Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-62481 State: PUBLISHED Published: 2025-10-21T20:03:18.956Z Last Updated: 2025-10-23T03:55:28.222Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Oracle Corporation Products: Oracle Marketing Problem Types: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in takeover of Oracle Marketing. Description: Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthe
CVE ID: CVE-2025-62482 State: PUBLISHED Published: 2025-11-13T14:56:25.642Z Last Updated: 2025-11-13T15:38:29.563Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Zoom Communications Inc. Products: Zoom Workplace Problem Types: CWE-79 Description: Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25046
CVE ID: CVE-2025-62483 State: PUBLISHED Published: 2025-11-13T15:03:07.612Z Last Updated: 2025-11-13T15:15:51.024Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Zoom Communications Inc. Products: Zoom Clients Problem Types: CWE-212 Description: Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25047
CVE ID: CVE-2025-62484 State: PUBLISHED Published: 2025-11-13T15:07:57.937Z Last Updated: 2025-11-14T04:55:33.475Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Zoom Communications Inc. Products: Zoom Workplace Problem Types: CWE-1333 Description: Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25048
CVE ID: CVE-2025-62490 State: PUBLISHED Published: 2025-10-16T15:51:06.100Z Last Updated: 2025-10-16T18:08:20.982Z Vendors: QuickJS Products: QuickJS Problem Types: CWE-416 Description: In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which the array could get resized and len1 become out of bounds. This results in a use-after-free.A second instance occurs in the same function during printing of a map or set objects. The code iterates over ms->records list, but once again, elements could be remov
uring printing of a map or set objects. The code iterates over ms->records list, but once again, elements could be removed from the list during js_print_value call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bellard.org/quickjs/Changelog - https://issuetracker.google.com/434196651
CVE ID: CVE-2025-62491 State: PUBLISHED Published: 2025-10-16T15:51:24.238Z Last Updated: 2025-10-16T18:04:16.529Z Vendors: QuickJS Products: QuickJS Problem Types: CWE-416 Description: A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejected_promise_list). * The function js_std_promise_rejection_check attempts to iterate over the rejected_promise_list to report unhandled rejections using a standard list loop. * The reason for a promise rejection is processed inside the loop, including calling js_std_dump_error1(ctx, rp->reason). * If the promise rejection reason is an Error object th
the loop, including calling js_std_dump_error1(ctx, rp->reason). * If the promise rejection reason is an Error object that defines a custom property getter (e.g., via Object.defineProperty), this getter is executed during the error dumping process. * The malicious custom getter can execute JavaScript code that calls catch() on the same rejected promise being processed. * Calling catch() internally triggers js_std_promise_rejection_tracker, which then removes and frees the current promise entry (JSRejectedPromiseEntry) from the rejected_promise_list. * Since the list iteration continues using the now-freed memory pointer (el), the subsequent loop access results in a Use-After-Free condition.
on continues using the now-freed memory pointer (el), the subsequent loop access results in a Use-After-Free condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bellard.org/quickjs/Changelog - https://issuetracker.google.com/434195203
CVE ID: CVE-2025-62492 State: PUBLISHED Published: 2025-10-16T15:51:34.445Z Last Updated: 2025-10-16T18:02:02.585Z Vendors: QuickJS Products: QuickJS Problem Types: CWE-125 Description: A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied. * The fromIndex argument (read as a double variable, $d$) is used to calculate the starting position for the search. * If d is negative, the index is calculated relative to the end of the array by adding the array's length (len) to d: $$d_{new} = d + \text{len}$$ * Due to the inherent limitations of floating-poi
by adding the array's length (len) to d: $$d_{new} = d + \text{len}$$ * Due to the inherent limitations of floating-point arithmetic, if the negative value $d$ is extremely small (e.g., $-1 \times 10^{-20}$), the addition $d + \text{len}$ can result in a loss of precision, yielding an outcome that is exactly equal to $\text{len}$. * The result is then converted to an integer index $k$: $k = \text{len}$. * The search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\text{len}-1$, starting the read at index $\text{len}$ is one element past the end of the array. This allows an attacker to cause an Out-of-Bounds Read of one element immediately fo
element past the end of the array. This allows an attacker to cause an Out-of-Bounds Read of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to Information Disclosure of adjacent memory contents, depending on the execution environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bellard.org/quickjs/Changelog - https://issuetracker.google.com/434194797
CVE ID: CVE-2025-62493 State: PUBLISHED Published: 2025-10-16T15:51:42.952Z Last Updated: 2025-10-16T17:59:10.306Z Vendors: QuickJS Products: QuickJS Problem Types: CWE-125 Description: A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the allocated BigInt structure. * The function determines the number of characters (n_digits) needed for the string representation by calculating: $$ \\ \text{n\_digits} = (\text{n\_bits} + \text{log2\_radix} - 1) / \text{log2\_radix}$$ $$$$This formula is off-by-one in certain edge cases when calculati
ts} + \text{log2\_radix} - 1) / \text{log2\_radix}$$ $$$$This formula is off-by-one in certain edge cases when calculating the necessary memory limbs. For instance, a 127-bit BigInt using radix 32 (where $\text{log2\_radix}=5$) is calculated to need $\text{n\_digits}=26$. * The maximum number of bits actually stored is $\text{n\_bits}=127$, which requires only two 64-bit limbs ($\text{JS\_LIMB\_BITS}=64$). * The conversion loop iterates $\text{n\_digits}=26$ times, attempting to read 5 bits in each iteration, totaling $26 \times 5 = 130$ bits. * In the final iterations of the loop, the code attempts to read data that spans two limbs: C c = (r->tab[pos] >> shift) | (r->tab[pos + 1] << (JS_LIM
he loop, the code attempts to read data that spans two limbs: C c = (r->tab[pos] >> shift) | (r->tab[pos + 1] << (JS_LIMB_BITS - shift)); * Since the BigInt was only allocated two limbs, the read operation for r->tab[pos + 1] becomes an Out-of-Bounds Read when pos points to the last valid limb (e.g., $pos=1$). This vulnerability allows an attacker to cause the engine to read and process data from the memory immediately following the BigInt buffer. This can lead to Information Disclosure of sensitive data stored on the heap adjacent to the BigInt object. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bellard.org/quickjs/Changelog - https://issuetracker.google.com/434
otes: - CISA ADP Vulnrichment: References: - https://bellard.org/quickjs/Changelog - https://issuetracker.google.com/434193024
CVE ID: CVE-2025-62494 State: PUBLISHED Published: 2025-10-16T15:51:50.977Z Last Updated: 2025-10-16T17:46:39.174Z Vendors: QuickJS Products: QuickJS Problem Types: CWE-704 Description: A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This conversion can trigger a callback (e.g., toString or valueOf). * During this callback, an attacker can modify the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array
the type of the left-hand operand in memory, changing it from a string to a different type (e.g., an object or an array). * The code then proceeds to call JS_ConcatStringInPlace, which still treats the modified left-hand value as a string. This mismatch between the assumed type (string) and the actual type allows an attacker to control the data structure being processed by the concatenation logic, resulting in a type confusion condition. This can lead to out-of-bounds memory access, potentially resulting in memory corruption and arbitrary code execution in the context of the QuickJS runtime. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bellard.org/quickjs/Changel
he QuickJS runtime. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bellard.org/quickjs/Changelog - https://issuetracker.google.com/434193023
CVE ID: CVE-2025-62495 State: PUBLISHED Published: 2025-10-16T15:51:58.953Z Last Updated: 2025-10-16T17:42:15.865Z Vendors: QuickJS Products: QuickJS Problem Types: CWE-191 Description: An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{size}\_\text{t}$ (an unsigned type, typically 64-bit) for its size member. * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\text{size}\_\text{t}$ value into a signed int (typi
r internal parsing routines, incorrectly cast or store this DynBuf $\text{size}\_\text{t}$ value into a signed int (typically 32-bit). * When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow). * This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction. * This negative of
se_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction. * This negative offset is then incorrectly added to the buffer pointer (s->byte\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below: put_u32(s->byte_code.buf + pos, len); Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bellard.org/quickjs/Changelog - https://issuetracker.google.com/434196926
CVE ID: CVE-2025-62496 State: PUBLISHED Published: 2025-10-16T15:52:05.654Z Last Updated: 2025-10-16T17:26:25.654Z Vendors: QuickJS Products: QuickJS Problem Types: CWE-190 Description: A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attempting to create a BigInt from a string with an excessively large number of digits. The function calculates the necessary number of bits (n_bits) required to store the BigInt using the formula: $$\text{n\_bits} = (\text{n\_digits} \times 27 + 7) / 8 \quad (\text{for radix 10})$$ * For large input strings (e.g., $79,536,432$ digits or more for base 10), the intermediate calculation $(\text{n\_digits} \ti
large input strings (e.g., $79,536,432$ digits or more for base 10), the intermediate calculation $(\text{n\_digits} \times 27 + 7)$ exceeds the maximum value of a standard signed 32-bit integer, resulting in an Integer Overflow. * The resulting n_bits value becomes unexpectedly small or even negative due to this wrap-around. * This flawed n_bits is then used to compute n_limbs, the number of memory "limbs" needed for the BigInt object. Since n_bits is too small, the calculated n_limbs is also significantly underestimated. * The function proceeds to allocate a JSBigInt object using this underestimated n_limbs. * When the function later attempts to write the actual BigInt data into the alloca
ct using this underestimated n_limbs. * When the function later attempts to write the actual BigInt data into the allocated object, the small buffer size is quickly exceeded, leading to a Heap Out-of-Bounds Write as data is written past the end of the allocated r->tab array. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bellard.org/quickjs/Changelog - https://issuetracker.google.com/434193016
CVE ID: CVE-2025-62497 State: PUBLISHED Published: 2025-11-25T04:37:08.451Z Last Updated: 2025-11-25T04:37:08.451Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Sony Corporation Products: SNC-CX600W Problem Types: CWE-352 Description: Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a specially crafted webpage while logged in, unintended operations may be performed. References: - https://www.sony.com/electronics/support/ip-cameras-fixed/snc-cx600w - https://jvn.jp/en/jp/JVN75140384/
CVE ID: CVE-2025-62498 State: PUBLISHED Published: 2025-10-23T21:46:45.360Z Last Updated: 2025-10-24T14:34:34.818Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: AutomationDirect Products: Productivity Suite, Productivity 3000 P3-622 CPU, Productivity 3000 P3-550E CPU, Productivity 3000 P3-530 CPU, Productivity 2000 P2-622 CPU, Productivity 2000 P2-550 CPU, Productivity 1000 P1-550 CPU, Productivity 1000 P1-540 CPU Problem Types: CWE-23 Description: A relative path traversal (ZipSlip) vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker who can tamper with a productivity project to execute arbitrar
re version 4.4.1.19. The vulnerability allows an attacker who can tamper with a productivity project to execute arbitrary code on the machine where the project is opened. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01 - https://www.automationdirect.com/support/software-downloads - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json
CVE ID: CVE-2025-62499 State: PUBLISHED Published: 2025-10-23T04:10:41.403Z Last Updated: 2025-10-23T15:13:25.011Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Six Apart Ltd. Products: Movable Type (Software Edition), Movable Type Advanced (Software Edition), Movable Type Premium (Software Edition), Movable Type Premium (Advanced Edition) (Software Edition), Movable Type (Cloud Edition), Movable Type Premium (Cloud Edition) Problem Types: CWE-79 Description: Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitra
rySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://movabletype.org/news/2025/10/mt-880-released.html - https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html - https://jvn.jp/en/jp/JVN24333679/
CVE ID: CVE-2025-62503 State: PUBLISHED Published: 2025-10-30T09:11:16.813Z Last Updated: 2025-10-30T14:25:43.960Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-250 Description: User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcr
CVE ID: CVE-2025-62504 State: PUBLISHED Published: 2025-10-16T21:23:41.883Z Last Updated: 2025-10-17T13:42:31.308Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-416 Description: Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling refe
(default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash. This results in denial of service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the condition but does not correct the underlying memory safety flaw. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-gcxr-6vrp-wff3
CVE ID: CVE-2025-62505 State: PUBLISHED Published: 2025-10-17T18:18:53.739Z Last Updated: 2025-10-17T18:32:20.732Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: lobehub Products: lobe-chat Problem Types: CWE-918 Description: LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service passes the user URLs to Crawler.crawl and the naive implementation performs a server-side fetch of each supplied URL without validating or restric
awler.crawl and the naive implementation performs a server-side fetch of each supplied URL without validating or restricting internal network addresses (such as localhost, 127.0.0.1, private IP ranges, or cloud instance metadata endpoints). This allows an attacker with a valid user token (or in development mode using a bypass header) to make the server disclose responses from internal HTTP services, potentially exposing internal API data or cloud metadata credentials. Version 1.136.2 fixes the issue. Update to version 1.136.2. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lobehub/lobe-chat/security/advisories/GHSA-fgx4-p8xf-qh
Notes: - CISA ADP Vulnrichment: References: - https://github.com/lobehub/lobe-chat/security/advisories/GHSA-fgx4-p8xf-qhp9 - https://github.com/lobehub/lobe-chat/commit/8d59583dca16f218b99213d641733d8ba77f182c
CVE ID: CVE-2025-62506 State: PUBLISHED Published: 2025-10-16T21:17:28.219Z Last Updated: 2025-10-23T19:03:46.367Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: minio Products: minio Problem Types: CWE-863 Description: MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their inline policy restrictions when performing operations on their own account, specifically when creating new service accounts for the same user. The vulnerability exists in the IAM policy val
count, specifically when creating new service accounts for the same user. The vulnerability exists in the IAM policy validation logic where the code incorrectly relied on the DenyOnly argument when validating session policies for restricted accounts. When a session policy is present, the system should validate that the action is allowed by the session policy, not just that it is not denied. An attacker with valid credentials for a restricted service or STS account can create a new service account for itself without policy restrictions, resulting in a new service account with full parent privileges instead of being restricted by the inline policy. This allows the attacker to access buckets an
h full parent privileges instead of being restricted by the inline policy. This allows the attacker to access buckets and objects beyond their intended restrictions and modify, delete, or create objects outside their authorized scope. The vulnerability is fixed in version RELEASE.2025-10-15T17-29-55Z. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minio/minio/security/advisories/GHSA-jjjj-jwhf-8rgr - https://github.com/minio/minio/pull/21642 - https://github.com/minio/minio/commit/c1a49490c78e9c3ebcad86ba0662319138ace190
CVE ID: CVE-2025-62507 State: PUBLISHED Published: 2025-11-04T21:24:44.802Z Last Updated: 2025-11-06T04:55:34.815Z Vendors: redis Products: redis Problem Types: CWE-20, CWE-121 Description: Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command. Additional Analyst Notes: - CISA ADP Vulnrichment: R
operation. This can be done using ACL to restrict XACKDEL command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-jhjx-x4cf-4vm8 - https://github.com/redis/redis/commit/5f83972188f6e5b1d6f1940218c650a9cbdf7741 - https://github.com/redis/redis/releases/tag/8.2.3