Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55211 State: PUBLISHED Published: 2025-09-15T21:00:13.557Z Last Updated: 2025-09-16T15:45:00.835Z Vendors: FreePBX Products: security-reporting Problem Types: CWE-78 Description: FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel (ACP) can run arbitrary shell commands by maliciously changing languages of the framework module. This vulnerability is fixed in 17.0.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-xg83-m6q5-q24h
CVE ID: CVE-2025-55212 State: PUBLISHED Published: 2025-08-26T16:43:15.189Z Last Updated: 2025-11-03T18:13:41.050Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-369 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28
triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw - https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af - https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355 - https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629 - https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1
CVE ID: CVE-2025-55213 State: PUBLISHED Published: 2025-08-18T19:23:33.684Z Last Updated: 2025-08-18T19:49:55.886Z Vendors: openfga Products: openfga Problem Types: CWE-863 Description: OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openfga/openfga/security/advisories/GHSA-mgh9-4mwp-fg55 - h
s: - CISA ADP Vulnrichment: References: - https://github.com/openfga/openfga/security/advisories/GHSA-mgh9-4mwp-fg55 - https://github.com/openfga/openfga/commit/1a7e0e37fc4777c824b2386cac4867a66f3480b0
CVE ID: CVE-2025-55214 State: PUBLISHED Published: 2025-08-18T16:36:46.621Z Last Updated: 2025-08-18T19:47:31.803Z Vendors: copier-org Products: copier Problem Types: CWE-22 Description: Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently write files outside the destination path where a project shall be generated or updated. This is possible when rendering a generated directory structure whose rendered path is ei
shall be generated or updated. This is possible when rendering a generated directory structure whose rendered path is either a relative parent path or an absolute path. Constructing such paths is possible using Copier's builtin pathjoin Jinja filter and its builtin _copier_conf.sep variable, which is the platform-native path separator. This way, a malicious template author can create a template that overwrites arbitrary files (according to the user's write permissions), e.g., to cause havoc. This vulnerability is fixed in 9.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/copier-org/copier/security/advisories/GHSA-p7q8-grrj-3m8w - https://github.com/co
ment: References: - https://github.com/copier-org/copier/security/advisories/GHSA-p7q8-grrj-3m8w - https://github.com/copier-org/copier/commit/fdbc0167cc22780b497e4db176feaf6f024757d6
CVE ID: CVE-2025-55223 State: PUBLISHED Published: 2025-09-09T17:01:02.102Z Last Updated: 2025-11-21T18:18:10.874Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared
dows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55223
CVE ID: CVE-2025-55224 State: PUBLISHED Published: 2025-09-09T17:01:31.548Z Last Updated: 2025-11-21T18:18:42.001Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shar
indows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55224
CVE ID: CVE-2025-55225 State: PUBLISHED Published: 2025-09-09T17:01:03.108Z Last Updated: 2025-11-21T18:18:11.439Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Se
vice Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-125 Description: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55225
CVE ID: CVE-2025-55226 State: PUBLISHED Published: 2025-09-09T17:01:03.660Z Last Updated: 2025-11-21T18:18:11.912Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute
ed resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55226
CVE ID: CVE-2025-55227 State: PUBLISHED Published: 2025-09-09T17:01:32.118Z Last Updated: 2025-11-21T18:18:42.568Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2019 (CU 32), Microsoft SQL Server 2022 (CU 20) Problem Types: CWE-77 Description: Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authoriz
on: Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55227
CVE ID: CVE-2025-55228 State: PUBLISHED Published: 2025-09-09T17:01:04.230Z Last Updated: 2025-11-21T18:18:12.469Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows a
rrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55228
CVE ID: CVE-2025-55229 State: PUBLISHED Published: 2025-08-21T19:50:40.421Z Last Updated: 2025-11-10T00:12:52.635Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-347 Description: Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55229
CVE ID: CVE-2025-55230 State: PUBLISHED Published: 2025-08-21T19:49:44.447Z Last Updated: 2025-11-10T00:11:57.160Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-822 Description: Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CI
Windows MBT Transport driver allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55230
CVE ID: CVE-2025-55231 State: PUBLISHED Published: 2025-08-21T19:50:40.983Z Last Updated: 2025-11-10T00:12:53.185Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an unauthorized
ecution using shared resource with improper synchronization ('race condition') in Windows Storage allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55231
CVE ID: CVE-2025-55232 State: PUBLISHED Published: 2025-09-09T17:01:04.860Z Last Updated: 2025-11-21T18:18:13.288Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft HPC Pack 2019 Problem Types: CWE-502 Description: Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55232
CVE ID: CVE-2025-55234 State: PUBLISHED Published: 2025-09-09T17:01:32.635Z Last Updated: 2025-11-21T18:18:43.127Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-287 Description: SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perfo
o relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privilege attacks. The SMB Server already supports mechanisms for hardening against relay attacks: SMB Server signing SMB Server Extended Protection for Authentication (EPA) Microsoft is releasing this CVE to provide customers with audit capabilities to help them to assess their environment and to identify any potential device or software incompatibility issues before deploying SMB Server hardening measures that protect against relay attacks. If you have not already enabled SMB Server hardening measures, we advise
g measures that protect against relay attacks. If you have not already enabled SMB Server hardening measures, we advise customers to take the following actions to be protected from these relay attacks: Assess your environment by utilizing the audit capabilities that we are exposing in the September 2025 security updates. See Support for Audit Events to deploy SMB Server Hardening—SMB Server Signing &amp; SMB Server EPA. Adopt appropriate SMB Server hardening measures. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55234
CVE ID: CVE-2025-55236 State: PUBLISHED Published: 2025-09-09T17:01:05.384Z Last Updated: 2025-11-21T18:18:14.213Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-367, CWE-843 Description: Time-of-check time-of-use (toct
indows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-367, CWE-843 Description: Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55236
CVE ID: CVE-2025-55238 State: PUBLISHED Published: 2025-09-04T23:09:52.596Z Last Updated: 2025-11-21T18:18:46.364Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Dynamics 365 FastTrack Implementation Problem Types: CWE-284 Description: Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55238
CVE ID: CVE-2025-55240 State: PUBLISHED Published: 2025-10-14T17:00:58.400Z Last Updated: 2025-11-22T04:09:05.042Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.10, Microsoft Visual Studio 2022 version 17.12, Microsoft Visual Studio 2022 version 17.14 Problem Types: CWE-284 Description: Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55240
CVE ID: CVE-2025-55241 State: PUBLISHED Published: 2025-09-04T23:09:53.490Z Last Updated: 2025-11-21T18:18:44.465Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Entra Problem Types: CWE-287 Description: Azure Entra ID Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241
CVE ID: CVE-2025-55242 State: PUBLISHED Published: 2025-09-04T23:09:51.199Z Last Updated: 2025-11-21T18:18:45.288Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Xbox Gaming Services Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55242
CVE ID: CVE-2025-55243 State: PUBLISHED Published: 2025-09-09T17:01:06.531Z Last Updated: 2025-11-21T18:18:15.339Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft OfficePLUS Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55243
CVE ID: CVE-2025-55244 State: PUBLISHED Published: 2025-09-04T23:09:49.557Z Last Updated: 2025-11-21T18:18:46.923Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Bot Service Problem Types: CWE-284 Description: Azure Bot Service Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55244
CVE ID: CVE-2025-55245 State: PUBLISHED Published: 2025-09-09T17:01:05.889Z Last Updated: 2025-11-21T18:18:14.719Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Xbox Gaming Services Problem Types: CWE-59 Description: Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55245
CVE ID: CVE-2025-55247 State: PUBLISHED Published: 2025-10-14T17:00:09.501Z Last Updated: 2025-11-22T04:08:18.435Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: .NET 8.0, .NET 9.0 Problem Types: CWE-59 Description: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55247