Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3003 State: PUBLISHED Published: 2025-03-31T16:31:04.326Z Last Updated: 2025-03-31T18:19:01.444Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in ESAFENET CDG 3. Affected is an unknown function of the file /CDGServer3/UserAjax. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
acted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302052 - https://vuldb.com/?ctiid.302052 - https://vuldb.com/?submit.524230 - https://github.com/zian10001/cve/blob/main/sql.md
CVE ID: CVE-2025-3004 State: PUBLISHED Published: 2025-03-31T17:00:11.982Z Last Updated: 2025-03-31T18:21:15.623Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Sayski Products: ForestBlog Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /search. The manipulation of the argument keywords leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302053 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302053 - https://vuldb.com/?ctiid.302053 - https://vuldb.com/?submit.524484 - https://github.com/saysky/ForestBlog/issues/104 - https://github.com/saysky/ForestBlog/issues/104#issue-2937118096
CVE ID: CVE-2025-3005 State: PUBLISHED Published: 2025-03-31T17:31:04.807Z Last Updated: 2025-03-31T17:50:40.482Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Sayski Products: ForestBlog Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this issue is some unknown functionality of the component Friend Link Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302054 - https://vuldb.com/?ctiid.3020
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302054 - https://vuldb.com/?ctiid.302054 - https://vuldb.com/?submit.524485 - https://github.com/saysky/ForestBlog/issues/105 - https://github.com/saysky/ForestBlog/issues/105#issue-2937119331
CVE ID: CVE-2025-3006 State: PUBLISHED Published: 2025-03-31T18:00:09.838Z Last Updated: 2025-03-31T18:31:31.466Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: e-Diary Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /edit-category.php?id=8. The manipulation of the argument Category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302056 - https://vuldb.com/?ctiid.302056 - https://vuldb.com/?submit.524553 - https://github.com/yasuoz99/CVE-/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-3007 State: PUBLISHED Published: 2025-03-31T18:31:03.769Z Last Updated: 2025-04-01T13:56:20.757Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Novastar Products: CX40 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Novastar CX40 up to 2.44.0. It has been rated as critical. This issue affects the function getopt of the file /usr/nova/bin/netconfig of the component NetFilter Utility. The manipulation of the argument cmd/netmask/pipeout/nettask leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in
een disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302057 - https://vuldb.com/?ctiid.302057 - https://vuldb.com/?submit.524867
CVE ID: CVE-2025-3008 State: PUBLISHED Published: 2025-03-31T19:00:07.651Z Last Updated: 2025-04-01T13:51:44.117Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Novastar Products: CX40 Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical has been found in Novastar CX40 up to 2.44.0. Affected is the function system/popen of the file /usr/nova/bin/netconfig of the component NetFilter Utility. The manipulation leads to command injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment:
contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302058 - https://vuldb.com/?ctiid.302058 - https://vuldb.com/?submit.524869
CVE ID: CVE-2025-3009 State: PUBLISHED Published: 2025-03-31T19:31:04.937Z Last Updated: 2025-04-01T19:52:16.980Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Jinher Network Products: OA Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Jinher Network OA C6. Affected by this vulnerability is an unknown functionality of the file /C6/JHSoft.Web.NetDisk/NetDiskProperty.aspx. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302059 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302059 - https://vuldb.com/?ctiid.302059 - https://vuldb.com/?submit.524554 - https://github.com/Myoung-SA/cve/issues/1
CVE ID: CVE-2025-3010 State: PUBLISHED Published: 2025-03-31T20:00:12.256Z Last Updated: 2025-03-31T22:25:33.135Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Khronos Group Products: glslang Problem Types: CWE-476, CWE-404 Description: A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CIS
to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302060 - https://vuldb.com/?ctiid.302060 - https://vuldb.com/?submit.524561 - https://github.com/KhronosGroup/glslang/issues/3903 - https://github.com/KhronosGroup/glslang/issues/3903#issue-2927492534
CVE ID: CVE-2025-3011 State: PUBLISHED Published: 2025-03-31T03:30:48.092Z Last Updated: 2025-03-31T13:00:10.205Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PiExtract Products: SOOP-CLM Problem Types: CWE-89 Description: SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10048-d690c-1.html - https://www.twcert.org.tw/en/cp-139-10049-394bd-2.html
CVE ID: CVE-2025-3013 State: PUBLISHED Published: 2025-03-31T03:40:04.534Z Last Updated: 2025-03-31T15:55:30.308Z Vendors: FPT Software Products: NightWolf Penetration Platform Problem Types: CWE-285 Description: Insecure Direct Object References (IDOR) in access control in Customer Portal before 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bug.report.night-wolf.io/changelogs
CVE ID: CVE-2025-3014 State: PUBLISHED Published: 2025-03-31T03:48:12.504Z Last Updated: 2025-03-31T13:37:51.896Z Vendors: FPT Software Products: NightWolf Penetration Platform Problem Types: CWE-285 Description: Insecure Direct Object References (IDOR) in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bug.report.night-wolf.io/changelogs
CVE ID: CVE-2025-3015 State: PUBLISHED Published: 2025-03-31T20:31:06.477Z Last Updated: 2025-03-31T21:21:09.096Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-125, CWE-119 Description: A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgradi
d. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0 is able to address this issue. The patch is named 7c705fde418d68cca4e8eff56be01b2617b0d6fe. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302067 - https://vuldb.com/?ctiid.302067 - https://vuldb.com/?submit.524589 - https://github.com/assimp/assimp/issues/6021 - https://github.com/assimp/assimp/pull/6045 - https://github.com/assimp/assimp/issues/6021#issue-2877378829 - https://github.com/assimp/assimp/commit/7c705fde418d68cca4e8eff56be01b2617b0d6fe
CVE ID: CVE-2025-3016 State: PUBLISHED Published: 2025-03-31T21:00:10.538Z Last Updated: 2025-03-31T21:19:54.032Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-400, CWE-404 Description: A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. T
to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302068 - https://vuldb.com/?ctiid.302068 - https://vuldb.com/?submit.524593 - https://github.com/assimp/assimp/issues/6022 - https://github.com/assimp/assimp/pull/6046 - https://github.com/assimp/assimp/commit/5d2a7482312db2e866439a8c05a07ce1e718bed1
CVE ID: CVE-2025-3017 State: PUBLISHED Published: 2025-03-31T21:31:10.492Z Last Updated: 2025-04-01T20:06:50.627Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: TA-Lib Problem Types: CWE-787, CWE-119 Description: A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of the file src/tools/ta_regtest/ta_test_func/test_minmax.c of the component ta_regtest. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5879180e9070ec35d5
al host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5879180e9070ec35d52948f2f57519713256a0f1. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302069 - https://vuldb.com/?ctiid.302069 - https://vuldb.com/?submit.524603 - https://github.com/TA-Lib/ta-lib/issues/61 - https://github.com/TA-Lib/ta-lib/pull/62 - https://github.com/TA-Lib/ta-lib/issues/61#issue-2931609110 - https://github.com/TA-Lib/ta-lib/commit/5879180e9070ec35d52948f2f57519713256a0f1
CVE ID: CVE-2025-3018 State: PUBLISHED Published: 2025-03-31T22:00:07.678Z Last Updated: 2025-04-01T13:33:29.294Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Users.php?f=delete. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.30207
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302070 - https://vuldb.com/?ctiid.302070 - https://vuldb.com/?submit.524623 - https://github.com/csemfl/cve/blob/main/sql.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-3019 State: PUBLISHED Published: 2025-03-31T06:49:34.073Z Last Updated: 2025-03-31T12:45:32.162Z Vendors: KNIME Products: KNIME Business Hub Problem Types: CWE-79 Description: KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existing data. The issues are caused by a bug https://github.com/Baroshem/nuxt-security/issues/610 in the widely used nuxt-security module. There are no viable workarounds therefore we strongly recommend to update to
0 in the widely used nuxt-security module. There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub: * 1.13.3 or later * 1.12.4 or later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.knime.com/security/advisories#CVE-2025-3019
CVE ID: CVE-2025-3020 State: PUBLISHED Published: 2025-05-06T08:01:58.965Z Last Updated: 2025-05-06T13:52:19.548Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Wiesemann & Theis Products: ERP-Gateway 12x Digital Input, 6x Digital Relais, ERP-Gateway 2x Digital Input, 2x Digital Output, ERP-Gateway 2x Digital PoE, Web-Alarm 6x6 DigitalWeb-Alarm 6x6 Digital, Web-Count 6x Digital, Web-Graph Air Quality, Web-IO 12x Digital Input, 6x Digital Relais, Web-IO Analog-In/Out 2x 0/4..20mA PoE, Web-IO Digital 12xIn, 12xOut, Web-IO Digital 12xIn, 12xOut, 1xRS232, Web-IO Digital 2xIn, 2xOut, Web-IO Digital Logger 6xIn, 6xOut, Web-Thermograph 2x, Web-Thermograph 8x, Web-
ut, 1xRS232, Web-IO Digital 2xIn, 2xOut, Web-IO Digital Logger 6xIn, 6xOut, Web-Thermograph 2x, Web-Thermograph 8x, Web-Thermograph NTC, Web-Thermograph NTC PoE, Web-Thermograph Pt100 / Pt1000, Web-Thermograph Pt100 / Pt1000 PoE, Web-Thermograph Relais, Web-Thermo-Hygrobarograph, Web-Thermo-Hygrograph Problem Types: CWE-79 Description: An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2025-032
CVE ID: CVE-2025-3021 State: PUBLISHED Published: 2025-03-31T10:12:45.843Z Last Updated: 2025-03-31T12:40:09.975Z Vendors: e-solutions Products: e-management Problem Types: CWE-22 Description: Path Traversal vulnerability in e-solutions e-management. This vulnerability could allow an attacker to access confidential files outside the expected scope via the ‘file’ parameter in the /downloadReport.php endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-e-management-e-solutions
CVE ID: CVE-2025-3022 State: PUBLISHED Published: 2025-03-31T11:09:17.106Z Last Updated: 2025-03-31T12:03:56.551Z Vendors: e-solutions Products: e-management Problem Types: CWE-78 Description: Os command injection vulnerability in e-solutions e-management. This vulnerability allows an attacker to execute arbitrary commands on the server via the ‘client’ parameter in the /data/apache/e-management/api/api3.php endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-e-management-e-solutions
CVE ID: CVE-2025-3023 State: REJECTED Published: N/A Last Updated: 2025-04-09T22:15:58.040Z Description: No description available.
CVE ID: CVE-2025-3025 State: PUBLISHED Published: 2025-09-15T12:20:21.094Z Last Updated: 2025-09-16T03:55:18.604Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Gen Digital Products: CCleaner Problem Types: CWE-552 Description: Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploiting insecure file delete operations. Reported in CCleaner v. 6.33.11465. This issue affects CCleaner: before < 6.36.11508. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE ID: CVE-2025-3026 State: PUBLISHED Published: 2025-03-31T10:30:24.424Z Last Updated: 2025-03-31T12:37:40.038Z Vendors: PrimeKey Solutions AB Products: EJBCA Problem Types: CWE-74 Description: The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is possible to manipulate the generated links and thus redirect the client to a different base URL. In this way, an attacker could insert his own server for the client to send HTTP requests, provided he succeeds in exploiting it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/mu
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ejbca
CVE ID: CVE-2025-3027 State: PUBLISHED Published: 2025-03-31T10:31:51.577Z Last Updated: 2025-03-31T12:33:15.293Z Vendors: PrimeKey Solutions AB Products: EJBCA Problem Types: CWE-601 Description: The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server fails to find the requested file and redirects to an external page. This vulnerability could allow users to be redirected to potentially malicious external sites, which can be exploited for phishing or other social engineering attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notice
ng attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ejbca
CVE ID: CVE-2025-3028 State: PUBLISHED Published: 2025-04-01T12:28:58.303Z Last Updated: 2025-11-03T19:46:48.122Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free triggered by XSLTProcessor Description: JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability affects Firefox < 137, Firefox ESR < 115.22, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1941002 - https://www.mozilla.org/security/advisories/mfsa2025-20/ - https://www.m
/bugzilla.mozilla.org/show_bug.cgi?id=1941002 - https://www.mozilla.org/security/advisories/mfsa2025-20/ - https://www.mozilla.org/security/advisories/mfsa2025-21/ - https://www.mozilla.org/security/advisories/mfsa2025-22/ - https://www.mozilla.org/security/advisories/mfsa2025-23/ - https://www.mozilla.org/security/advisories/mfsa2025-24/
CVE ID: CVE-2025-3029 State: PUBLISHED Published: 2025-04-01T12:28:59.386Z Last Updated: 2025-11-03T19:46:49.584Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: URL Bar Spoofing via non-BMP Unicode characters Description: A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1952213 - https://www.mozilla.org/security/advisories/mfsa2025-20
rences: - https://bugzilla.mozilla.org/show_bug.cgi?id=1952213 - https://www.mozilla.org/security/advisories/mfsa2025-20/ - https://www.mozilla.org/security/advisories/mfsa2025-22/ - https://www.mozilla.org/security/advisories/mfsa2025-23/ - https://www.mozilla.org/security/advisories/mfsa2025-24/
CVE ID: CVE-2025-3030 State: PUBLISHED Published: 2025-04-01T12:29:00.640Z Last Updated: 2025-11-03T19:46:50.996Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 Description: Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9. Additional Analyst Notes: - CIS
affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1850615%2C1932468%2C1942551%2C1951017%2C1951494 - https://www.mozilla.org/security/advisories/mfsa2025-20/ - https://www.mozilla.org/security/advisories/mfsa2025-22/ - https://www.mozilla.org/security/advisories/mfsa2025-23/ - https://www.mozilla.org/security/advisories/mfsa2025-24/
CVE ID: CVE-2025-3031 State: PUBLISHED Published: 2025-04-01T12:29:02.220Z Last Updated: 2025-04-01T18:38:18.743Z Vendors: Mozilla Products: Firefox, Thunderbird Problem Types: JIT optimization bug with different stack slot sizes Description: An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability affects Firefox < 137 and Thunderbird < 137. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1947141 - https://www.mozilla.org/security/advisories/mfsa2025-20/ - https://www.mozilla.org/security/advisories/mfsa2025-23/