Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-0747 State: PUBLISHED Published: 2025-01-30T11:20:21.844Z Last Updated: 2025-02-18T19:01:15.344Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: EmbedAI Products: EmbedAI Problem Types: CWE-79 Description: A Stored Cross-Site Scripting vulnerability has been found in EmbedAI. This vulnerability allows an authenticated attacker to inject a malicious JavaScript code into a message that will be executed when a user opens the chat. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai
CVE ID: CVE-2025-0748 State: PUBLISHED Published: 2025-03-07T01:44:54.459Z Last Updated: 2025-03-07T16:30:28.665Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Fave Themes Products: Homey Problem Types: CWE-352 Description: The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homey_verify_user_manually' function. This makes it possible for unauthenticated attackers to update verify an user via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: -
d they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a35a66c6-2a86-4f6e-b28e-d79e13489a49?source=cve - https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog
CVE ID: CVE-2025-0749 State: PUBLISHED Published: 2025-03-07T01:44:53.516Z Last Updated: 2025-03-07T16:32:11.170Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fave Themes Products: Homey Problem Types: CWE-288 Description: The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers to log in to the first verified user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vul
rified user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05f87510-28c3-4ad1-b2be-2408a199cf68?source=cve - https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog
CVE ID: CVE-2025-0750 State: PUBLISHED Published: 2025-01-28T09:29:30.831Z Last Updated: 2025-11-20T20:00:10.015Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4 Problem Types: CWE-22 Description: A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
denial of service by unmounting critical system directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:1122 - https://access.redhat.com/security/cve/CVE-2025-0750 - https://bugzilla.redhat.com/show_bug.cgi?id=2339405
CVE ID: CVE-2025-0751 State: PUBLISHED Published: 2025-01-27T19:31:06.040Z Last Updated: 2025-01-27T20:01:20.534Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Axiomatic Products: Bento4 Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0. This affects the function AP4_BitReader::ReadBits of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293517 - https://vuldb.com/?ctiid.29351
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293517 - https://vuldb.com/?ctiid.293517 - https://vuldb.com/?submit.483315 - https://github.com/axiomatic-systems/Bento4/issues/991 - https://github.com/user-attachments/files/18434657/seeds.zip
CVE ID: CVE-2025-0752 State: PUBLISHED Published: 2025-01-28T09:29:33.073Z Last Updated: 2025-11-20T20:00:16.285Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: OpenShift Service Mesh 2 Problem Types: CWE-444 Description: A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-0752 - https://bugzilla.redhat.com/show_bug.cgi?id=2339115
CVE ID: CVE-2025-0753 State: PUBLISHED Published: 2025-01-27T21:00:15.655Z Last Updated: 2025-01-27T21:30:35.460Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Axiomatic Products: Bento4 Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0. This vulnerability affects the function AP4_StdcFileByteStream::ReadPartial of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293518 - https://vuldb.com/?
sed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293518 - https://vuldb.com/?ctiid.293518 - https://vuldb.com/?submit.483326 - https://github.com/axiomatic-systems/Bento4/issues/991 - https://github.com/user-attachments/files/18434657/seeds.zip
CVE ID: CVE-2025-0754 State: PUBLISHED Published: 2025-01-28T09:37:11.500Z Last Updated: 2025-11-20T20:00:18.669Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: OpenShift Service Mesh 2 Problem Types: CWE-117 Description: The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to log injection and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries o
ion and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries or execute reflected cross-site scripting (XSS) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-0754 - https://bugzilla.redhat.com/show_bug.cgi?id=2339147
CVE ID: CVE-2025-0755 State: PUBLISHED Published: 2025-03-18T09:01:04.793Z Last Updated: 2025-11-03T19:35:09.738Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MongoDB Inc Products: libbson, MongoDB Server Problem Types: CWE-122 Description: The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions
affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-94461 - https://jira.mongodb.org/browse/CDRIVER-5601
CVE ID: CVE-2025-0756 State: PUBLISHED Published: 2025-04-16T22:23:19.116Z Last Updated: 2025-04-17T13:09:26.057Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Vantara Products: Pentaho Data Integration & Analytics Problem Types: CWE-99 Description: Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Description Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not restrict JNDI identifiers during the creatio
ion & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not restrict JNDI identifiers during the creation of platform data sources. Impact An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://support.pentaho.com/hc/en-us/articles/35771876077709--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Improper-Control-of-Resource-Identifiers-Resource-Injection-Versions-before-
-Vantara-Pentaho-Data-Integration-Analytics-Improper-Control-of-Resource-Identifiers-Resource-Injection-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0756
CVE ID: CVE-2025-0757 State: PUBLISHED Published: 2025-04-16T22:18:19.156Z Last Updated: 2025-04-17T13:10:09.857Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-79 Description: Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. Impact Once the malicious s
9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. Impact Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/35781038882445--Resolved-Hitachi-Vantara-Pentaho-B
richment: References: - https://support.pentaho.com/hc/en-us/articles/35781038882445--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0757
CVE ID: CVE-2025-0758 State: PUBLISHED Published: 2025-04-16T22:12:29.724Z Last Updated: 2025-04-17T13:10:38.993Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-732 Description: Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. (CWE-732) Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, is installed with Karaf JMX beans enabled and accessible by default. Impact When the vulnerability is leveraged, a user with
stalled with Karaf JMX beans enabled and accessible by default. Impact When the vulnerability is leveraged, a user with local execution privileges can access functionality exposed by Karaf beans contained in the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/35781318194061--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Permission-Assignment-for-Critical-Resource-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0758
CVE ID: CVE-2025-0759 State: PUBLISHED Published: 2025-02-27T14:53:41.714Z Last Updated: 2025-02-27T15:11:40.468Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: EntireX Problem Types: CWE-367 Description: IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184194
CVE ID: CVE-2025-0760 State: PUBLISHED Published: 2025-02-25T23:31:24.292Z Last Updated: 2025-02-26T15:43:21.203Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Tenable Products: Tenable Identity Exposure Problem Types: CWE-522 Description: A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2025-01
CVE ID: CVE-2025-0762 State: PUBLISHED Published: 2025-01-29T10:33:45.673Z Last Updated: 2025-01-29T14:21:22.229Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_28.html - https://issues.chromium.org/issues/384844003
CVE ID: CVE-2025-0763 State: PUBLISHED Published: 2025-09-11T07:24:50.341Z Last Updated: 2025-09-11T14:41:25.190Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: webcodingplace Products: Ultimate Classified Listings Problem Types: CWE-862 Description: The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_custom_fields function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change plugin custom fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
ess and above, to change plugin custom fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c368677-e436-412a-9a88-89d128d72aa0?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/tags/1.4/classes/class-admin-settings.php#L379
CVE ID: CVE-2025-0764 State: PUBLISHED Published: 2025-02-28T07:03:46.135Z Last Updated: 2025-02-28T14:52:27.378Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: tomdever Products: wpForo Forum Problem Types: CWE-20 Description: The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to read arbitrary files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-i
files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd8ffcb-0a24-4e0a-a9f9-23501742715f?source=cve - https://plugins.trac.wordpress.org/changeset/3245711/wpforo
CVE ID: CVE-2025-0765 State: PUBLISHED Published: 2025-07-24T06:33:38.009Z Last Updated: 2025-07-24T13:36:22.397Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an unauthorized user to access custom service desk email addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/515381 - https://hackerone.com/reports/2956315
CVE ID: CVE-2025-0767 State: PUBLISHED Published: 2025-02-27T18:14:52.946Z Last Updated: 2025-02-27T19:00:33.746Z Vendors: Melapress Products: WP Activity Log Problem Types: CWE-502 Description: WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/skims-9/ - https://co.wordpress.org/plugins/wp-security-audit-log/
CVE ID: CVE-2025-0769 State: PUBLISHED Published: 2025-02-28T20:01:30.324Z Last Updated: 2025-02-28T20:29:26.478Z Vendors: PixelYourSite Problem Types: CWE-502 Description: PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/skims-23/ - https://co.wordpress.org/plugins/pixelyoursite/#developers
CVE ID: CVE-2025-0781 State: PUBLISHED Published: 2025-01-28T16:34:21.881Z Last Updated: 2025-02-12T20:01:11.702Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: FlightGear Products: SimGear Problem Types: CWE-863 Description: An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/flightgear/simgear/-/commit/5bb023647114267141a7610e8f1ca7d6f4f5a5a8 - https://gitlab.com/flightgear/flightgear/-/commit/ad37afce28083fad7f79467b3ffdead753584358 - http
610e8f1ca7d6f4f5a5a8 - https://gitlab.com/flightgear/flightgear/-/commit/ad37afce28083fad7f79467b3ffdead753584358 - https://gitlab.com/flightgear/flightgear/-/issues/3025
CVE ID: CVE-2025-0782 State: REJECTED Published: 2025-05-02T20:11:19.114Z Last Updated: 2025-05-20T10:17:12.083Z Description: No description available.
CVE ID: CVE-2025-0783 State: PUBLISHED Published: 2025-01-28T18:31:04.836Z Last Updated: 2025-01-28T18:53:37.145Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: pankajindevops Products: scale Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpoint. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
ut affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293907 - https://vuldb.com/?ctiid.293907 - https://vuldb.com/?submit.480350 - https://docs.google.com/document/d/1FCJveTlXtJd8EJRW2-LXwuhno92JaVt3_98Iqrdoc6M/edit?tab=t.0#heading=h.bbpri264qnth - https://drive.google.com/file/d/1KqzS5bMyPtgO9eIk_-que50tZU097RVi/view
CVE ID: CVE-2025-0784 State: PUBLISHED Published: 2025-01-28T20:00:13.220Z Last Updated: 2025-02-12T20:01:10.799Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Intelbras Products: InControl Problem Types: CWE-319, CWE-310 Description: A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic. This vulnerability affects unknown code of the file /v1/usuario/ of the component Registered User Handler. The manipulation leads to cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclo
otely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.59 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293908 - https://vuldb.com/?ctiid.293908 - https://vuldb.com/?submit.483835 - https://eldruin.notion.site/Intelbras-InControl-v2-21-57-Password-exposed-in-clear-text-17d27474cccb806fba1efda195c78258?pvs=4
CVE ID: CVE-2025-0785 State: PUBLISHED Published: 2025-01-28T21:31:04.105Z Last Updated: 2025-01-29T14:35:08.056Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ESAFENET Products: CDG Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ESAFENET CDG V5 and classified as problematic. This issue affects some unknown processing of the file /SysConfig.jsp. The manipulation of the argument help leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293909 - https://vuldb.com/?ctiid.293909 - https://vuldb.com/?submit.483338 - https://github.com/Rain1er/report/blob/main/CDG/SysConfig.md
CVE ID: CVE-2025-0786 State: PUBLISHED Published: 2025-01-28T22:00:11.362Z Last Updated: 2025-01-29T14:20:20.599Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in ESAFENET CDG V5. It has been classified as critical. Affected is an unknown function of the file /appDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293910 - https://vuldb.com/?ctiid.293910 - https://vuldb.com/?submit.483339 - https://github.com/Rain1er/report/blob/main/CDG/appDetail.md
CVE ID: CVE-2025-0787 State: PUBLISHED Published: 2025-01-28T22:00:13.073Z Last Updated: 2025-01-29T14:55:42.566Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ESAFENET Products: CDG Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ESAFENET CDG V5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /appDetail.jsp. The manipulation of the argument curpage leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA AD