Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-41347 State: PUBLISHED Published: 2025-11-18T11:06:39.222Z Last Updated: 2025-11-18T20:39:39.303Z Vendors: Informática del Este Products: WinPlus Problem Types: CWE-434 Description: Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This vulnerability allows an attacker to upload a 'webshell' by sending a POST request to '/WinplusPortal/ws/sWinplus.svc/json/uploadfile'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-winplus-informatica-del-este
CVE ID: CVE-2025-41348 State: PUBLISHED Published: 2025-11-18T11:24:06.672Z Last Updated: 2025-11-18T20:35:01.430Z Vendors: Informática del Este Products: WinPlus Problem Types: CWE-89 Description: SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumper_post'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-winplus-informatica-del-este
CVE ID: CVE-2025-41349 State: PUBLISHED Published: 2025-11-18T11:26:23.985Z Last Updated: 2025-11-18T20:32:21.960Z Vendors: Informática del Este Products: WinPlus Problem Types: CWE-79 Description: Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'descripcion' parameter in '/WinplusPortal/ws/sWinplus. svc/json/savesolpla_post'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichmen
query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-winplus-informatica-del-este
CVE ID: CVE-2025-41350 State: PUBLISHED Published: 2025-11-18T11:27:42.348Z Last Updated: 2025-11-18T19:26:49.005Z Vendors: Informática del Este Products: WinPlus Problem Types: CWE-79 Description: Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'descripcion' parameter in '/WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment
CVE ID: CVE-2025-41360 State: PUBLISHED Published: 2025-06-06T11:45:26.228Z Last Updated: 2025-06-06T14:26:48.713Z Vendors: ZIV Products: IDF and ZLF Problem Types: CWE-400 Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE ID: CVE-2025-41361 State: PUBLISHED Published: 2025-06-06T11:53:10.953Z Last Updated: 2025-06-06T12:34:51.168Z Vendors: ZIV Products: IDF and ZLF Problem Types: CWE-400 Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit this vulnerability, PROCOME ports must be configured and active, with communications encryption active. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso
ive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE ID: CVE-2025-41362 State: PUBLISHED Published: 2025-06-06T11:46:28.479Z Last Updated: 2025-06-06T17:37:10.978Z Vendors: ZIV Products: IDF and ZLF Problem Types: CWE-94 Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE ID: CVE-2025-41363 State: PUBLISHED Published: 2025-06-06T11:47:55.640Z Last Updated: 2025-06-06T14:19:23.725Z Vendors: ZIV Products: IDF and ZLF Problem Types: CWE-942 Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE ID: CVE-2025-41364 State: PUBLISHED Published: 2025-06-06T11:49:03.631Z Last Updated: 2025-06-06T13:10:40.776Z Vendors: ZIV Products: IDF and ZLF Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-
SA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE ID: CVE-2025-41365 State: PUBLISHED Published: 2025-06-06T11:49:51.858Z Last Updated: 2025-06-06T13:06:59.821Z Vendors: ZIV Products: IDF and ZLF Problem Types: CWE-94 Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed only with permissions higher than the view permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zi
CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE ID: CVE-2025-41366 State: PUBLISHED Published: 2025-06-06T11:50:42.685Z Last Updated: 2025-06-06T12:51:02.198Z Vendors: ZIV Products: IDF and ZLF Problem Types: CWE-942 Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE ID: CVE-2025-41367 State: PUBLISHED Published: 2025-06-06T11:51:36.441Z Last Updated: 2025-06-06T12:47:26.876Z Vendors: ZIV Products: IDF and ZLF Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-s
n. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE ID: CVE-2025-41370 State: PUBLISHED Published: 2025-08-01T12:28:12.959Z Last Updated: 2025-08-01T13:43:27.160Z Vendors: TESI Products: Gandia Integra Total Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb/html/view/acceso.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE ID: CVE-2025-41371 State: PUBLISHED Published: 2025-08-01T12:28:36.860Z Last Updated: 2025-08-01T13:39:24.925Z Vendors: TESI Products: Gandia Integra Total Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb_v4/integra/html/view/acceso.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE ID: CVE-2025-41372 State: PUBLISHED Published: 2025-08-01T12:29:13.628Z Last Updated: 2025-08-01T13:36:51.302Z Vendors: TESI Products: Gandia Integra Total Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/informe_campo_entrevistas.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE ID: CVE-2025-41373 State: PUBLISHED Published: 2025-08-01T12:29:25.136Z Last Updated: 2025-08-01T13:25:28.243Z Vendors: TESI Products: Gandia Integra Total Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE ID: CVE-2025-41374 State: PUBLISHED Published: 2025-08-01T12:29:35.137Z Last Updated: 2025-08-01T13:23:15.693Z Vendors: TESI Products: Gandia Integra Total Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE ID: CVE-2025-41375 State: PUBLISHED Published: 2025-08-01T12:29:48.916Z Last Updated: 2025-09-11T08:51:03.073Z Vendors: LimeSurvey Products: LimeSurvey Problem Types: CWE-89 Description: SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey
CVE ID: CVE-2025-41376 State: PUBLISHED Published: 2025-08-01T12:29:59.023Z Last Updated: 2025-09-11T08:56:57.154Z Vendors: LimeSurvey Products: LimeSurvey Problem Types: CWE-93 Description: CRLF Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey
CVE ID: CVE-2025-41377 State: PUBLISHED Published: 2025-05-23T12:37:48.645Z Last Updated: 2025-08-01T12:30:09.665Z Vendors: TESI Products: Gandia Integra Total Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gandia-integra-total-tesi
CVE ID: CVE-2025-41378 State: PUBLISHED Published: 2025-05-23T12:40:14.121Z Last Updated: 2025-05-27T14:39:15.642Z Vendors: Intellian Technologies Products: Iridium Certus 700 Problem Types: CWE-20 Description: The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker to extend his knowledge of the system and compromise other devices. The information is filtered by the logs function of the web panel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-intellian-technologies-iridium-certus
CVE ID: CVE-2025-41379 State: PUBLISHED Published: 2025-05-23T12:41:09.682Z Last Updated: 2025-05-23T15:04:14.233Z Vendors: Intellian Technologies Products: Iridium Certus 700 Problem Types: CWE-20 Description: The Intellian C700 web panel allows you to add firewall rules. Each of these rules has an associated ID, but there is a problem when adding a new rule, the ID used to create the database entry may be different from the JSON ID. If the rule needs to be deleted later, the system will use the JSON ID and therefore fail. This can be exploited by an attacker to create rules that cannot be deleted unless the device is reset to factory defaults. Additional Analyst Notes: - CISA ADP Vulnrichm
es that cannot be deleted unless the device is reset to factory defaults. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-intellian-technologies-iridium-certus
CVE ID: CVE-2025-41380 State: PUBLISHED Published: 2025-05-23T12:41:58.459Z Last Updated: 2025-05-23T15:02:02.156Z Vendors: Intellian Technologies Products: Iridium Certus 700 Problem Types: CWE-798 Description: Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-intellian-technologies-iridium-certus
CVE ID: CVE-2025-41384 State: PUBLISHED Published: 2025-10-27T12:53:51.383Z Last Updated: 2025-10-27T15:08:15.360Z Vendors: SuiteCRM Products: SuiteCRM Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-suitecrm
CVE ID: CVE-2025-41385 State: PUBLISHED Published: 2025-05-30T06:35:56.222Z Last Updated: 2025-05-30T13:05:39.535Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: UCHIDA YOKO CO., LTD. Products: wivia 5 Problem Types: CWE-78 Description: An OS Command Injection issue exists in wivia 5 all versions. If this vulnerability is exploited, an arbitrary OS command may be executed by a logged-in administrative user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.uchida.co.jp/wivia/support02.html - https://jvn.jp/en/jp/JVN51394666/
CVE ID: CVE-2025-41388 State: PUBLISHED Published: 2025-06-17T20:24:26.869Z Last Updated: 2025-06-18T14:57:23.413Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Smart Editor Problem Types: CWE-121 Description: Fuji Electric Smart Editor is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-04
CVE ID: CVE-2025-41390 State: PUBLISHED Published: 2025-10-20T14:15:29.418Z Last Updated: 2025-11-03T17:44:44.504Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Truffle Security Co. Products: TruffleHog Problem Types: CWE-829 Description: An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2243 -
nrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2243 - https://trufflesecurity.com/blog/contributor-spotlight-adam-reiser-of-cisco-talos
CVE ID: CVE-2025-41391 State: PUBLISHED Published: 2025-07-31T07:25:10.798Z Last Updated: 2025-07-31T14:23:47.388Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Alfasado Inc. Products: PowerCMS Problem Types: CWE-79 Description: Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be executed on the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.powercms.jp/news/release-powercms-671-531-461.html - https://jvn.jp/en/vu/JVNVU93412964/
CVE ID: CVE-2025-41392 State: PUBLISHED Published: 2025-08-18T21:07:20.484Z Last Updated: 2025-08-19T13:34:52.678Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt, Xenon, Argon, Lithium, Cobalt Share Problem Types: CWE-125 Description: In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
o execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01
CVE ID: CVE-2025-41393 State: PUBLISHED Published: 2025-05-12T08:04:39.693Z Last Updated: 2025-07-14T06:23:13.218Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Ricoh Company, Ltd., KONICA MINOLTA JAPAN, INC. Products: Multiple laser printers and MFPs which implement Web Image Monitor, Multiple MFPs which implement Web Image Monitor Problem Types: CWE-79 Description: Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor. As for the details of affected p
y script may be executed on the web browser of the user who accessed Web Image Monitor. As for the details of affected product names and versions, refer to the information provided by the vendors under [References]. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000001 - https://jp.ricoh.com/security/products/vulnerabilities/vul?id=ricoh-2025-000001 - https://www.konicaminolta.jp/business/support/important/250714_01_01.html - https://jvn.jp/en/jp/JVN20474768/
CVE ID: CVE-2025-41395 State: PUBLISHED Published: 2025-04-24T06:48:31.087Z Last Updated: 2025-04-24T13:58:04.968Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-1287 Description: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/securit
e web app for all users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-41396 State: PUBLISHED Published: 2025-07-31T07:24:20.561Z Last Updated: 2025-07-31T15:14:06.812Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Alfasado Inc. Products: PowerCMS Problem Types: CWE-22 Description: A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.powercms.jp/news/release-powercms-671-531-461.html - https://jvn.jp/en/vu/JVNVU93412964/
CVE ID: CVE-2025-41399 State: PUBLISHED Published: 2025-05-07T22:04:07.220Z Last Updated: 2025-05-08T13:23:51.078Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Next, BIG-IP Next SPK, BIG-IP Next CNF Problem Types: CWE-404 Description: When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000137709