Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-32053 State: PUBLISHED Published: 2025-04-03T13:37:39.054Z Last Updated: 2025-11-06T23:08:09.589Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-126 Description: A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.
. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:4440 - https://access.redhat.com/errata/RHSA-2025:4508 - https://access.redhat.com/errata/RHSA-2025:4560 - https://access.redhat.com/errata/RHSA-2025:4568 - https://access.redhat.com/errata/RHSA-2025:7436 - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/security/cve/CVE-2025-32053 - https://bugzilla.redhat.com/show_bug.cgi?id=2357070
CVE ID: CVE-2025-32054 State: PUBLISHED Published: 2025-04-03T16:48:35.468Z Last Updated: 2025-04-03T18:03:21.211Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: IntelliJ IDEA Problem Types: CWE-532 Description: In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-32067 State: PUBLISHED Published: 2025-04-11T16:21:33.513Z Last Updated: 2025-07-07T14:33:32.461Z Vendors: The Wikimedia Foundation Products: Mediawiki - Growth Experiments Extension Problem Types: CWE-20 Description: Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Growth Experiments Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T386963 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/1122163
CVE ID: CVE-2025-32068 State: PUBLISHED Published: 2025-04-11T16:21:11.981Z Last Updated: 2025-07-07T14:28:21.088Z Vendors: The Wikimedia Foundation Products: Mediawiki - OAuth Extension Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T336113 - https://gerrit.wikimedia.org/r/q/I27b61af2cdfb862a42432e7a87b863033d540cfc
CVE ID: CVE-2025-32069 State: PUBLISHED Published: 2025-04-11T16:20:48.994Z Last Updated: 2025-07-07T14:09:11.663Z Vendors: The Wikimedia Foundation Products: Mediawiki - Wikibase Media Info Extension Problem Types: CWE-20 Description: Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Media Info Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T387691 - https://gerrit.wikimedia.org/r/q/Ie969a8cfeab0d4457417773fa884e271968e5657
CVE ID: CVE-2025-32070 State: PUBLISHED Published: 2025-04-11T16:20:24.436Z Last Updated: 2025-07-07T14:31:48.651Z Vendors: The Wikimedia Foundation Products: Mediawiki - AJAX Poll Extension Problem Types: CWE-20 Description: Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T389590 - https://gerrit.wikimedia.org/r/q/Ib59c59b2cd36928ab200149c851e2bfcf5cf920c
CVE ID: CVE-2025-32071 State: PUBLISHED Published: 2025-04-11T16:19:46.163Z Last Updated: 2025-07-07T14:17:52.085Z Vendors: The Wikimedia Foundation Products: Mediawiki - Wikidata Extension Problem Types: CWE-20 Description: Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message via ImageHandler::getDimensionsString()This issue affects Mediawiki - Wikidata Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T389369 - https://gerrit.wikimedia.org/r/q/Iac1f1c27054bfd1a4a4251281ab8c72f59204a90
CVE ID: CVE-2025-32072 State: PUBLISHED Published: 2025-04-11T16:23:12.186Z Last Updated: 2025-11-03T19:53:18.332Z Vendors: The Wikimedia Foundation Products: Mediawiki Core - Feed Utils Problem Types: CWE-116 Description: Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1120134 - https://phabricator.wikimedia.org/T386175
CVE ID: CVE-2025-32073 State: PUBLISHED Published: 2025-04-11T16:22:47.728Z Last Updated: 2025-07-07T14:09:51.465Z Vendors: The Wikimedia Foundation Products: Mediawiki - HTML Tags Problem Types: CWE-20 Description: Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML Tags: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T386337 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/HTMLTags/+/1121056
CVE ID: CVE-2025-32074 State: PUBLISHED Published: 2025-04-11T16:22:23.418Z Last Updated: 2025-07-07T14:29:03.605Z Vendors: The Wikimedia Foundation Products: Mediawiki - Confirm Account Extension Problem Types: CWE-116 Description: Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Confirm Account Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T386908 - https://gerrit.wikimedia.org/r/q/I86f47103ffb78c671890b44ccd59fcff6613975f
CVE ID: CVE-2025-32075 State: PUBLISHED Published: 2025-04-11T16:21:59.701Z Last Updated: 2025-04-11T17:34:19.348Z Vendors: The Wikimedia Foundation Products: Mediawiki - Tabs Extension Problem Types: CWE-20 Description: Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T386887 - https://gerrit.wikimedia.org/r/q/I03bec9528ee3ed05f35187458cde4e2fc4b51092
CVE ID: CVE-2025-32076 State: PUBLISHED Published: 2025-04-11T16:23:36.096Z Last Updated: 2025-04-11T16:39:21.649Z Vendors: The Wikimedia Foundation Products: Mediawiki - Visual Data Extension Problem Types: CWE-20 Description: Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/VisualData/+/1121732 - https://phabricator.wikimedia.org/T385935
CVE ID: CVE-2025-32077 State: PUBLISHED Published: 2025-04-11T16:25:06.597Z Last Updated: 2025-04-11T16:33:20.827Z Vendors: The Wikimedia Foundation Products: Mediawiki - Extension:SimpleCalendar Problem Types: CWE-20 Description: Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Extension:SimpleCalendar: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T383472 - https://gerrit.wikimedia.org/r/q/Ic5b5ce8f7791026eff1aafffb32a68f3aab119be
CVE ID: CVE-2025-32078 State: PUBLISHED Published: 2025-04-11T16:24:46.164Z Last Updated: 2025-04-11T16:34:20.203Z Vendors: The Wikimedia Foundation Products: Mediawiki - Version Compare Extension Problem Types: CWE-116 Description: Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T384269 - https://gerrit.wikimedia.org/r/q/If901b3b98e615e1a4f4034d932d2d592000b51d0
CVE ID: CVE-2025-32079 State: PUBLISHED Published: 2025-04-11T16:24:21.988Z Last Updated: 2025-07-07T14:17:08.578Z Vendors: The Wikimedia Foundation Products: Mediawiki - GrowthExperiments Problem Types: CWE-20 Description: Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperiments: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/1114020 - https://phabricator.wikimedia.org/T384244
CVE ID: CVE-2025-32080 State: PUBLISHED Published: 2025-04-11T16:24:00.100Z Last Updated: 2025-04-11T16:36:40.447Z Vendors: The Wikimedia Foundation Products: Mediawiki - Mobile Frontend Extension Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T366402 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MobileFrontend/+/1123392 - https://gerrit.wikim
edia.org/T366402 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MobileFrontend/+/1123392 - https://gerrit.wikimedia.org/r/q/Ia5c3be79db37240acbaa630834e430ec3147e61c
CVE ID: CVE-2025-32086 State: PUBLISHED Published: 2025-08-12T16:59:38.650Z Last Updated: 2025-11-03T17:32:29.530Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX Problem Types: Escalation of Privilege, CWE-358 Description: Improperly implemented security check for standard in the DDRIO configuration for some Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/con
access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01367.html
CVE ID: CVE-2025-32088 State: PUBLISHED Published: 2025-11-11T16:51:01.215Z Last Updated: 2025-11-17T16:09:52.950Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) QAT Windows software Problem Types: Denial of Service, CWE-754 Description: Improper conditions check for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requ
potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01373.html
CVE ID: CVE-2025-32089 State: PUBLISHED Published: 2025-11-17T22:34:18.769Z Last Updated: 2025-11-19T04:55:31.209Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the CvManager_SBI functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to a arbitrary code execution. An attacker can issue an api call to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2188
CVE ID: CVE-2025-32091 State: PUBLISHED Published: 2025-11-11T16:51:03.260Z Last Updated: 2025-11-14T15:28:55.714Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Arc(TM) B-series GPUs Problem Types: Escalation of Privilege, CWE-276 Description: Incorrect default permissions in some firmware for the Intel(R) Arc(TM) B-series GPUs within Ring 1: Device Drivers may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present with special internal knowledg
is result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01356.html
CVE ID: CVE-2025-32093 State: PUBLISHED Published: 2025-04-14T06:57:54.208Z Last Updated: 2025-04-14T13:58:29.741Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/s
mproper permission validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-32094 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-07T14:40:00.471Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Akamai Products: AkamaiGhost Problem Types: CWE-444 Description: An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body. Additional Analyst Notes: - CISA ADP
st, allowing an attacker to smuggle a second request in the original request body. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100 - https://www.rfc-editor.org/rfc/rfc9112.html#name-obsolete-line-folding - https://www.akamai.com/blog/security/cve-2025-32094-http-request-smuggling - https://www.blackhat.com/us-25/briefings/schedule/#http1-must-die-the-desync-endgame-45103
CVE ID: CVE-2025-32098 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-03T19:55:27.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file delete operations during the update process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-32098/
CVE ID: CVE-2025-32100 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-03T19:56:43.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. A programming mistake for buffer copy leads to out-of-bounds writes via malformed ROHC packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-suppo
.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-32100/
CVE ID: CVE-2025-32102 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-11-03T19:53:19.682Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: CrushFTP Products: CrushFTP Problem Types: CWE-918 Description: CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterface/function/ URI. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.crushftp.com/ - https://seclists.org/fulldisclosure/2025/Apr/17 - https://packetstorm.news/files/id/190460/
CVE ID: CVE-2025-32103 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-11-03T19:53:21.052Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: CrushFTP Products: CrushFTP Problem Types: CWE-40 Description: CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames, bypassing SecurityManager restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.crushftp.com/ - https://seclists.org/fulldisclosure/2025/Apr/17 - https://packetstorm.news/files/id/190460/
CVE ID: CVE-2025-32105 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-18T14:04:23.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the the Sangoma IMG2020 HTTP server through 2.3.9.6 allows an unauthenticated user to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/austin2111/papers/blob/main/Software_Vulnerabilities_in_Telecommunications_Hardware.pdf - https://github.com/austin2111/papers/blob/main/CVE-2025-32105_CVE-2025-32106_Technical_Report.pdf
CVE ID: CVE-2025-32106 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-18T14:05:45.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthorized code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://Audiocodes.com - https://github.com/austin2111/papers/blob/main/Software_Vulnerabilities_in_Telecommunications_Hardware.pdf - https://github.com/austin2111/papers/blob/main/CVE-2025-32105_CVE-2025-32106_Technical_Report.pdf
CVE ID: CVE-2025-32107 State: PUBLISHED Published: 2025-04-11T08:17:59.253Z Last Updated: 2025-04-11T13:54:38.206Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Corporation Limited Products: Deco BE65 Pro Problem Types: CWE-78 Description: OS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65 Pro(JP)_V1_1.1.2 Build 20250123". If this vulnerability is exploited, an arbitrary OS command may be executed by the user who can log in to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/jp/support/download/deco-be65-pro/#Firmware - https://jvn.jp/en/vu/JVNVU94912671/
CVE ID: CVE-2025-32111 State: PUBLISHED Published: 2025-04-04T00:00:00.000Z Last Updated: 2025-04-04T14:22:55.509Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: acme.sh project Products: acme.sh Problem Types: CWE-260 Description: The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/acmesh-official/acme.sh/commit/a1de13657e79c5471dbc8fa3539ea39160937389 - https://github.com/acmesh-official/acme.sh/commit/40b6db6a2715628aa977ed1853fe5256704010ae - https://github.com/actions
https://github.com/acmesh-official/acme.sh/commit/40b6db6a2715628aa977ed1853fe5256704010ae - https://github.com/actions/checkout/blob/85e6279cec87321a52edac9c87bce653a07cf6c2/README.md?plain=1#L70-L72
CVE ID: CVE-2025-32112 State: PUBLISHED Published: 2025-04-04T15:58:19.304Z Last Updated: 2025-04-04T20:20:29.771Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: OTWthemes Products: Sidebar Manager Light Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light allows Cross Site Request Forgery. This issue affects Sidebar Manager Light: from n/a through 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sidebar-manager-light/vulnerability/wordpress-sidebar-manager-light-plugin-1-1-8-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-32113 State: PUBLISHED Published: 2025-04-04T15:58:20.052Z Last Updated: 2025-04-04T20:20:21.076Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Renzo Tejada Products: Libro de Reclamaciones y Quejas Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas allows Cross Site Request Forgery. This issue affects Libro de Reclamaciones y Quejas: from n/a through 0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/libro-de-reclamaciones-y-quejas/vulnerability/wordpress-libro-de-reclamaciones-y-quejas-plugin-
atabase/wordpress/plugin/libro-de-reclamaciones-y-quejas/vulnerability/wordpress-libro-de-reclamaciones-y-quejas-plugin-0-9-csrf-to-stored-xss-vulnerability?_s_id=cve