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to os command injection. The attack can be launch
of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310783 - https://vuldb.com/?ctiid.310783 - https://vuldb.com/?submit.584366 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_7/7.md - https://www.linksys.com/
CVE ID: CVE-2025-5445 State: PUBLISHED Published: 2025-06-02T12:31:04.618Z Last Updated: 2025-06-02T16:22:15.559Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified as critical. Affected by this issue is the function RP_checkFWByBBS of the file /goform/RP_checkFWByBBS. The manipulation of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to os command injection. The attack may be launched remotely. The
ype/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310784 - https://vuldb.com/?ctiid.310784 - https://vuldb.com/?submit.584367 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_8/8.md - https://www.linksys.com/
CVE ID: CVE-2025-5446 State: PUBLISHED Published: 2025-06-02T13:00:17.423Z Last Updated: 2025-06-02T13:40:07.771Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been classified as critical. This affects the function RP_checkCredentialsByBBS of the file /goform/RP_checkCredentialsByBBS. The manipulation of the argument pwd leads to os command injection. It is possible to initiate the attack remotely. The exploit has been dis
the argument pwd leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310785 - https://vuldb.com/?ctiid.310785 - https://vuldb.com/?submit.584368 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_9/9.md - https://www.linksys.com/
CVE ID: CVE-2025-5447 State: PUBLISHED Published: 2025-06-02T13:31:04.197Z Last Updated: 2025-06-02T13:54:42.963Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Linksys Products: RE6500, RE6250, RE6300, RE6350, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter. The manipulation of the argument apselect_%d/newap_text_%d leads to os command injection. The attack can be initiated remotely. The exploit has been
ment apselect_%d/newap_text_%d leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310786 - https://vuldb.com/?ctiid.310786 - https://vuldb.com/?submit.584369 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_10/10.md - https://www.linksys.com/
CVE ID: CVE-2025-5449 State: PUBLISHED Published: 2025-07-25T17:19:39.345Z Last Updated: 2025-11-20T21:12:41.249Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-190 Description: A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes th
overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-5449 - https://bugzilla.redhat.com/show_bug.cgi?id=2369705 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=261612179f740bc62ba363d98b3bd5e5573a811f - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=3443aec90188d6aab9282afc80a81df5ab72c4da - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=5504ff40515439a5fecbb17da7483000c4d12eb7 - https://git.
ps://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=5504ff40515439a5fecbb17da7483000c4d12eb7 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=78485f446af9b30e37eb8f177b81940710d54496 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=f79ec51b7fd519dbc5737a7ba826e3ed093f6ceb - https://www.libssh.org/security/advisories/CVE-2025-5449.txt
CVE ID: CVE-2025-5450 State: PUBLISHED Published: 2025-07-08T15:00:02.314Z Last Updated: 2025-07-08T20:42:58.412Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-602 Description: Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated admin with read-only rights to modify settings that should be restricted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivant
P Vulnrichment: References: - https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE ID: CVE-2025-5451 State: PUBLISHED Published: 2025-07-08T15:02:00.522Z Last Updated: 2025-07-08T20:43:37.606Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-121 Description: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to trigger a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE ID: CVE-2025-5452 State: PUBLISHED Published: 2025-11-11T07:00:46.077Z Last Updated: 2025-11-12T04:57:45.909Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-214 Description: A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. Additional A
nsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/39/ba/8b/cve-2025-5452pdf-en-US-504212.pdf
CVE ID: CVE-2025-5454 State: PUBLISHED Published: 2025-11-11T06:50:19.130Z Last Updated: 2025-11-12T04:57:43.508Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-35 Description: An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
the victim to install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/48/ab/82/cve-2025-5454pdf-en-US-504213.pdf
CVE ID: CVE-2025-5455 State: PUBLISHED Published: 2025-06-02T08:46:20.524Z Last Updated: 2025-06-02T12:42:34.203Z Vendors: The Qt Company Products: Qt Problem Types: CWE-20 Description: An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed
n a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codereview.qt-project.org/c/qt/qtbase/+/642006
CVE ID: CVE-2025-5456 State: PUBLISHED Published: 2025-08-12T14:50:46.329Z Last Updated: 2025-08-12T15:05:53.651Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure, ZTA Gateway, Neurons for Secure Problem Types: CWE-125 Description: A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. CWE-125 Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
cated attacker to trigger a denial of service. CWE-125 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US
CVE ID: CVE-2025-5459 State: PUBLISHED Published: 2025-06-26T06:30:56.546Z Last Updated: 2025-07-03T09:25:04.719Z Vendors: Perforce Products: Puppet Enterprise Problem Types: CWE-78 Description: A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.perforce.com/s/detail/a91PA000001SiDdYAK
CVE ID: CVE-2025-5462 State: PUBLISHED Published: 2025-08-12T14:56:19.798Z Last Updated: 2025-08-12T15:08:46.265Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure, ZTA Gateway, Neurons for Secure Access Problem Types: CWE-122 Description: A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
enticated attacker to trigger a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US
CVE ID: CVE-2025-5463 State: PUBLISHED Published: 2025-07-08T15:02:38.657Z Last Updated: 2025-07-08T20:39:29.302Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Connect Secure, Policy Secure Problem Types: CWE-532 Description: Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated attacker to obtain that information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE ID: CVE-2025-5464 State: PUBLISHED Published: 2025-07-08T15:32:32.212Z Last Updated: 2025-07-08T15:57:58.608Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Ivanti Products: Connect Secure Problem Types: CWE-532 Description: Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE ID: CVE-2025-5466 State: PUBLISHED Published: 2025-08-12T15:00:05.978Z Last Updated: 2025-08-12T19:00:58.665Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure, ZTA Gateway, Neurons for Secure Access Problem Types: CWE-776 Description: XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
dmin privileges to trigger a denial of service Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US