Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-36185 State: PUBLISHED Published: 2025-11-07T18:40:59.591Z Last Updated: 2025-11-07T18:52:26.052Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 Problem Types: CWE-943 Description: IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250487
CVE ID: CVE-2025-36186 State: PUBLISHED Published: 2025-11-07T18:40:32.478Z Last Updated: 2025-11-08T04:55:21.393Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Db2 Problem Types: CWE-250 Description: IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250486
CVE ID: CVE-2025-36193 State: PUBLISHED Published: 2025-09-03T19:00:39.089Z Last Updated: 2025-09-03T20:08:27.956Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Transformation Advisor Problem Types: CWE-732 Description: IBM Transformation Advisor 2.0.1 through 4.3.1 incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Transformation Advisor Operator Catalog image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7243632
CVE ID: CVE-2025-36202 State: PUBLISHED Published: 2025-09-22T15:14:44.349Z Last Updated: 2025-09-22T15:42:51.190Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: webMethods Integration Problem Types: CWE-134 Description: IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings passed as an argument from an external source. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7245720
CVE ID: CVE-2025-36222 State: PUBLISHED Published: 2025-09-11T20:44:06.696Z Last Updated: 2025-09-13T03:55:38.759Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: IBM Products: Fusion, Fusion HCI, Fusion HCI for watsonx Problem Types: CWE-1188 Description: IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244646
CVE ID: CVE-2025-36223 State: PUBLISHED Published: 2025-11-12T21:04:45.915Z Last Updated: 2025-11-13T15:03:56.553Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: OpenPages Problem Types: CWE-644 Description: IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250239
CVE ID: CVE-2025-36225 State: PUBLISHED Published: 2025-10-09T13:56:19.270Z Last Updated: 2025-10-09T14:43:28.382Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-203 Description: IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247502
CVE ID: CVE-2025-36236 State: PUBLISHED Published: 2025-11-13T22:01:31.264Z Last Updated: 2025-11-14T15:25:04.199Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: IBM Products: AIX, VIOS Problem Types: CWE-22 Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7251173
CVE ID: CVE-2025-36239 State: PUBLISHED Published: 2025-09-27T01:16:02.872Z Last Updated: 2025-09-29T13:59:37.166Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Storage TS4500 Library Problem Types: CWE-79 Description: IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246246
CVE ID: CVE-2025-36244 State: PUBLISHED Published: 2025-09-16T14:38:08.632Z Last Updated: 2025-09-22T18:10:06.615Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: AIX, VIOS Problem Types: CWE-454 Description: IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper initialization of critical variables. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7245092
CVE ID: CVE-2025-36245 State: PUBLISHED Published: 2025-09-29T22:29:33.007Z Last Updated: 2025-10-01T03:55:56.172Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-78 Description: IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246170
CVE ID: CVE-2025-36248 State: PUBLISHED Published: 2025-09-19T16:22:39.759Z Last Updated: 2025-11-06T19:07:42.042Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Copy Services Manager Problem Types: CWE-79 Description: IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7245562
CVE ID: CVE-2025-36249 State: PUBLISHED Published: 2025-10-31T13:05:32.799Z Last Updated: 2025-10-31T13:43:40.821Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Jazz for Service Management Problem Types: CWE-614 Description: IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. Additional Analyst Notes: - CISA ADP
re link and the attacker can then obtain the cookie value by snooping the traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249820
CVE ID: CVE-2025-36250 State: PUBLISHED Published: 2025-11-13T22:01:27.447Z Last Updated: 2025-11-15T04:56:16.615Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: AIX, VIOS Problem Types: CWE-114 Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7251173
CVE ID: CVE-2025-36251 State: PUBLISHED Published: 2025-11-13T22:01:13.345Z Last Updated: 2025-11-15T04:56:15.260Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: IBM Products: AIX, VIOS Problem Types: CWE-114 Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7251173
CVE ID: CVE-2025-36262 State: PUBLISHED Published: 2025-09-30T19:42:37.033Z Last Updated: 2025-09-30T20:41:05.565Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Planning Analytics Local Problem Types: CWE-1286 Description: IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246602
CVE ID: CVE-2025-36274 State: PUBLISHED Published: 2025-09-26T14:14:01.082Z Last Updated: 2025-09-26T14:57:32.217Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Aspera HTTP Gateway Problem Types: CWE-319 Description: IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246284
CVE ID: CVE-2025-36299 State: PUBLISHED Published: 2025-11-17T20:09:35.286Z Last Updated: 2025-11-17T20:54:09.781Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: IBM Planning Analytics Local Problem Types: CWE-540 Description: IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7251265
CVE ID: CVE-2025-36326 State: PUBLISHED Published: 2025-09-26T14:20:46.219Z Last Updated: 2025-09-26T14:54:41.385Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cognos Controller, Controller Problem Types: CWE-321 Description: IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246015
CVE ID: CVE-2025-36351 State: PUBLISHED Published: 2025-09-29T14:27:39.032Z Last Updated: 2025-09-29T15:04:12.822Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: License Metric Tool Problem Types: CWE-284 Description: IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246534
CVE ID: CVE-2025-36352 State: PUBLISHED Published: 2025-09-29T14:25:39.773Z Last Updated: 2025-09-29T15:08:36.763Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: License Metric Tool Problem Types: CWE-79 Description: IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246534
CVE ID: CVE-2025-36354 State: PUBLISHED Published: 2025-10-06T16:53:43.179Z Last Updated: 2025-10-06T19:58:39.023Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Security Verify Access Appliance, Security Verify Access Docker Problem Types: CWE-78 Description: IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247215
CVE ID: CVE-2025-36355 State: PUBLISHED Published: 2025-10-06T16:52:30.705Z Last Updated: 2025-10-06T19:59:35.611Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: IBM Products: Security Verify Access Appliance, Security Verify Access Docker Problem Types: CWE-829 Description: IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247215
CVE ID: CVE-2025-36356 State: PUBLISHED Published: 2025-10-06T16:50:48.729Z Last Updated: 2025-10-06T20:00:08.743Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Access Appliance, Security Verify Access Docker Problem Types: CWE-250 Description: IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to escalate their privileges to root due to execution with more privileges than required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247215
CVE ID: CVE-2025-36357 State: PUBLISHED Published: 2025-11-17T20:07:00.856Z Last Updated: 2025-11-18T04:55:24.326Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: IBM Planning Analytics Local Problem Types: CWE-36 Description: IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7251265
CVE ID: CVE-2025-36361 State: PUBLISHED Published: 2025-10-24T09:35:20.590Z Last Updated: 2025-10-25T02:03:18.631Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: App Connect Enterprise Problem Types: CWE-862 Description: IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined resources due to missing authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249061
CVE ID: CVE-2025-36367 State: PUBLISHED Published: 2025-11-01T12:01:31.137Z Last Updated: 2025-11-04T04:55:13.395Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: i Problem Types: CWE-862 Description: IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use the elevated privileges of another user profile to gain root access to the host operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249915
CVE ID: CVE-2025-36371 State: PUBLISHED Published: 2025-11-19T19:45:31.840Z Last Updated: 2025-11-19T20:18:56.273Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: i Problem Types: CWE-598 Description: IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by obtaining an information vulnerability in the database plan cache implementation. A user with access to the database plan cache could see information they do not have authority to view. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7251699
CVE ID: CVE-2025-36386 State: PUBLISHED Published: 2025-10-28T15:56:58.740Z Last Updated: 2025-10-28T16:57:09.538Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: IBM Maximo Application Suite Problem Types: CWE-305 Description: IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249416
CVE ID: CVE-2025-36460 State: PUBLISHED Published: 2025-11-17T22:47:21.793Z Last Updated: 2025-11-19T04:55:30.522Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-805 Description: Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when sub
ry corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 2 (`WBIO_USH_GET_IDENTITY`) with an improper `ReceiveBuferSize` value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2175
CVE ID: CVE-2025-36461 State: PUBLISHED Published: 2025-11-17T22:50:19.544Z Last Updated: 2025-11-19T04:55:29.771Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-805 Description: Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when sub
ry corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 0 (`WBIO_USH_GET_TEMPLATE`) and with either and an invalid `ReceiveBuferSize` and/or an invalid `SendBufferSize`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2175
CVE ID: CVE-2025-36462 State: PUBLISHED Published: 2025-11-17T22:50:46.863Z Last Updated: 2025-11-19T04:55:28.926Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-805 Description: Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when sub
ry corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 3 (`WBIO_USH_CREATE_CHALLENGE`) with an invalid `ReceiveBuferSize`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2175
CVE ID: CVE-2025-36463 State: PUBLISHED Published: 2025-11-17T22:51:10.804Z Last Updated: 2025-11-19T04:55:27.855Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-805 Description: Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when sub
ry corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 4 (`WBIO_USH_ADD_RECORD`) and with an invalid `SendBufferSize`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000326061/dsa-2025-228 - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2175
CVE ID: CVE-2025-36504 State: PUBLISHED Published: 2025-05-07T22:04:09.881Z Last Updated: 2025-05-08T13:05:39.886Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next, BIG-IP Next SPK, BIG-IP Next CNF Problem Types: CWE-770 Description: When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000140919
CVE ID: CVE-2025-36506 State: PUBLISHED Published: 2025-06-13T08:18:49.469Z Last Updated: 2025-06-13T15:13:20.611Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Ricoh Company, Ltd. Products: RICOH Streamline NX V3 PC Client Problem Types: CWE-73 Description: External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted request, arbitrary files in the file system can be overwritten with log data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000004 - https://jvn.jp/en/jp/JVN