Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54588 State: PUBLISHED Published: 2025-09-02T23:39:07.429Z Last Updated: 2025-09-03T20:27:46.781Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-416 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending r
on, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-g
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw - https://github.com/envoyproxy/envoy/releases/tag/v1.34.5 - https://github.com/envoyproxy/envoy/releases/tag/v1.35.1
CVE ID: CVE-2025-54589 State: PUBLISHED Published: 2025-07-31T13:48:41.615Z Last Updated: 2025-07-31T14:12:45.463Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: 9001 Products: copyparty Problem Types: CWE-79, CWE-80 Description: Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users
owing for reflected Cross-Site Scripting (XSS) and can be exploited against both authenticated and unauthenticated users. This is fixed in version 1.18.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/9001/copyparty/security/advisories/GHSA-8mx2-rjh8-q3jq - https://github.com/9001/copyparty/commit/a8705e611d05eeb22be5d3d7d9ab5c020fe54c62 - https://github.com/9001/copyparty/releases/tag/v1.18.7
CVE ID: CVE-2025-54590 State: PUBLISHED Published: 2025-08-01T18:03:41.619Z Last Updated: 2025-08-01T18:39:35.748Z Vendors: silverbucket Products: webfinger.js Problem Types: CWE-918 Description: webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accepts user addresses for account checking. However, the ActivityPub specification requires preventing access to localhost services in production. This library does not prevent localhost access, only checking for hosts that start with "localhost" and end with a port. Users can exploit this by creating servers that send GET requests with controlled
with "localhost" and end with a port. Users can exploit this by creating servers that send GET requests with controlled host, path, and port parameters to query services on the instance's host or local network, enabling blind SSRF attacks. This is fixed in version 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/silverbucket/webfinger.js/security/advisories/GHSA-8xq3-w9fx-74rv - https://github.com/silverbucket/webfinger.js/commit/b5f2f2c957297d25f4d76072963fccaee2e3095a - https://github.com/silverbucket/webfinger.js/releases/tag/v2.8.1
CVE ID: CVE-2025-54591 State: PUBLISHED Published: 2025-09-29T21:00:50.080Z Last Updated: 2025-09-30T15:02:37.861Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-284 Description: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a defined firstAction() method with an override to make sure that every action requires access. If one doesn't, then every action has to check fo
ethod with an override to make sure that every action requires access. If one doesn't, then every action has to check for access manually, and certain endpoints use neither the firstAction() method, or do they perform a manual access check. This issue is fixed in version 1.27.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jf4v-f8p2-8xvq - https://github.com/FreshRSS/FreshRSS/pull/7768 - https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0
CVE ID: CVE-2025-54592 State: PUBLISHED Published: 2025-09-29T21:23:43.903Z Last Updated: 2025-09-30T13:42:14.955Z Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-613 Description: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/F
s issue is fixed in version 1.27.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-42v4-65f8-5wgr - https://github.com/FreshRSS/FreshRSS/pull/7762 - https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0
CVE ID: CVE-2025-54593 State: PUBLISHED Published: 2025-08-01T18:04:40.265Z Last Updated: 2025-08-01T18:32:59.897Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-94 Description: FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an update. After successfully executing code, user data including hashed passwords can be exfiltrated, the instance can be defaced when file permissions allow. Malicious code can be inserte
hed passwords can be exfiltrated, the instance can be defaced when file permissions allow. Malicious code can be inserted into the instance to steal plaintext passwords, among others. This is fixed in version 1.26.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jcww-48g9-wf57 - https://github.com/FreshRSS/FreshRSS/pull/7477 - https://github.com/FreshRSS/FreshRSS/commit/dbdadbb4107878d9233f635c31a88afe45957101 - https://github.com/FreshRSS/FreshRSS/releases/tag/1.26.2
CVE ID: CVE-2025-54594 State: PUBLISHED Published: 2025-08-05T23:31:53.399Z Last Updated: 2025-08-06T20:29:56.111Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: callstackincubator Products: react-native-bottom-tabs Problem Types: CWE-269, CWE-94 Description: react-native-bottom-tabs is a library of Native Bottom Tabs for React Native. In versions 0.9.2 and below, the github/workflows/release-canary.yml GitHub Actions repository workflow improperly used the pull_request_target event trigger, which allowed for untrusted code from a forked pull request to be executed in a privileged context. An attacker could create a pull request containing a malicious pre
pull request to be executed in a privileged context. An attacker could create a pull request containing a malicious preinstall script in the package.json file and then trigger the vulnerable workflow by posting a specific comment (!canary). This allowed for arbitrary code execution, leading to the exfiltration of sensitive secrets such as GITHUB_TOKEN and NPM_TOKEN, and could have allowed an attacker to push malicious code to the repository or publish compromised packages to the NPM registry. There is a remediation commit which removes github/workflows/release-canary.yml, but a version with this fix has yet to be released. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
but a version with this fix has yet to be released. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/callstackincubator/react-native-bottom-tabs/security/advisories/GHSA-588g-38p4-gr6x - https://github.com/callstackincubator/react-native-bottom-tabs/commit/9e1c9c61d742c435ac5e0901b7e0c9249b9fc70c - https://callstack.notion.site/Post-Incident-Security-Measures-GitHub-Actions-Workflow-Vulnerability-2405d027c0f8804ab7f7cdfb43366a31
CVE ID: CVE-2025-54595 State: PUBLISHED Published: 2025-08-01T18:06:23.948Z Last Updated: 2025-08-01T18:21:50.407Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: alienator88 Products: Pearcleaner Problem Types: CWE-78, CWE-269 Description: Pearcleaner is a free, source-available and fair-code licensed mac app cleaner. The PearcleanerHelper is a privileged helper tool bundled with the Pearcleaner application. It is registered and activated only after the user approves a system prompt to allow privileged operations. Upon approval, the helper is configured as a LaunchDaemon and runs with root privileges. In versions 4.4.0 through 4.5.1, the helper registers an X
s configured as a LaunchDaemon and runs with root privileges. In versions 4.4.0 through 4.5.1, the helper registers an XPC service (com.alienator88.Pearcleaner.PearcleanerHelper) and accepts unauthenticated connections from any local process. It exposes a method that executes arbitrary shell commands. This allows any local unprivileged user to escalate privileges to root once the helper is approved and active. This issue is fixed in version 4.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/alienator88/Pearcleaner/security/advisories/GHSA-gr2j-65fh-8pvc - https://github.com/alienator88/Pearcleaner/issues/278 - https://github.com/alienator88/Pearcleaner
GHSA-gr2j-65fh-8pvc - https://github.com/alienator88/Pearcleaner/issues/278 - https://github.com/alienator88/Pearcleaner/commit/69afadfa95791cb998118ca35c227007b230b984 - https://github.com/alienator88/Pearcleaner/releases/tag/4.5.2
CVE ID: CVE-2025-54596 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T18:26:01.691Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Abnormal AI Products: Abnormal Security Problem Types: CWE-863 Description: Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugcrowd.com/disclosures/b2406123-c02d-47cf-bcf1-8af57e1de526/no-rbac-validation-on-api-requests-user-management
CVE ID: CVE-2025-54597 State: PUBLISHED Published: 2025-07-27T00:00:00.000Z Last Updated: 2025-07-28T18:55:34.203Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: LinuxServer Products: Heimdall Problem Types: CWE-79 Description: LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/linuxserver/Heimdall/commit/d1a96dd752ba30dc56380400dd2587d8abb8e9d1 - https://github.com/linuxserver/Heimdall/compare/v2.7.2...v2.7.3
CVE ID: CVE-2025-54598 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T18:51:20.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/delete/ URI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bevy.com/b/events-and-groups - https://gist.github.com/deep1chil/057b63e62d4db6158a3ee28995fc246f - https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43985.txt
CVE ID: CVE-2025-54599 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:37:19.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bevy.com/b/events-and-groups - https://www.youtube.com/watch?v=wbmIvA09Ra8 - https://gist.github.com/deep1chil
- https://bevy.com/b/events-and-groups - https://www.youtube.com/watch?v=wbmIvA09Ra8 - https://gist.github.com/deep1chil/558e8da919690a634bec684e7c4d0ffe
CVE ID: CVE-2025-54603 State: PUBLISHED Published: 2025-10-14T00:00:00.000Z Last Updated: 2025-10-14T19:08:49.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation of existing OIDC users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://claroty.com - https://claroty.com/product-security/oidc-configurations-in-claroty-secure-access
CVE ID: CVE-2025-54604 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T14:08:44.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://github.com/bitcoin/bitcoin/releases - https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-54604/
CVE ID: CVE-2025-54605 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T14:06:18.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://github.com/bitcoin/bitcoin/releases - https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-54605/
CVE ID: CVE-2025-54606 State: PUBLISHED Published: 2025-08-06T01:09:07.879Z Last Updated: 2025-08-06T15:41:12.703Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-840 Description: Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54607 State: PUBLISHED Published: 2025-08-06T01:10:31.063Z Last Updated: 2025-08-06T15:41:06.254Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-295 Description: Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54608 State: PUBLISHED Published: 2025-08-06T01:12:53.484Z Last Updated: 2025-08-06T15:40:59.991Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-264 Description: Vulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: Successful exploitation of this vulnerability may cause device screen orientation to be arbitrarily set. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54609 State: PUBLISHED Published: 2025-08-06T01:14:24.271Z Last Updated: 2025-08-06T15:40:54.965Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-125 Description: Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54610 State: PUBLISHED Published: 2025-08-06T01:15:54.155Z Last Updated: 2025-08-06T15:40:49.631Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-129 Description: Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54611 State: PUBLISHED Published: 2025-08-06T01:18:18.740Z Last Updated: 2025-08-06T13:49:45.364Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-840 Description: EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54612 State: PUBLISHED Published: 2025-08-06T01:21:06.271Z Last Updated: 2025-08-06T13:48:26.134Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-664 Description: Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54613 State: PUBLISHED Published: 2025-08-06T01:22:10.905Z Last Updated: 2025-08-06T17:58:21.381Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-664 Description: Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54614 State: PUBLISHED Published: 2025-08-06T01:24:08.000Z Last Updated: 2025-08-06T17:57:54.715Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-20 Description: Input verification vulnerability in the home screen module. Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54615 State: PUBLISHED Published: 2025-08-06T01:26:36.584Z Last Updated: 2025-08-06T20:34:16.567Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-200 Description: Vulnerability of insufficient information protection in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54616 State: PUBLISHED Published: 2025-08-06T01:27:33.234Z Last Updated: 2025-08-06T20:34:02.194Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-787 Description: Out-of-bounds array access vulnerability in the ArkUI framework. Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54617 State: PUBLISHED Published: 2025-08-06T01:28:57.064Z Last Updated: 2025-08-06T13:48:01.561Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-121 Description: Stack-based buffer overflow vulnerability in the dms_fwk module. Impact: Successful exploitation of this vulnerability can cause RCE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54618 State: PUBLISHED Published: 2025-08-06T01:32:16.986Z Last Updated: 2025-08-06T20:33:20.809Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-275 Description: Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54619 State: PUBLISHED Published: 2025-08-06T01:34:38.207Z Last Updated: 2025-08-06T20:31:42.455Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-664 Description: Iterator failure issue in the multi-mode input module. Impact: Successful exploitation of this vulnerability may cause iterator failures and affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54620 State: PUBLISHED Published: 2025-08-06T01:35:52.999Z Last Updated: 2025-08-06T20:29:32.777Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-502 Description: Deserialization vulnerability of untrusted data in the ability module. Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54621 State: PUBLISHED Published: 2025-08-06T01:37:57.772Z Last Updated: 2025-08-06T20:27:35.897Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-664 Description: Iterator failure issue in the WantAgent module. Impact: Successful exploitation of this vulnerability may cause memory release failures. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/
CVE ID: CVE-2025-54622 State: PUBLISHED Published: 2025-08-06T01:39:04.798Z Last Updated: 2025-08-06T20:25:32.332Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-305 Description: Binding authentication bypass vulnerability in the devicemanager module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/8/