Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-25017 State: PUBLISHED Published: 2025-10-10T09:53:25.634Z Last Updated: 2025-10-10T16:43:55.939Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-18-8-8-19-4-9-0-7-9-1-4-security-update-esa-2025-16/382450
CVE ID: CVE-2025-25018 State: PUBLISHED Published: 2025-10-10T09:50:35.448Z Last Updated: 2025-10-14T03:55:14.473Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-17/382451
CVE ID: CVE-2025-25019 State: PUBLISHED Published: 2025-06-03T15:14:47.341Z Last Updated: 2025-08-24T12:00:16.388Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: QRadar Suite Software, Cloud Pak for Security Problem Types: CWE-613 Description: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235432
CVE ID: CVE-2025-25020 State: PUBLISHED Published: 2025-06-03T15:19:41.438Z Last Updated: 2025-08-24T12:00:36.733Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: QRadar Suite Software, Cloud Pak for Security Problem Types: CWE-1287 Description: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated user to cause a denial of service due to improperly validating API data input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235432
CVE ID: CVE-2025-25021 State: PUBLISHED Published: 2025-06-03T15:17:37.411Z Last Updated: 2025-08-24T11:59:57.516Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: QRadar Suite Software, Cloud Pak for Security Problem Types: CWE-94 Description: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged execute code in case management script creation due to the improper generation of code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235432
CVE ID: CVE-2025-25022 State: PUBLISHED Published: 2025-06-03T15:16:19.691Z Last Updated: 2025-08-26T14:53:06.088Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: QRadar Suite Software, Cloud Pak for Security Problem Types: CWE-260 Description: IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive information in configuration files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235432
CVE ID: CVE-2025-25023 State: PUBLISHED Published: 2025-04-09T14:07:13.339Z Last Updated: 2025-09-01T00:55:20.025Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Guardium Problem Types: CWE-266 Description: IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7230467
CVE ID: CVE-2025-25025 State: PUBLISHED Published: 2025-05-28T01:10:05.961Z Last Updated: 2025-08-26T14:56:48.611Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Guardium Problem Types: CWE-209 Description: IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234827
CVE ID: CVE-2025-25026 State: PUBLISHED Published: 2025-05-28T01:11:23.103Z Last Updated: 2025-08-28T14:11:17.800Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Guardium Problem Types: CWE-863 Description: IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234827
CVE ID: CVE-2025-25029 State: PUBLISHED Published: 2025-05-28T01:12:19.751Z Last Updated: 2025-08-28T14:11:37.356Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Guardium Problem Types: CWE-116 Description: IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234827
CVE ID: CVE-2025-25032 State: PUBLISHED Published: 2025-06-11T17:26:35.867Z Last Updated: 2025-08-24T11:55:03.503Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-770 Description: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a specially crafted request that would exhaust memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234674
CVE ID: CVE-2025-25034 State: PUBLISHED Published: 2025-06-20T18:34:13.197Z Last Updated: 2025-11-20T16:24:48.786Z Vendors: SugarCRM Products: SugarCRM Problem Types: CWE-502 Description: A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Althou
a containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web.archive.org/web/20160725194502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-008 - https://web.archive.org/web/20160508053502/http://www.sugarcrm.com/security/sugarcrm-sa-2016-001 - https://karmainsecurity.com/KIS-2016-07 - https://www.exploit-db.com/exploits/40344 - https://raw.github
m-sa-2016-001 - https://karmainsecurity.com/KIS-2016-07 - https://www.exploit-db.com/exploits/40344 - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/sugarcrm_rest_unserialize_exec.rb - https://www.sugarcrm.com/crm/ - https://vulncheck.com/advisories/sugarcrm-php-deserialization-rce
CVE ID: CVE-2025-25035 State: PUBLISHED Published: 2025-03-21T19:02:39.718Z Last Updated: 2025-11-19T20:26:02.084Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Jalios Products: JPlatform Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Jalios Workplace 6.2, Jalios Workplace 6.1, Jalios Workplace 6.0, and Jalios Workplace 5.3 to 5.5 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.jalio
and Jalios Workplace 5.3 to 5.5 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19 - https://issues.jalios.com/browse/JCMS-11259 - https://issues.jalios.com/browse/JCMS-11246 - https://issues.jalios.com/browse/JCMS-11248 - https://vulncheck.com/advisories/jalios-jplatform-xss
CVE ID: CVE-2025-25036 State: PUBLISHED Published: 2025-03-21T19:27:12.472Z Last Updated: 2025-11-19T20:26:50.070Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Jalios Products: JPlatform Problem Types: CWE-611 Description: Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19 - https://issues.jalios.com/browse/JCMS-11250 - https://vulncheck.com/advisories/jalios-jplatform-xxe
CVE ID: CVE-2025-25037 State: PUBLISHED Published: 2025-06-20T18:35:19.243Z Last Updated: 2025-06-23T20:33:15.219Z Vendors: Aquatronica Products: Aquatronica Controller System Problem Types: CWE-200 Description: An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration data, including plaintext administrative credentials. Exploitation of this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquari
this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5824.php - https://www.exploit-db.com/exploits/52028 - https://fortiguard.fortinet.com/encyclopedia/ips/56008 - https://www.aquatronica.com - https://vulncheck.com/advisories/aquatronica-controller-system-credential-leak
CVE ID: CVE-2025-25038 State: PUBLISHED Published: 2025-06-20T18:36:09.946Z Last Updated: 2025-11-20T16:16:56.115Z Vendors: MiniDVBLinux Products: MiniDVBLinux Problem Types: CWE-78 Description: An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to properly sanitize user-supplied input before passing it to operating system commands. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary commands as the root user, potentially compromising the entire device. Exploitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC. Additional Analyst Notes: - CISA ADP V
loitation evidence was observed by the Shadowserver Foundation on 2024-04-10 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5717.php - https://www.exploit-db.com/exploits/51096 - https://www.fortiguard.com/encyclopedia/ips/52454 - https://cxsecurity.com/issue/WLB-2022100039 - https://packetstormsecurity.com/files/168744/ - https://www.minidvblinux.de - https://vulncheck.com/advisories/minidvblinux-command-injection
CVE ID: CVE-2025-25039 State: PUBLISHED Published: 2025-02-04T18:13:23.132Z Last Updated: 2025-03-13T18:02:24.600Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking ClearPass Policy Manager Description: A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
rivileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US
CVE ID: CVE-2025-25040 State: PUBLISHED Published: 2025-03-18T18:59:54.510Z Last Updated: 2025-03-18T19:24:02.485Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-CX Description: A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctl
d could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04818en_us&docLocale=en_US
CVE ID: CVE-2025-25041 State: PUBLISHED Published: 2025-04-01T16:45:53.717Z Last Updated: 2025-04-03T17:56:23.610Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: Virtual Intranet Access (VIA) Description: A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM (root). A successful exploit could allow the creation of a Denial-of-Service (DoS) condition affecting the Microsoft Windows Operating System. This vulnerability does not affect Linux and Android based clients. Additional Analyst Notes: - CISA ADP Vulnrich
ystem. This vulnerability does not affect Linux and Android based clients. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04841en_us&docLocale=en_US
CVE ID: CVE-2025-25042 State: PUBLISHED Published: 2025-03-18T19:02:02.192Z Last Updated: 2025-03-18T19:27:35.020Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-CX Description: A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized access or data breaches. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpe
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04818en_us&docLocale=en_US
CVE ID: CVE-2025-25044 State: PUBLISHED Published: 2025-06-01T11:35:22.032Z Last Updated: 2025-08-26T14:55:10.032Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Planning Analytics Local Problem Types: CWE-79 Description: IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235182
CVE ID: CVE-2025-25045 State: PUBLISHED Published: 2025-04-23T22:23:10.087Z Last Updated: 2025-08-28T15:04:29.605Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-209 Description: IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7231332
CVE ID: CVE-2025-25046 State: PUBLISHED Published: 2025-04-23T22:24:43.269Z Last Updated: 2025-08-28T15:04:09.033Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-319 Description: IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauthorized actor using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7231333
CVE ID: CVE-2025-25048 State: PUBLISHED Published: 2025-09-04T15:06:15.076Z Last Updated: 2025-09-04T15:16:08.257Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: IBM Products: Jazz Foundation Problem Types: CWE-23 Description: IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244014
CVE ID: CVE-2025-25050 State: PUBLISHED Published: 2025-06-13T21:03:18.087Z Last Updated: 2025-11-03T19:44:55.517Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-787 Description: An out-of-bounds write vulnerability exists in the cv_upgrade_sensor_firmware functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault 3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an out-of-bounds write. An attacker can issue an API call to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container
CVE ID: CVE-2025-25052 State: PUBLISHED Published: 2025-05-06T09:03:38.566Z Last Updated: 2025-05-06T14:48:41.647Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-120 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-05.md
CVE ID: CVE-2025-25053 State: PUBLISHED Published: 2025-04-09T09:03:09.322Z Last Updated: 2025-04-09T17:15:44.479Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Inaba Denki Sangyo Co., Ltd. Products: AC-WPS-11ac, AC-WPS-11ac-P, AC-WPSM-11ac, AC-WPSM-11ac-P, AC-PD-WPS-11ac, AC-PD-WPS-11ac-P Problem Types: CWE-78 Description: OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/security_20250404
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/security_20250404.pdf - https://jvn.jp/en/vu/JVNVU93925742/
CVE ID: CVE-2025-25054 State: PUBLISHED Published: 2025-02-19T05:52:09.401Z Last Updated: 2025-02-19T14:53:01.685Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Six Apart Ltd. Products: Movable Type (8.4.x series), Movable Type (8.0.x series), Movable Type Advanced (8.4.x series), Movable Type Advanced (8.0.x series), Movable Type Premium (2.x series), Movable Type Premium (Advanced Edition) (2.x series), Movable Type Cloud Edition (8.x series), Movable Type Premium Cloud Edition (2.x series) Problem Types: CWE-79 Description: Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentic
e contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.movabletype.org/news/2025/02/mt-842-released.html - https://jvn.jp/en/jp/JVN48742353/
CVE ID: CVE-2025-25055 State: PUBLISHED Published: 2025-02-17T23:56:51.567Z Last Updated: 2025-02-18T15:42:32.539Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: JIP InfoBridge Co., Ltd. Products: FileMegane Problem Types: CWE-290 Description: Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. If exploited, restricted file contents may be accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.info-brdg.co.jp/support/report/megane/sec20250201.html - https://jvn.jp/en/jp/JVN80527854/
CVE ID: CVE-2025-25056 State: PUBLISHED Published: 2025-04-09T09:03:14.758Z Last Updated: 2025-04-09T17:13:41.222Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Inaba Denki Sangyo Co., Ltd. Products: AC-WPS-11ac, AC-WPS-11ac-P, AC-WPSM-11ac, AC-WPSM-11ac-P, AC-PD-WPS-11ac, AC-PD-WPS-11ac-P Problem Types: CWE-352 Description: Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views a malicious page while logged in, unintended operations may be performed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inaba.co.jp/abaniact/news/security_20250404.pdf - https://jvn.jp/en/vu/JVNVU9392574
nrichment: References: - https://www.inaba.co.jp/abaniact/news/security_20250404.pdf - https://jvn.jp/en/vu/JVNVU93925742/
CVE ID: CVE-2025-25057 State: PUBLISHED Published: 2025-04-07T02:35:48.580Z Last Updated: 2025-04-07T15:28:40.407Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-401 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md
CVE ID: CVE-2025-25059 State: PUBLISHED Published: 2025-11-11T16:50:09.860Z Last Updated: 2025-11-12T20:01:14.840Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) One Boot Flash Update (Intel(R) OFU) software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when