Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ata Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain a Path Traversal: '.../...//' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE ID: CVE-2025-43908 State: PUBLISHED Published: 2025-10-07T18:22:27.493Z Last Updated: 2025-10-08T03:55:21.852Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 Problem Types: CWE-78 Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 relea
ata Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulner
ww.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE ID: CVE-2025-43909 State: PUBLISHED Published: 2025-10-07T19:11:18.767Z Last Updated: 2025-10-07T19:27:32.584Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 Problem Types: CWE-327 Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release
a Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Use of a Broken or Risky Cryptographic Algorithm vulnerability in the DD boost. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE ID: CVE-2025-43910 State: PUBLISHED Published: 2025-10-07T19:16:21.656Z Last Updated: 2025-10-07T19:40:39.287Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 Problem Types: CWE-121 Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release
a Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain a Stack-based Buffer Overflow vulnerability in the DDSH CLI. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE ID: CVE-2025-43911 State: PUBLISHED Published: 2025-10-07T18:08:29.640Z Last Updated: 2025-10-08T03:55:20.756Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release, Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025, Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024, Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 Problem Types: CWE-78 Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-sec
nalyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE ID: CVE-2025-43912 State: PUBLISHED Published: 2025-10-07T18:48:57.243Z Last Updated: 2025-10-07T19:25:28.110Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 Problem Types: CWE-122 Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 rele
Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE ID: CVE-2025-43913 State: PUBLISHED Published: 2025-10-07T18:54:46.731Z Last Updated: 2025-10-07T19:10:52.390Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Dell Products: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 Problem Types: CWE-327 Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 rele
Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Use of a Broken or Risky Cryptographic Algorithm vulnerability in the DDOS. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information disclosure. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/00
nformation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE ID: CVE-2025-43914 State: PUBLISHED Published: 2025-10-07T17:43:48.551Z Last Updated: 2025-10-08T03:55:17.726Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Dell Products: PowerProtect Data Domain BoostFS for Linux Ubuntu Feature Release, PowerProtect Data Domain BoostFS for Linux Ubuntu LTS2025, PowerProtect Data Domain BoostFS for Linux Ubuntu LTS2024, PowerProtect Data Domain BoostFS for Linux Ubuntu LTS2023 Problem Types: CWE-266 Description: Dell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023
7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000376224/dsa-2025-333-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE ID: CVE-2025-43915 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-19T15:10:54.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.buoyant.io/resources - https://docs.buoyant.io/security/advisories/2025-01/
CVE ID: CVE-2025-43916 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T14:03:20.440Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Sonos Products: api.sonos.com Problem Types: CWE-647 Description: Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might have further implications in conjunction with "Decompiling the app revealed a hardcoded secret." Additional Analyst Notes: - CISA ADP Vulnrichment:
n conjunction with "Decompiling the app revealed a hardcoded secret." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/larlarua/vulnerability-reports/blob/main/CVE-2025-43916/detail.md
CVE ID: CVE-2025-43917 State: PUBLISHED Published: 2025-04-19T00:00:00.000Z Last Updated: 2025-04-21T15:13:55.743Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Pritunl Products: Pritunl-Client Problem Types: CWE-863 Description: In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. Specifically, an administrator can insert a new file at the pathname of the removed pritunl-service file. This file then is executed by a LaunchDaemon as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forum.pritunl.com/t/pritunl-client-v1-3-4220-57/3183
CVE ID: CVE-2025-43918 State: PUBLISHED Published: 2025-04-19T00:00:00.000Z Last Updated: 2025-04-21T14:19:27.457Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: SSL.com Products: SSL.com Problem Types: CWE-348 Description: SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued for the domain name of a requester's email address, even when the requester does not otherwise establish administrative control of that domain. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://news.ycombinator.com/item?id=43738485 - https://bugzilla.mozilla.o
Notes: - CISA ADP Vulnrichment: References: - https://news.ycombinator.com/item?id=43738485 - https://bugzilla.mozilla.org/show_bug.cgi?id=1961406
CVE ID: CVE-2025-43919 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-04-28T13:43:23.197Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: GNU Products: Mailman Problem Types: CWE-24 Description: GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code.laun
ess of whether cPanel or WHM is used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code.launchpad.net/~mailman-coders/mailman/2.1 - https://github.com/0NYX-MY7H/CVE-2025-43919 - https://github.com/cpanel/mailman2-python3 - https://www.openwall.com/lists/oss-security/2025/04/21/6
CVE ID: CVE-2025-43920 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-04-28T13:44:29.998Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: GNU Products: Mailman Problem Types: CWE-78 Description: GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code.launchpad.net/~mailman-coders/mai
is used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code.launchpad.net/~mailman-coders/mailman/2.1 - https://github.com/0NYX-MY7H/CVE-2025-43920 - https://github.com/cpanel/mailman2-python3 - https://www.openwall.com/lists/oss-security/2025/04/21/6
CVE ID: CVE-2025-43921 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-04-28T13:45:41.386Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: GNU Products: Mailman Problem Types: CWE-863 Description: GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code.launchpad.net/~mailman-coders/mailman/2.1 - https://github.com/0NYX-MY7H/CVE-2025-43921 - https://github.com/cp
s://code.launchpad.net/~mailman-coders/mailman/2.1 - https://github.com/0NYX-MY7H/CVE-2025-43921 - https://github.com/cpanel/mailman2-python3 - https://www.openwall.com/lists/oss-security/2025/04/21/6
CVE ID: CVE-2025-43922 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T16:16:33.259Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: FileWave Products: FileWave Problem Types: CWE-863 Description: The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.filewave.com/books/downloads/page/filewave-version-1603
CVE ID: CVE-2025-43923 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-04T20:20:26.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ReportController in Unicom Focal Point 7.6.1. A user who has administrative privilege in Focal Point can perform SQL injection via the image parameter during a delete report image operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unicomsi.com/products/focal-point/ - https://www.unicomsi.com/security-advisory/
CVE ID: CVE-2025-43924 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-04T20:22:22.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController (for /fp/admin/settings/loginpage) and the rootserviceurl parameter in FriendsController (for /fp/admin/settings/friends), entered by an admin, allow stored XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unicomsi.com/products/focal-point/ - https://www.unicomsi.com/security-advisory/
CVE ID: CVE-2025-43925 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-03T18:23:56.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Unicom Focal Point 7.6.1. The database is encrypted with a hardcoded key, making it easier to recover the cleartext data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unicomsi.com/products/focal-point/ - https://www.unicomsi.com/security-advisory/
CVE ID: CVE-2025-43926 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:31:16.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://znuny.com - https://www.znuny.org/en/advisories/zsa-2025-07
CVE ID: CVE-2025-43928 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-04-21T14:33:02.315Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Infodraw Products: Media Relay Service Problem Types: CWE-24 Description: In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mint-secure.de/path-traversal-vulnerability-in-surveillance-software/ - https://cfp.eh22.eas
ment: References: - https://mint-secure.de/path-traversal-vulnerability-in-surveillance-software/ - https://cfp.eh22.easterhegg.eu/eh22/talk/9UDXSE/
CVE ID: CVE-2025-43929 State: PUBLISHED Published: 2025-04-20T00:00:00.000Z Last Updated: 2025-04-21T13:49:36.078Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: kitty project Products: kitty Problem Types: CWE-346 Description: open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kovidgoyal/kitty/commit/ce5cfdd9caf44c538af800a07162e1f49bd53c35 - https://github.com/kovidgoyal/kitty/compare/v0.40.1...v0.41.0 - https://gh
it/ce5cfdd9caf44c538af800a07162e1f49bd53c35 - https://github.com/kovidgoyal/kitty/compare/v0.40.1...v0.41.0 - https://ghostwriter.kde.org/documentation/#links - https://hitman.services/cve-2025-43929/ - https://github.com/0xBenCantCode/CVE-2025-43929
CVE ID: CVE-2025-43930 State: PUBLISHED Published: 2025-07-07T00:00:00.000Z Last Updated: 2025-07-08T17:37:44.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hashview/hashview/blob/579a082176279f4af0e128e44c9da5667f82ec5a/hashview/users/routes.py#L198-L218 - https://github.com/hashview/hashview/issues/145
CVE ID: CVE-2025-43931 State: PUBLISHED Published: 2025-07-07T00:00:00.000Z Last Updated: 2025-07-08T17:37:39.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MaxHalford/flask-boilerplate/blob/a170e7cec605906801680567c4279b30ccd9630b/app/views/user.py#L103-L126 - https://gist.github.com/BrookeYangRui/19fcc6c19df7bb4d8437476c609a6129
CVE ID: CVE-2025-43932 State: PUBLISHED Published: 2025-07-07T00:00:00.000Z Last Updated: 2025-07-08T17:37:34.743Z Vendors: n/a Products: n/a Problem Types: n/a Description: JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/guomaoqiu/JobCenter/blob/7e7b0b2f756d66bba7e592a6c8952c78a3573d9c/app/templates/auth/email/reset_password.txt - https://github.com/guomaoqiu/JobCenter/issues/18
CVE ID: CVE-2025-43933 State: PUBLISHED Published: 2025-07-07T00:00:00.000Z Last Updated: 2025-07-08T17:37:29.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ghost123gg/fblog/blob/983bedec9f837a54ab2dfd358a9cb45504a2e709/app/templates/auth/email/resetPassword.html#L1-L8 - https://github.com/ghost123gg/fblog/issues/5
CVE ID: CVE-2025-43934 State: PUBLISHED Published: 2025-10-07T18:30:18.124Z Last Updated: 2025-10-07T19:00:35.914Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) Vendors: Dell Products: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024, PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023 Problem Types: CWE-22 Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release