Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-30370 State: PUBLISHED Published: 2025-04-03T22:00:44.476Z Last Updated: 2025-04-04T18:54:20.953Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H) Vendors: jupyterlab Products: jupyterlab-git Problem Types: CWE-78 Description: jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Ope
r starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. This vulnerability is fixed in 0.51.1. Additional Analyst Notes: - CISA ADP Vuln
vious patch provided an incomplete fix. This vulnerability is fixed in 0.51.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-cj5w-8mjf-r5f8 - https://github.com/jupyterlab/jupyterlab-git/pull/1196 - https://github.com/jupyterlab/jupyterlab-git/commit/b46482993f76d3a546015c6a94ebed8b77fc2376 - https://github.com/jupyterlab/jupyterlab-git/blob/7eb3b06f0092223bd5494688ec264527bbeb2195/src/commandsAndMenu.tsx#L175-L184
CVE ID: CVE-2025-30371 State: PUBLISHED Published: 2025-03-28T14:47:36.718Z Last Updated: 2025-03-28T15:42:10.181Z Vendors: metabase Products: metabase Problem Types: CWE-59 Description: Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with
2.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-8xf9-9jc8-qp98
CVE ID: CVE-2025-30372 State: PUBLISHED Published: 2025-03-28T14:51:41.664Z Last Updated: 2025-03-28T15:43:43.798Z Vendors: emlog Products: emlog Problem Types: CWE-89 Description: Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-w6xc
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-w6xc-r6x5-m77c
CVE ID: CVE-2025-30373 State: PUBLISHED Published: 2025-04-07T14:37:58.071Z Last Updated: 2025-04-08T19:02:45.783Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Graylog2 Products: graylog2-server Problem Types: CWE-285 Description: Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allo
is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q7g5-jq6p-6wvx - https://github.com/Graylog2/graylog2-server/commit/31bc13d3cd6f550ec83473d0f8666cd3ebf50f10
CVE ID: CVE-2025-30375 State: PUBLISHED Published: 2025-05-13T16:58:39.168Z Last Updated: 2025-09-10T00:09:18.457Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016 Problem Types: CWE-843 Description: Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References
l allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30375
CVE ID: CVE-2025-30376 State: PUBLISHED Published: 2025-05-13T16:58:40.109Z Last Updated: 2025-09-10T00:09:51.332Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016 Problem Types: CWE-122, CWE-125 Description: Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft
ttacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30376
CVE ID: CVE-2025-30377 State: PUBLISHED Published: 2025-05-13T16:58:40.672Z Last Updated: 2025-09-10T00:09:19.095Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office for Android, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Office 2016 Problem Types: CWE-416 Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/
code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30377
CVE ID: CVE-2025-30378 State: PUBLISHED Published: 2025-05-13T16:58:41.341Z Last Updated: 2025-09-10T00:09:19.676Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition Problem Types: CWE-502 Description: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30378
CVE ID: CVE-2025-30379 State: PUBLISHED Published: 2025-05-13T16:58:41.975Z Last Updated: 2025-09-10T00:09:20.337Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016 Problem Types: CWE-763 Description: Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.micro
ed attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30379
CVE ID: CVE-2025-30381 State: PUBLISHED Published: 2025-05-13T16:58:42.618Z Last Updated: 2025-09-10T00:09:50.822Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016 Problem Types: CWE-125, CWE-822 Description: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/upd
to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30381
CVE ID: CVE-2025-30382 State: PUBLISHED Published: 2025-05-13T16:58:43.339Z Last Updated: 2025-09-10T00:09:20.983Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition Problem Types: CWE-502 Description: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30382
CVE ID: CVE-2025-30383 State: PUBLISHED Published: 2025-05-13T16:58:44.101Z Last Updated: 2025-09-10T00:09:21.537Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Office Online Server, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Excel 2016 Problem Types: CWE-843 Description: Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References
l allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30383
CVE ID: CVE-2025-30384 State: PUBLISHED Published: 2025-05-13T16:58:44.963Z Last Updated: 2025-09-10T00:09:22.331Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition Problem Types: CWE-502 Description: Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30384
CVE ID: CVE-2025-30385 State: PUBLISHED Published: 2025-05-13T16:59:09.691Z Last Updated: 2025-09-10T00:09:42.893Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
n: Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30385
CVE ID: CVE-2025-30386 State: PUBLISHED Published: 2025-05-13T16:58:45.977Z Last Updated: 2025-09-10T00:09:22.960Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office for Android, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Office 2016 Problem Types: CWE-416 Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/
code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30386
CVE ID: CVE-2025-30387 State: PUBLISHED Published: 2025-05-13T16:58:46.604Z Last Updated: 2025-09-10T00:09:23.556Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure AI Document Intelligence Studio Problem Types: CWE-22 Description: Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30387
CVE ID: CVE-2025-30388 State: PUBLISHED Published: 2025-05-13T16:59:10.344Z Last Updated: 2025-09-10T00:09:43.614Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office LTSC for Mac 2021, Microsoft Office for Android, Microsoft Office for Universal, Microsoft Office LTSC for Mac 2024, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core in
Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-
Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-122 Description: Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30388
CVE ID: CVE-2025-30389 State: PUBLISHED Published: 2025-04-30T17:14:50.414Z Last Updated: 2025-06-04T17:53:39.477Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: Azure AI Bot Service Problem Types: CWE-285 Description: Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30389
CVE ID: CVE-2025-30390 State: PUBLISHED Published: 2025-04-30T17:14:51.736Z Last Updated: 2025-06-04T17:53:40.629Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Machine Learning Problem Types: CWE-285 Description: Improper authorization in Azure allows an authorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30390
CVE ID: CVE-2025-30391 State: PUBLISHED Published: 2025-04-30T17:14:49.584Z Last Updated: 2025-08-27T20:43:01.532Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Dynamics 365 Customer Service Problem Types: CWE-20 Description: Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30391
CVE ID: CVE-2025-30392 State: PUBLISHED Published: 2025-04-30T17:14:52.419Z Last Updated: 2025-06-04T17:53:41.264Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure AI Bot Service Problem Types: CWE-285 Description: Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30392
CVE ID: CVE-2025-30393 State: PUBLISHED Published: 2025-05-13T16:58:47.856Z Last Updated: 2025-09-10T00:09:24.803Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024 Problem Types: CWE-416 Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30393
CVE ID: CVE-2025-30394 State: PUBLISHED Published: 2025-05-13T16:58:49.077Z Last Updated: 2025-09-10T00:09:51.883Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-591 Description:
llation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-591 Description: Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30394
CVE ID: CVE-2025-30397 State: PUBLISHED Published: 2025-05-13T16:59:10.994Z Last Updated: 2025-10-21T22:55:14.872Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-843 Description: Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized at
n: Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30397
CVE ID: CVE-2025-30398 State: PUBLISHED Published: 2025-11-11T17:59:51.398Z Last Updated: 2025-11-21T19:07:14.634Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Nuance PowerScribe 360 version 4.0.5, Nuance PowerScribe 360 version 4.0.8, Nuance PowerScribe 360 version 4.0.9, Nuance PowerScribe 360 version 4.0.6, Nuance PowerScribe 360 version 4.0.7, Nuance PowerScribe One version 2019.3, Nuance PowerScribe One version 2019.2, Nuance PowerScribe One version 2019.1, Nuance PowerScribe 360 version 4.0.1, Nuance PowerScribe 360 version 4.0.2, Nuance PowerScribe 360 version 4.0.3, Nuance PowerScribe 360 version 4.0.4, Nuance Power
PowerScribe 360 version 4.0.2, Nuance PowerScribe 360 version 4.0.3, Nuance PowerScribe 360 version 4.0.4, Nuance PowerScribe One version 2019.5, Nuance PowerScribe One version 2019.4, Nuance PowerScribe One version 2019.6, Nuance PowerScribe One version 2019.8, Nuance PowerScribe One version 2019.7, Nuance PowerScribe One version 2019.9, Nuance PowerScribe One version 2019.10, PowerScribe One version 2023.1 SP2 Patch 7 Problem Types: CWE-862 Description: Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30398
CVE ID: CVE-2025-30399 State: PUBLISHED Published: 2025-06-13T01:08:00.208Z Last Updated: 2025-07-11T16:36:12.015Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: PowerShell 7.4, PowerShell 7.5, .NET 8.0, .NET 9.0, Microsoft Visual Studio 2022 version 17.12, Microsoft Visual Studio 2022 version 17.8, Microsoft Visual Studio 2022 version 17.10, Microsoft Visual Studio 2022 version 17.14 Problem Types: CWE-426 Description: Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/updat
e code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30399