Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-46346 State: PUBLISHED Published: 2025-04-29T15:36:14.321Z Last Updated: 2025-04-29T17:47:55.685Z Vendors: YesWiki Products: yeswiki Problem Types: CWE-79 Description: YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting (XSS) vulnerability was discovered in the application’s comments feature. This issue allows a malicious actor to inject JavaScript payloads that are stored and later executed in the browser of any user viewing the affected comment. The XSS occurs because the application fails to properly sanitize or encode user input submitted to the comments. Notably, the application sanitizes or does not allow execution of `<script
encode user input submitted to the comments. Notably, the application sanitizes or does not allow execution of `<script>` tags, but does not account for payloads obfuscated using JavaScript block comments like `/* JavaScriptPayload */`. This issue has been patched in version 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-59x8-cvxh-3mm4 - https://github.com/YesWiki/yeswiki/commit/0d4efc880a727599fa4f6d7a64cc967afe475530
CVE ID: CVE-2025-46347 State: PUBLISHED Published: 2025-04-29T17:11:05.404Z Last Updated: 2025-04-29T18:06:22.228Z Vendors: YesWiki Products: yeswiki Problem Types: CWE-116 Description: YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be used to write a file with a PHP extension, which then can be browsed to in order to execute arbitrary code on the server, resulting in a full compromise of the server. This could potentially be performed unwittingly by a user. This issue has been patched in version 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/
d in version 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-88xg-v53p-fpvf - https://github.com/YesWiki/yeswiki/commit/8fe5275a78dc7e0f9c242baa3cbac6b5ac1cc066
CVE ID: CVE-2025-46348 State: PUBLISHED Published: 2025-04-29T20:39:40.423Z Last Updated: 2025-04-30T13:19:35.339Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: YesWiki Products: yeswiki Problem Types: CWE-287, CWE-862 Description: YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading
esult in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wc9g-6j9w-hr95 - https://github.com/YesWiki/yeswiki/commit/0d4efc880a727599fa4f6d7a64cc967afe475530
CVE ID: CVE-2025-46349 State: PUBLISHED Published: 2025-04-29T17:11:10.679Z Last Updated: 2025-04-29T18:01:20.769Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: YesWiki Products: yeswiki Problem Types: CWE-79 Description: YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2 - https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524
CVE ID: CVE-2025-46350 State: PUBLISHED Published: 2025-04-29T17:11:18.291Z Last Updated: 2025-04-29T18:00:34.649Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: YesWiki Products: yeswiki Problem Types: CWE-79 Description: YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4. Additional Analyst Notes: -
deface the website or embed malicious content. This issue has been patched in version 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cg4f-cq8h-3ch8 - https://github.com/YesWiki/yeswiki/commit/e2603176a4607b83659635a0c517550d4a171cb9
CVE ID: CVE-2025-46352 State: PUBLISHED Published: 2025-05-29T23:18:33.934Z Last Updated: 2025-05-30T12:49:31.802Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Consilium Safety Products: CS5000 Fire Panel Problem Types: CWE-798 Description: The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary responsible for running VNC. This password cannot be altered, allowing anyone with knowledge of it to gain remote access to the panel. Such access could enable an attacker to operate the panel remotely, potentially putting the fire panel into a non-functional state and causing serious sa
ker to operate the panel remotely, potentially putting the fire panel into a non-functional state and causing serious safety issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-03 - https://www.consiliumsafety.com/en/support/
CVE ID: CVE-2025-46354 State: PUBLISHED Published: 2025-07-22T15:26:32.910Z Last Updated: 2025-11-03T20:04:25.328Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Bloomberg Products: Comdb2 Problem Types: CWE-617 Description: A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A specially crafted network packet can lead to a denial of service. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2198
CVE ID: CVE-2025-46355 State: PUBLISHED Published: 2025-06-03T08:09:47.909Z Last Updated: 2025-06-03T13:54:42.604Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Keiyo System Co., LTD Products: PC Time Tracer Problem Types: CWE-276 Description: Incorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with SYSTEM privilege on Windows system where the product is running by a local authenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.keiyo-system.co.jp/archives/11305 - https://jvn.jp/en/jp/JVN05562338/
CVE ID: CVE-2025-46358 State: PUBLISHED Published: 2025-07-10T23:41:25.965Z Last Updated: 2025-07-11T13:54:26.695Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Emerson Products: ValveLink SOLO, ValveLink DTM, ValveLink PRM, ValveLink SNAP-ON Problem Types: CWE-693 Description: Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01 - https://www.emerson.com/en-us/support/security-notifications - https://www.emerson.com/en-us/supp
ories/icsa-25-189-01 - https://www.emerson.com/en-us/support/security-notifications - https://www.emerson.com/en-us/support/software-downloads-drivers
CVE ID: CVE-2025-46359 State: PUBLISHED Published: 2025-07-31T07:22:46.914Z Last Updated: 2025-07-31T15:28:30.839Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Alfasado Inc. Products: PowerCMS Problem Types: CWE-22 Description: A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.powercms.jp/news/release-powercms-671-531-461.html - https://jvn.jp/en/vu/JVNVU93412964/
CVE ID: CVE-2025-46362 State: PUBLISHED Published: 2025-11-13T19:34:09.622Z Last Updated: 2025-11-13T19:42:43.042Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Dell Products: Alienware Command Center 6.x (AWCC) Problem Types: CWE-284 Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE ID: CVE-2025-46363 State: PUBLISHED Published: 2025-10-30T15:22:43.106Z Last Updated: 2025-10-30T16:00:58.601Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: Secure Connect Gateway SCG 5.0 Application and Appliance Problem Types: CWE-23 Description: Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerability in the SCG exposed for an internal collection download REST API (if this REST API is enabled by Admin user from UI). A low privileged attacker with remote access could potentially exploit this vulnerability, leading to allowing relative path traver
leged attacker with remote access could potentially exploit this vulnerability, leading to allowing relative path traversal to restricted resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000385239/dsa-2025-386-security-update-for-dell-secure-connect-gateway-rest-api
CVE ID: CVE-2025-46364 State: PUBLISHED Published: 2025-11-05T16:36:00.347Z Last Updated: 2025-11-06T04:55:39.277Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CloudLin Problem Types: CWE-269 Description: Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control of system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE ID: CVE-2025-46365 State: PUBLISHED Published: 2025-11-05T16:40:39.934Z Last Updated: 2025-11-06T04:55:40.128Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: Dell Products: CloudLink Problem Types: CWE-77 Description: Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection on an affected Dell CloudLink. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE ID: CVE-2025-46366 State: PUBLISHED Published: 2025-11-05T16:50:28.754Z Last Updated: 2025-11-06T04:55:41.794Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: CloudLink Problem Types: CWE-256 Description: Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the database to obtain confidential information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE ID: CVE-2025-46367 State: PUBLISHED Published: 2025-11-13T19:23:58.335Z Last Updated: 2025-11-14T04:55:41.936Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Alienware Command Center Problem Types: CWE-390 Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE ID: CVE-2025-46368 State: PUBLISHED Published: 2025-11-13T19:30:44.540Z Last Updated: 2025-11-13T19:37:36.389Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Dell Products: Alienware Command Center 6.x (AWCC) Problem Types: CWE-377 Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE ID: CVE-2025-46369 State: PUBLISHED Published: 2025-11-13T19:41:56.545Z Last Updated: 2025-11-14T04:55:42.715Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Alienware Command Center 6.x (AWCC) Problem Types: CWE-377 Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE ID: CVE-2025-46370 State: PUBLISHED Published: 2025-11-13T19:38:47.751Z Last Updated: 2025-11-13T19:54:44.576Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Dell Products: Alienware Command Center 6.x (AWCC) Problem Types: CWE-114 Description: Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Process Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000379467/dsa-2025-392
CVE ID: CVE-2025-46373 State: PUBLISHED Published: 2025-11-18T17:01:15.231Z Last Updated: 2025-11-18T20:58:43.450Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-122 Description: A Heap-based Buffer Overflow vulnerability [CWE-122] in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.8 may allow an authenticated local IPSec user to execute arbitrary code or commands via "fortips_74.sys". The attacker would need to bypass the Windows heap integrity protections Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com
p integrity protections Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-125
CVE ID: CVE-2025-46374 State: REJECTED Published: N/A Last Updated: 2025-04-24T02:55:08.708Z Description: No description available.
CVE ID: CVE-2025-46375 State: REJECTED Published: N/A Last Updated: 2025-04-24T02:55:08.258Z Description: No description available.
CVE ID: CVE-2025-46376 State: REJECTED Published: N/A Last Updated: 2025-04-24T02:55:07.798Z Description: No description available.
CVE ID: CVE-2025-46377 State: REJECTED Published: N/A Last Updated: 2025-04-24T02:55:07.234Z Description: No description available.
CVE ID: CVE-2025-46378 State: REJECTED Published: N/A Last Updated: 2025-04-24T02:55:06.768Z Description: No description available.
CVE ID: CVE-2025-46379 State: REJECTED Published: N/A Last Updated: 2025-04-24T02:55:06.238Z Description: No description available.
CVE ID: CVE-2025-46380 State: REJECTED Published: N/A Last Updated: 2025-04-24T02:55:05.776Z Description: No description available.
CVE ID: CVE-2025-46381 State: REJECTED Published: N/A Last Updated: 2025-04-24T02:55:05.224Z Description: No description available.
CVE ID: CVE-2025-46382 State: PUBLISHED Published: 2025-07-20T14:31:09.823Z Last Updated: 2025-07-21T13:17:27.991Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: CyberArk Products: IDP Problem Types: CWE-200 Description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46383 State: PUBLISHED Published: 2025-07-20T14:35:19.273Z Last Updated: 2025-07-21T20:37:03.283Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Emby Products: Windows Problem Types: CWE-79 Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46384 State: PUBLISHED Published: 2025-07-20T14:40:22.895Z Last Updated: 2025-07-21T20:36:56.862Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Emby Products: Windows Problem Types: CWE-434 Description: CWE-434 Unrestricted Upload of File with Dangerous Type Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46385 State: PUBLISHED Published: 2025-07-20T14:42:32.213Z Last Updated: 2025-07-21T12:40:09.062Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Emby Products: Windows Problem Types: CWE-918 Description: CWE-918 Server-Side Request Forgery (SSRF) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46386 State: PUBLISHED Published: 2025-08-06T10:14:19.177Z Last Updated: 2025-08-06T13:23:44.180Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Emby Products: MediaBrowser Problem Types: CWE-639 Description: CWE-639 Authorization Bypass Through User-Controlled Key Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46387 State: PUBLISHED Published: 2025-08-06T10:43:49.456Z Last Updated: 2025-08-06T13:14:33.567Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Emby Products: MediaBrowser Problem Types: CWE-639 Description: CWE-639 Authorization Bypass Through User-Controlled Key Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46388 State: PUBLISHED Published: 2025-08-06T10:47:56.756Z Last Updated: 2025-08-06T13:14:02.258Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Emby Products: MediaBrowser Problem Types: CWE-200 Description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46389 State: PUBLISHED Published: 2025-08-06T10:51:32.533Z Last Updated: 2025-08-06T13:13:24.031Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Emby Products: MediaBrowser Problem Types: CWE-620 Description: CWE-620: Unverified Password Change Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46390 State: PUBLISHED Published: 2025-08-06T10:55:50.202Z Last Updated: 2025-08-06T13:12:30.252Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Emby Products: MediaBrowser Problem Types: CWE-204 Description: CWE-204: Observable Response Discrepancy Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46391 State: PUBLISHED Published: 2025-08-06T11:00:08.481Z Last Updated: 2025-08-06T13:11:29.960Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Emby Products: MediaBrowser Problem Types: CWE-284 Description: CWE-284: Improper Access Control Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-46392 State: PUBLISHED Published: 2025-05-09T09:34:38.854Z Last Updated: 2025-05-13T19:15:39.662Z Vendors: Apache Software Foundation Products: Apache Commons Configuration Problem Types: CWE-400 Description: Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that loa
Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2024-29131 - https://www.cve.org/CVERecord?id=CVE-2024-29133 - https://lists.apache.org/thread/y1pl0mn3opz6kwkm873zshj
E-2024-29131 - https://www.cve.org/CVERecord?id=CVE-2024-29133 - https://lists.apache.org/thread/y1pl0mn3opz6kwkm873zshjdxq3dwq5s
CVE ID: CVE-2025-46393 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-23T15:17:20.473Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-131 Description: In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels in an arbitrary order). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-44---2025-02-22 - https://github.com/ImageMagick/ImageMagick/commit/81ac8a0d2eb21739842ed18c48c7646b7eef65b8