Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
shutter, IEC 3Ph 22kW Parent cable 7m, IEC 3Ph 22kW Parent cable 7m incl. SIM, IEC 3Ph 22kW Parent socket, IEC 3Ph 22kW Parent socket incl. SIM, IEC 3Ph 22kW Parent socket/ shutter, IEC 3Ph 22kW Parent socket/ shutter SIM, IEC ERK 3Ph 22 kW Child cable 7m, IEC ERK 3Ph 22 kW Child socket, IEC ERK 3Ph 22 kW Parent socket, IEC ERK 3Ph 22 kW Parent socket incl. SI, UL Commercial Cellular 48A NTEP, UL Commercial Child 40A w/ 15118 HW, UL Commercial Child 48A BA Compliant, UL Commercial Child 48A w/ 15118 HW, UL Commercial Parent 40A with Simcard, UL Commercial Parent 48A (USPS), UL Commercial Parent 48A BA Compliant, UL Commercial Parent 48A with Simcard BA, UL Commercial Parent 48A, 15118, 25ft
, UL Commercial Parent 48A BA Compliant, UL Commercial Parent 48A with Simcard BA, UL Commercial Parent 48A, 15118, 25ft, UL Commercial Parent 48A,15118 25ft Sim, VersiCharge Blue™ 80A AC Cellular Problem Types: CWE-1188 Description: A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions < V2.135), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2EN04-0GA0) (All versions < V2.135), IEC 1Ph 7.4kW Parent cable 7m (8EM1310-2EJ04-3GA1) (All versions < V2.135), IEC 1Ph 7.4kW Parent cable 7m incl. SIM (8EM1310-2EJ04-3GA2) (All versions < V2.135), IEC 1Ph 7.4kW Parent socket (8EM1310-2EH04-3GA1) (All versions < V2.135), IEC 1Ph 7.4kW Parent socket incl. SI
V2.135), IEC 1Ph 7.4kW Parent socket (8EM1310-2EH04-3GA1) (All versions < V2.135), IEC 1Ph 7.4kW Parent socket incl. SIM (8EM1310-2EH04-3GA2) (All versions < V2.135), IEC 1Ph 7.4kW Parent socket/ shutter (8EM1310-2EN04-3GA1) (All versions < V2.135), IEC 1Ph 7.4kW Parent socket/ shutter SIM (8EM1310-2EN04-3GA2) (All versions < V2.135), IEC 3Ph 22kW Child cable 7m (8EM1310-3EJ04-0GA0) (All versions < V2.135), IEC 3Ph 22kW Child socket (8EM1310-3EH04-0GA0) (All versions < V2.135), IEC 3Ph 22kW Child socket/ shutter (8EM1310-3EN04-0GA0) (All versions < V2.135), IEC 3Ph 22kW Parent cable 7m (8EM1310-3EJ04-3GA1) (All versions < V2.135), IEC 3Ph 22kW Parent cable 7m incl. SIM (8EM1310-3EJ04-3GA2)
rent cable 7m (8EM1310-3EJ04-3GA1) (All versions < V2.135), IEC 3Ph 22kW Parent cable 7m incl. SIM (8EM1310-3EJ04-3GA2) (All versions < V2.135), IEC 3Ph 22kW Parent socket (8EM1310-3EH04-3GA1) (All versions < V2.135), IEC 3Ph 22kW Parent socket incl. SIM (8EM1310-3EH04-3GA2) (All versions < V2.135), IEC 3Ph 22kW Parent socket/ shutter (8EM1310-3EN04-3GA1) (All versions < V2.135), IEC 3Ph 22kW Parent socket/ shutter SIM (8EM1310-3EN04-3GA2) (All versions < V2.135), IEC ERK 3Ph 22 kW Child cable 7m (8EM1310-3FJ04-0GA0) (All versions < V2.135), IEC ERK 3Ph 22 kW Child cable 7m (8EM1310-3FJ04-0GA1) (All versions < V2.135), IEC ERK 3Ph 22 kW Child cable 7m (8EM1310-3FJ04-0GA2) (All versions < V2.
(8EM1310-3FJ04-0GA1) (All versions < V2.135), IEC ERK 3Ph 22 kW Child cable 7m (8EM1310-3FJ04-0GA2) (All versions < V2.135), IEC ERK 3Ph 22 kW Child socket (8EM1310-3FH04-0GA0) (All versions < V2.135), IEC ERK 3Ph 22 kW Parent socket (8EM1310-3FH04-3GA1) (All versions < V2.135), IEC ERK 3Ph 22 kW Parent socket incl. SI (8EM1310-3FH04-3GA2) (All versions < V2.135), UL Commercial Cellular 48A NTEP (8EM1310-5HF14-1GA2) (All versions < V2.135), UL Commercial Child 40A w/ 15118 HW (8EM1310-4CF14-0GA0) (All versions < V2.135), UL Commercial Child 48A BA Compliant (8EM1315-5CG14-0GA0) (All versions < V2.135), UL Commercial Child 48A w/ 15118 HW (8EM1310-5CF14-0GA0) (All versions < V2.135), UL Comm
0GA0) (All versions < V2.135), UL Commercial Child 48A w/ 15118 HW (8EM1310-5CF14-0GA0) (All versions < V2.135), UL Commercial Parent 40A with Simcard (8EM1310-4CF14-1GA2) (All versions < V2.135), UL Commercial Parent 48A (USPS) (8EM1317-5CG14-1GA2) (All versions < V2.135), UL Commercial Parent 48A BA Compliant (8EM1315-5CG14-1GA2) (All versions < V2.135), UL Commercial Parent 48A with Simcard BA (8EM1310-5CF14-1GA2) (All versions < V2.135), UL Commercial Parent 48A, 15118, 25ft (8EM1310-5CG14-1GA1) (All versions < V2.135), UL Commercial Parent 48A, 15118, 25ft (8EM1314-5CG14-2FA2) (All versions < V2.135), UL Commercial Parent 48A, 15118, 25ft (8EM1315-5HG14-1GA2) (All versions < V2.135), UL
14-2FA2) (All versions < V2.135), UL Commercial Parent 48A, 15118, 25ft (8EM1315-5HG14-1GA2) (All versions < V2.135), UL Commercial Parent 48A,15118 25ft Sim (8EM1310-5CG14-1GA2) (All versions < V2.135), VersiCharge Blue™ 80A AC Cellular (8EM1315-7BG16-1FH2) (All versions < V2.135). Affected devices contain Modbus service enabled by default. This could allow an attacker connected to the same network to remotely control the EV charger. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-556937.html
CVE ID: CVE-2025-31931 State: PUBLISHED Published: 2025-11-11T16:50:48.208Z Last Updated: 2025-11-14T15:29:08.477Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Instrumentation and Tracing Technology API (ITT API) software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for the Instrumentation and Tracing Technology API (ITT API) software before version 3.25.4 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local
combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01337.html
CVE ID: CVE-2025-31932 State: PUBLISHED Published: 2025-04-11T09:38:50.657Z Last Updated: 2025-04-11T14:34:57.079Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: OPEN, Inc. Products: BizRobo! Problem Types: CWE-502 Description: Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is exploited, an arbitrary code is executed on the Management Console. The vendor provides the workaround information and recommends to apply it to the deployment environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://knowledge.bizrobo.com/hc/ja/articles/39951710517145 - https://knowledge.bizrobo.com/hc/ja/artic
t: References: - https://knowledge.bizrobo.com/hc/ja/articles/39951710517145 - https://knowledge.bizrobo.com/hc/ja/articles/39952052043289 - https://knowledge.bizrobo.com/hc/ja/articles/39953373809305 - https://knowledge.bizrobo.com/hc/ja/articles/360029772271 - https://jvn.jp/en/jp/JVN30641875/
CVE ID: CVE-2025-31933 State: PUBLISHED Published: 2025-04-15T20:17:05.854Z Last Updated: 2025-04-16T15:10:38.283Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attacker can check the existence of usernames in the system by querying an API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-31935 State: PUBLISHED Published: 2025-04-11T15:33:08.761Z Last Updated: 2025-04-11T16:12:37.100Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Subnet Solutions Products: PowerSYSTEM Center 2020 Problem Types: CWE-502 Description: Subnet Solutions PowerSYSTEM Center is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the API may trigger an exception, resulting in a denial-of-service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-08
CVE ID: CVE-2025-31937 State: PUBLISHED Published: 2025-11-11T16:50:49.860Z Last Updated: 2025-11-14T15:29:01.768Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) QAT Windows software Problem Types: Denial of Service, CWE-125 Description: Out-of-bounds read for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and require
tentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01373.html
CVE ID: CVE-2025-31940 State: PUBLISHED Published: 2025-11-11T16:50:51.749Z Last Updated: 2025-11-17T16:10:11.937Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Thread Director Visualizer software Problem Types: Escalation of Privilege, CWE-276 Description: Incorrect default permissions for some Intel(R) Thread Director Visualizer software before version 1.1.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requiremen
ity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01375.html
CVE ID: CVE-2025-31941 State: PUBLISHED Published: 2025-04-15T20:28:53.866Z Last Updated: 2025-04-16T15:10:22.745Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-31945 State: PUBLISHED Published: 2025-04-15T21:14:18.106Z Last Updated: 2025-04-16T15:08:40.373Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attacker can obtain other users' charger information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-31946 State: PUBLISHED Published: 2025-05-08T22:41:00.370Z Last Updated: 2025-05-09T13:33:32.858Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Pixmeo Products: OsiriX MD Problem Types: CWE-416 Description: Pixmeo OsiriX MD is vulnerable to a local use after free scenario, which could allow an attacker to locally import a crafted DICOM file and cause memory corruption or a system crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01 - https://www.osirix-viewer.com/osirix/osirix-md/ - https://www.osirix-viewer.com/about/contact/
CVE ID: CVE-2025-31947 State: PUBLISHED Published: 2025-05-15T10:41:42.104Z Last Updated: 2025-05-15T13:46:27.427Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-645 Description: Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-31948 State: PUBLISHED Published: 2025-11-11T16:50:53.424Z Last Updated: 2025-11-17T16:10:06.394Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) oneAPI Math Kernel Library Problem Types: Denial of Service, CWE-20 Description: Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal k
. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01366.html
CVE ID: CVE-2025-31949 State: PUBLISHED Published: 2025-04-15T20:19:24.914Z Last Updated: 2025-04-15T20:34:48.685Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An authenticated attacker can obtain any plant name by knowing the plant ID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-31950 State: PUBLISHED Published: 2025-04-15T21:16:16.331Z Last Updated: 2025-04-16T15:08:28.970Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attacker can obtain EV charger energy consumption information of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-31952 State: PUBLISHED Published: 2025-07-24T21:01:57.524Z Last Updated: 2025-07-25T13:34:09.699Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: HCL Software Products: iAutomate Problem Types: CWE-613 Description: HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122646
CVE ID: CVE-2025-31953 State: PUBLISHED Published: 2025-07-24T20:40:43.677Z Last Updated: 2025-07-25T01:32:44.278Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: HCL Software Products: iAutomate Problem Types: CWE-798 Description: HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122646
CVE ID: CVE-2025-31954 State: PUBLISHED Published: 2025-11-05T18:23:21.019Z Last Updated: 2025-11-05T18:46:53.781Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: iAutomate Problem Types: CWE-598 Description: HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that request. An attacker could potentially access information or resources they were not intended to see. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0
yst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0125011
CVE ID: CVE-2025-31955 State: PUBLISHED Published: 2025-07-24T20:59:34.692Z Last Updated: 2025-07-25T13:34:36.168Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: HCL Software Products: iAutomate Problem Types: CWE-200 Description: HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122646
CVE ID: CVE-2025-31961 State: PUBLISHED Published: 2025-08-15T04:29:59.295Z Last Updated: 2025-08-15T16:34:50.112Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: Connections Problem Types: CWE-1220 Description: HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123268
CVE ID: CVE-2025-31965 State: PUBLISHED Published: 2025-07-29T16:53:03.338Z Last Updated: 2025-07-29T18:32:30.900Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L) Vendors: HCL Software Products: BigFix Remote Control Problem Types: CWE-305 Description: Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122906
CVE ID: CVE-2025-31969 State: PUBLISHED Published: 2025-10-12T07:37:24.785Z Last Updated: 2025-10-14T14:06:18.566Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L) Vendors: HCL Software Products: Unica Platform Problem Types: CWE-358 Description: HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417
CVE ID: CVE-2025-31971 State: PUBLISHED Published: 2025-08-28T18:04:17.132Z Last Updated: 2025-08-28T18:21:13.424Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L) Vendors: HCL Software Products: AIML Solutions for SX Problem Types: CWE-425 Description: AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery (SSRF) attack enabling unauthorized network calls from the system, potentially exposing internal services or sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123600
CVE ID: CVE-2025-31972 State: PUBLISHED Published: 2025-08-28T16:50:07.540Z Last Updated: 2025-08-28T17:14:41.728Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: BigFix Service Management (SM) Problem Types: CWE-319 Description: HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123631
CVE ID: CVE-2025-31977 State: PUBLISHED Published: 2025-08-28T17:00:13.558Z Last Updated: 2025-08-28T17:14:21.168Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: BigFix Service Management (SM) Problem Types: CWE-311 Description: HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123631
CVE ID: CVE-2025-31979 State: PUBLISHED Published: 2025-08-28T17:06:31.151Z Last Updated: 2025-08-28T17:14:09.146Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: BigFix Service Management (SM) Problem Types: CWE-434 Description: A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or web shells, by bypassing client-side or server-side validation mechanisms. Additional Analyst Notes: - CISA ADP Vulnr
or web shells, by bypassing client-side or server-side validation mechanisms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123631
CVE ID: CVE-2025-31987 State: PUBLISHED Published: 2025-08-14T22:06:59.169Z Last Updated: 2025-08-15T12:58:03.024Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: HCL Software Products: Connections Docs Problem Types: CWE-405 Description: HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123272
CVE ID: CVE-2025-31988 State: PUBLISHED Published: 2025-08-19T18:12:07.098Z Last Updated: 2025-08-19T18:35:46.124Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: HCL Software Products: Digital Experience Problem Types: CWE-79 Description: HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123435
CVE ID: CVE-2025-31992 State: PUBLISHED Published: 2025-10-12T05:57:03.334Z Last Updated: 2025-10-15T19:51:20.037Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: MaxAI Assistant Problem Types: CWE-80 Description: HCL Unica MaxAI Assistant is susceptible to a HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the context of the user's session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124424