Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48002 State: PUBLISHED Published: 2025-07-08T16:57:34.902Z Last Updated: 2025-08-23T00:39:54.851Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-190, CWE-125 Description: Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to disclose information over an adjacent network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48002
CVE ID: CVE-2025-48003 State: PUBLISHED Published: 2025-07-08T16:57:35.495Z Last Updated: 2025-08-23T00:39:55.349Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-693 Description: Protection mechanism failure in Window
Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-693 Description: Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48003
CVE ID: CVE-2025-48004 State: PUBLISHED Published: 2025-10-14T17:00:06.255Z Last Updated: 2025-11-22T04:08:15.934Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
unauthorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48004
CVE ID: CVE-2025-48005 State: PUBLISHED Published: 2025-08-25T13:53:34.410Z Last Updated: 2025-11-03T18:12:57.558Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the RHS2000 parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted RHS2000 file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerab
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2240
CVE ID: CVE-2025-48006 State: PUBLISHED Published: 2025-09-29T07:40:45.307Z Last Updated: 2025-09-29T11:44:58.304Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Saison Technology Co.,Ltd. Products: DataSpider Servista Problem Types: CWE-611 Description: Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request is processed, arbitrary files on the file system where the server application for the product is installed may be read, or a denial-of-service (DoS) condition may occur. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hulft.com/application/files
tion may occur. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hulft.com/application/files/1217/5885/0217/information_20250926.pdf - https://jvn.jp/en/jp/JVN23423519/
CVE ID: CVE-2025-48007 State: PUBLISHED Published: 2025-09-19T13:09:47.243Z Last Updated: 2025-09-19T14:03:52.710Z Vendors: Hallo Welt! GmbH Products: BlueSpice Problem Types: CWE-116 Description: Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05
CVE ID: CVE-2025-48008 State: PUBLISHED Published: 2025-10-15T13:55:44.957Z Last Updated: 2025-10-16T03:56:28.384Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next SPK, BIG-IP Next CNF Problem Types: CWE-416 Description: When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/art
EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000150614
CVE ID: CVE-2025-48009 State: PUBLISHED Published: 2025-05-21T16:22:45.494Z Last Updated: 2025-05-21T16:46:08.881Z Vendors: Drupal Products: Single Content Sync Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-060
CVE ID: CVE-2025-48010 State: PUBLISHED Published: 2025-05-21T16:23:30.829Z Last Updated: 2025-05-21T16:47:12.092Z Vendors: Drupal Products: One Time Password Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-061
CVE ID: CVE-2025-48011 State: PUBLISHED Published: 2025-05-21T16:23:46.543Z Last Updated: 2025-05-21T16:48:46.286Z Vendors: Drupal Products: One Time Password Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-062
CVE ID: CVE-2025-48012 State: PUBLISHED Published: 2025-05-21T16:24:07.429Z Last Updated: 2025-05-21T16:49:32.969Z Vendors: Drupal Products: One Time Password Problem Types: CWE-294 Description: Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-063
CVE ID: CVE-2025-48013 State: PUBLISHED Published: 2025-06-11T14:20:06.254Z Last Updated: 2025-06-11T15:26:57.249Z Vendors: Drupal Products: Quick Node Block Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-065
CVE ID: CVE-2025-48014 State: PUBLISHED Published: 2025-05-20T15:10:54.624Z Last Updated: 2025-05-20T15:55:46.002Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Schweitzer Engineering Laboratories Products: SEL-5056 Software-Defined Network Flow Controller Problem Types: CWE-307 Description: Password guessing limits could be bypassed when using LDAP authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://selinc.com/products/software/latest-software-versions/
CVE ID: CVE-2025-48015 State: PUBLISHED Published: 2025-05-20T15:11:53.851Z Last Updated: 2025-05-20T15:55:28.762Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Schweitzer Engineering Laboratories Products: SEL-5056 Software-Defined Network Flow Controller Problem Types: CWE-204 Description: Failed login response could be different depending on whether the username was local or central. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://selinc.com/products/software/latest-software-versions/
CVE ID: CVE-2025-48016 State: PUBLISHED Published: 2025-05-20T15:12:20.861Z Last Updated: 2025-05-20T15:55:05.750Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Schweitzer Engineering Laboratories Products: SEL-5056 Software-Defined Network Flow Controller Problem Types: CWE-799 Description: OpenFlow discovery protocol can exhaust resources because it is not rate limited Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://selinc.com/products/software/latest-software-versions/
CVE ID: CVE-2025-48017 State: PUBLISHED Published: 2025-05-20T15:14:02.728Z Last Updated: 2025-05-20T15:54:26.743Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Schweitzer Engineering Laboratories Products: SEL-5056 Software-Defined Network Flow Controller Problem Types: CWE-22 Description: Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://selinc.com/products/software/latest-software-versions/
CVE ID: CVE-2025-48018 State: PUBLISHED Published: 2025-05-20T15:14:36.200Z Last Updated: 2025-05-20T15:43:44.337Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Schweitzer Engineering Laboratories Products: SEL-5030 acSELerator QuickSet Software Problem Types: CWE-502 Description: An authenticated user can modify application state data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://selinc.com/products/software/latest-software-versions/
CVE ID: CVE-2025-48024 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-15T15:28:53.689Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: BlueWave Products: Checkmate Problem Types: CWE-497 Description: In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bluewave-labs/Checkmate/pull/2227 - https://github.com/bluewave-labs/Checkmate/commit/7a855ef47adf2265121c236097059c7c6555fd7c - https://github.com/bluewave-labs/Checkmate/commit/91c2f7f0d5106bdfd4a0ff2c14b7e44acc3ba
df2265121c236097059c7c6555fd7c - https://github.com/bluewave-labs/Checkmate/commit/91c2f7f0d5106bdfd4a0ff2c14b7e44acc3baee6 - https://github.com/bluewave-labs/Checkmate/commit/36d78a9aa4ed607ca1bd2b5fdaca5a3927b2d287 - https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-jjmg-cjr4-439m
CVE ID: CVE-2025-48025 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-21T19:49:57.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000, there is an improper access control vulnerability related to a log file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-48025/
CVE ID: CVE-2025-48026 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-24T17:59:30.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow an attacker to read files from the underlying OS and obtain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/mitel-product-security-advisory-misa-2025-0005
CVE ID: CVE-2025-48027 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-15T14:51:34.307Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: MutonUfoAI Products: pGina.Fork Problem Types: CWE-290 Description: The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kwburns/CVE/blob/main/pGina.Fork/3.9.9.12/README.md - https://github.com/MutonUfoAI/pgina/blob/1922de0fe27492c09d2f188c2c7e54a4b364bbad/Plugins/HttpAuth/HttpAuth/Settings.cs#L44
CVE ID: CVE-2025-48038 State: PUBLISHED Published: 2025-09-11T08:13:04.030Z Last Updated: 2025-09-12T03:19:08.401Z Vendors: Erlang Products: OTP Problem Types: CWE-770, CWE-400 Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-pvj7
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-pvj7-9652-7h9r - https://www.erlang.org/doc/system/versions.html#order-of-versions - https://github.com/erlang/otp/pull/10156 - https://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a - https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f
CVE ID: CVE-2025-48039 State: PUBLISHED Published: 2025-09-11T08:13:36.878Z Last Updated: 2025-09-12T03:19:09.907Z Vendors: Erlang Products: OTP Problem Types: CWE-770, CWE-400 Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-rr5p
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-rr5p-6856-j7h8 - https://www.erlang.org/doc/system/versions.html#order-of-versions - https://github.com/erlang/otp/pull/10155 - https://github.com/erlang/otp/commit/c242e6458967e9514bea351814151695807a54ac - https://github.com/erlang/otp/commit/043ee3c943e2977c1acdd740ad13992fd60b6bf0
CVE ID: CVE-2025-48040 State: PUBLISHED Published: 2025-09-11T08:14:19.671Z Last Updated: 2025-09-12T03:19:04.361Z Vendors: Erlang Products: OTP Problem Types: CWE-400, CWE-770 Description: Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-h7rg-6rjg-4cph - https://www.erlang.o
Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-h7rg-6rjg-4cph - https://www.erlang.org/doc/system/versions.html#order-of-versions - https://github.com/erlang/otp/pull/10162 - https://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a - https://github.com/erlang/otp/commit/548f1295d86d0803da884db8685cc16d461d0d5a
CVE ID: CVE-2025-48041 State: PUBLISHED Published: 2025-09-11T08:14:20.508Z Last Updated: 2025-09-12T03:19:05.890Z Vendors: Erlang Products: OTP Problem Types: CWE-770, CWE-400 Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3 - h
Notes: - CISA ADP Vulnrichment: References: - https://github.com/erlang/otp/security/advisories/GHSA-79c4-cvv7-4qm3 - https://www.erlang.org/doc/system/versions.html#order-of-versions - https://github.com/erlang/otp/pull/10157 - https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288 - https://github.com/erlang/otp/commit/d49efa2d4fa9e6f7ee658719cd76ffe7a33c2401
CVE ID: CVE-2025-48042 State: PUBLISHED Published: 2025-09-07T16:01:01.470Z Last Updated: 2025-09-09T03:24:04.033Z Vendors: ash-project Products: ash Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This vulnerability is associated with program files lib/ash/actions/create/bulk.ex, lib/ash/actions/destroy/bulk.ex, lib/ash/actions/update/bulk.ex and program routines 'Elixir.Ash.Actions.Create.Bulk':run/5, 'Elixir.Ash.Actions.Destroy.Bulk':run/6, 'Elixir.Ash.Actions.Update.Bulk:run'/6. This issue affects ash: from pkg:hex/ash before pkg:hex/ash@3.5.39, before 3.5.39, before 5d1b
tions.Update.Bulk:run'/6. This issue affects ash: from pkg:hex/ash before pkg:hex/ash@3.5.39, before 3.5.39, before 5d1b6a5d00771fd468a509778637527b5218be9a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ash-project/ash/security/advisories/GHSA-jj4j-x5ww-cwh9 - https://github.com/ash-project/ash/commit/5d1b6a5d00771fd468a509778637527b5218be9a
CVE ID: CVE-2025-48043 State: PUBLISHED Published: 2025-10-10T15:57:29.225Z Last Updated: 2025-10-11T03:18:31.221Z Vendors: ash-project Products: ash Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/authorizer/authorizer.ex and program routines 'Elixir.Ash.Policy.Authorizer':strict_filters/2. This issue affects ash: from pkg:hex/ash@0 before pkg:hex/ash@3.6.2, before 3.6.2, before 66d81300065b970da0d2f4528354835d2418c7ae. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ash-project/ash/security/advisories/GHSA-7r7f-9xp
alyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ash-project/ash/security/advisories/GHSA-7r7f-9xpj-jmr7 - https://github.com/ash-project/ash/commit/66d81300065b970da0d2f4528354835d2418c7ae
CVE ID: CVE-2025-48044 State: PUBLISHED Published: 2025-10-17T13:52:53.644Z Last Updated: 2025-10-21T03:28:19.832Z Vendors: ash-project Products: ash Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/policy.ex and program routines 'Elixir.Ash.Policy.Policy':expression/2. This issue affects ash: from pkg:hex/ash@3.6.3 before pkg:hex/ash@3.7.1, from 3.6.3 before 3.7.1, from 79749c2685ea031ebb2de8cf60cc5edced6a8dd0 before 8b83efa225f657bfc3656ad8ee8485f9b2de923d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ash-project
3656ad8ee8485f9b2de923d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ash-project/ash/security/advisories/GHSA-pcxq-fjp3-r752 - https://github.com/ash-project/ash/commit/8b83efa225f657bfc3656ad8ee8485f9b2de923d
CVE ID: CVE-2025-48045 State: PUBLISHED Published: 2025-05-29T12:29:33.475Z Last Updated: 2025-05-29T13:17:57.088Z Vendors: MICI Network Co. Ltd. Products: NetFax Server Problem Types: CWE-201 Description: An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed/
CVE ID: CVE-2025-48046 State: PUBLISHED Published: 2025-05-29T12:33:27.734Z Last Updated: 2025-09-05T08:30:09.250Z Vendors: MICI Network Co. Ltd. Products: NetFax Server Problem Types: CWE-256 Description: An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed/
CVE ID: CVE-2025-48047 State: PUBLISHED Published: 2025-05-29T12:36:13.667Z Last Updated: 2025-05-29T13:15:14.119Z Vendors: MICI Network Co. Ltd. Products: NetFax Server Problem Types: CWE-78 Description: An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2025/05/29/cve-2025-48045-cve-2025-48046-cve-2025-48047-mici-netfax-server-product-vulnerabilities-not-fixed/
CVE ID: CVE-2025-48050 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-16T14:37:43.180Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: Cure53 Products: DOMPurify Problem Types: CWE-24 Description: In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://g
rver if needed and must be manually started." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/odaysec/advisory/blob/main/cure53/DOMPurify/writeup.md - https://github.com/cure53/DOMPurify/pull/1101 - https://github.com/cure53/DOMPurify/commit/6bc6d60e49256f27a4022181b7d8a5b0721fd534 - https://security.snyk.io/vuln/SNYK-JS-DOMPURIFY-10176060