Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22423 State: PUBLISHED Published: 2025-09-02T22:11:14.667Z Last Updated: 2025-09-03T15:46:24.359Z Vendors: Google Products: Android Problem Types: Denial of service Description: In ParseTag of dng_ifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/external/dng_sdk/+/748dbd7dfcecb19f3a19caaba4285e059f32d2dd - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22425 State: PUBLISHED Published: 2025-09-04T17:11:43.156Z Last Updated: 2025-09-06T03:55:37.100Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/8575592802b9527fe0f7cf19e9cb7159c9aa5121 - https://android.googlesource.com/platform/frameworks/base/+/942884abf148426e948774b
2802b9527fe0f7cf19e9cb7159c9aa5121 - https://android.googlesource.com/platform/frameworks/base/+/942884abf148426e948774b4857052da77ef77b3 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-22427 State: PUBLISHED Published: 2025-09-02T22:11:15.672Z Last Updated: 2025-09-04T03:55:38.138Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/7255b2eaac4b5cb1bc3bbf23509b33c7355a8657 - https://source
s://android.googlesource.com/platform/packages/apps/Settings/+/7255b2eaac4b5cb1bc3bbf23509b33c7355a8657 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22428 State: PUBLISHED Published: 2025-09-02T22:11:16.691Z Last Updated: 2025-09-04T03:55:37.044Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/4a9cb946e978d9d93f9ee0a2c4c8
nrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/4a9cb946e978d9d93f9ee0a2c4c8ca41ba774540 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22429 State: PUBLISHED Published: 2025-09-02T22:11:17.697Z Last Updated: 2025-09-03T15:46:03.618Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/ece83fb425b1e912a036e9985b710910e2e3ca37 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22430 State: PUBLISHED Published: 2025-09-02T22:11:18.681Z Last Updated: 2025-09-03T15:45:56.745Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/161eb6100d6f75f0a0df6da3d19da7fe842655c1 - https://source.android.com/security/bulletin/2025-04-
tform/frameworks/base/+/161eb6100d6f75f0a0df6da3d19da7fe842655c1 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22431 State: PUBLISHED Published: 2025-09-02T22:11:19.663Z Last Updated: 2025-09-03T15:45:50.218Z Vendors: Google Products: Android Problem Types: Denial of service Description: In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in the code. This could lead to local denial of service until the phone reboots with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/79211e094a7363f28a06cea2737aa815339911ad - htt
References: - https://android.googlesource.com/platform/frameworks/base/+/79211e094a7363f28a06cea2737aa815339911ad - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22433 State: PUBLISHED Published: 2025-09-02T22:11:20.673Z Last Updated: 2025-09-04T03:55:35.938Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Profile scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/d2216fc62a9e1253828bf4cfdf5395948f2e78c6
ent: References: - https://android.googlesource.com/platform/frameworks/base/+/d2216fc62a9e1253828bf4cfdf5395948f2e78c6 - https://android.googlesource.com/platform/packages/modules/IntentResolver/+/20cef18d8d9b817823d8d8d505cc382d3b334f34 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22434 State: PUBLISHED Published: 2025-09-02T22:11:21.647Z Last Updated: 2025-09-04T03:55:34.854Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/2880f0ab2dc63dc6ea820afb79e9be523ecb7074 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22435 State: PUBLISHED Published: 2025-09-02T22:11:22.630Z Last Updated: 2025-09-04T03:55:33.794Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/efa5f4ef386a8947f4777840c5cefff389740e86 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22437 State: PUBLISHED Published: 2025-09-02T22:11:23.647Z Last Updated: 2025-09-04T03:55:32.753Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/339d20053956ec0f92384f0b7cefda4fa7126290 - https://source.android.co
glesource.com/platform/packages/modules/Bluetooth/+/339d20053956ec0f92384f0b7cefda4fa7126290 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22438 State: PUBLISHED Published: 2025-09-02T22:11:24.666Z Last Updated: 2025-09-04T03:55:31.734Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/native/+/7ac747cb442d382c74a18d26268b7fc3751537ce - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22439 State: PUBLISHED Published: 2025-09-02T22:11:25.681Z Last Updated: 2025-09-04T03:55:30.676Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/1f283d5b87d0c8f04a79d1d2a51ed4d9327ae864 - https://source.android.co
oglesource.com/platform/packages/apps/DocumentsUI/+/1f283d5b87d0c8f04a79d1d2a51ed4d9327ae864 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22441 State: PUBLISHED Published: 2025-09-04T18:17:24.935Z Last Updated: 2025-09-06T03:55:35.236Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-08-01
CVE ID: CVE-2025-22442 State: PUBLISHED Published: 2025-09-02T22:11:26.672Z Last Updated: 2025-09-04T03:55:28.500Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/2095d130b4d7f2ba1a3284abb58ca894817f5f4a - https://
ences: - https://android.googlesource.com/platform/frameworks/base/+/2095d130b4d7f2ba1a3284abb58ca894817f5f4a - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22443 State: PUBLISHED Published: 2025-03-04T03:44:38.676Z Last Updated: 2025-03-04T15:22:29.072Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-03.md
CVE ID: CVE-2025-22445 State: PUBLISHED Published: 2025-01-09T06:55:13.389Z Last Updated: 2025-01-09T15:46:51.120Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-754 Description: Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-22446 State: PUBLISHED Published: 2025-05-13T21:02:36.588Z Last Updated: 2025-05-15T04:01:56.914Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: Edge Orchestrator software for Intel(R) Tiber™ Edge Platform Problem Types: Escalation of Privilege, CWE-326 Description: Inadequate encryption strength for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escalation of privilege via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01239.html
CVE ID: CVE-2025-22447 State: PUBLISHED Published: 2025-03-06T03:56:03.508Z Last Updated: 2025-03-06T15:14:58.728Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: RSUPPORT Co.,Ltd. Products: RemoteView Agent (for Windows) Problem Types: CWE-276 Description: Incorrect access permission of a specific service issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. If this vulnerability is exploited, a non-administrative user on the remote PC may execute an arbitrary OS command with LocalSystem privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.rview.com/hc/ja/articles/38287019277843-%E7%B7%8A%E6%80%A5%E3%83
es: - CISA ADP Vulnrichment: References: - https://help.rview.com/hc/ja/articles/38287019277843-%E7%B7%8A%E6%80%A5%E3%83%91%E3%83%83%E3%83%81%E4%BD%9C%E6%A5%AD%E3%81%AE%E3%81%94%E6%A1%88%E5%86%85-2025-02-13-%E5%AE%8C%E4%BA%86 - https://jvn.jp/en/jp/JVN24992507/
CVE ID: CVE-2025-22448 State: PUBLISHED Published: 2025-05-13T21:02:38.132Z Last Updated: 2025-05-14T13:57:29.422Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: n/a Products: Intel(R) Simics(R) Package Manager software Problem Types: Denial of Service, CWE-277 Description: Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01297.html
CVE ID: CVE-2025-22449 State: PUBLISHED Published: 2025-01-09T06:54:53.029Z Last Updated: 2025-01-09T15:29:20.571Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-22450 State: PUBLISHED Published: 2025-01-22T05:49:13.793Z Last Updated: 2025-02-12T20:41:22.761Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: I-O DATA DEVICE, INC. Products: UD-LT2 Problem Types: CWE-1242 Description: Inclusion of undocumented features issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. A remote attacker may disable the LAN-side firewall function of the affected products, and open specific ports. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iodata.jp/support/information/2025/01_ud-lt2/ - https://jvn.jp/en/jp/JVN15293958/
CVE ID: CVE-2025-22452 State: PUBLISHED Published: 2025-04-07T02:35:30.455Z Last Updated: 2025-04-07T13:33:20.329Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125 Description: in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-04.md
CVE ID: CVE-2025-22454 State: PUBLISHED Published: 2025-03-11T14:11:30.497Z Last Updated: 2025-03-12T04:00:43.923Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Secure Access Client Problem Types: CWE-732 Description: Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/March-Security-Advisory-Ivanti-Secure-Access-Client-ISAC-CVE-2025-22454
CVE ID: CVE-2025-22455 State: PUBLISHED Published: 2025-06-10T14:38:36.559Z Last Updated: 2025-06-11T04:01:32.734Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Workspace Control Problem Types: CWE-321 Description: A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-CVE-2025-5353-CVE-CVE-2025-22463-CVE-2025-22455
CVE ID: CVE-2025-22457 State: PUBLISHED Published: 2025-04-03T15:20:23.628Z Last Updated: 2025-10-21T22:55:21.943Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure, Neurons for ZTA gateways Problem Types: CWE-121 Description: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secur
- CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457
CVE ID: CVE-2025-22458 State: PUBLISHED Published: 2025-04-08T14:25:42.603Z Last Updated: 2025-05-17T06:03:34.838Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-427 Description: DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2025-22459 State: PUBLISHED Published: 2025-04-08T14:25:57.827Z Last Updated: 2025-04-08T15:37:26.132Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-296 Description: Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2025-22460 State: PUBLISHED Published: 2025-05-13T15:09:30.912Z Last Updated: 2025-05-13T19:43:10.536Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: CSA (Cloud Services Appliance) Problem Types: CWE-1392 Description: Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CVE-2025-22460
CVE ID: CVE-2025-22461 State: PUBLISHED Published: 2025-04-08T14:26:23.423Z Last Updated: 2025-04-09T04:00:30.953Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-89 Description: SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2025-22462 State: PUBLISHED Published: 2025-05-13T15:10:17.923Z Last Updated: 2025-05-13T19:39:47.647Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Neurons for ITSM (on-prem) Problem Types: CWE-288 Description: An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-on-premises-only-CVE-2025-22462
CVE ID: CVE-2025-22463 State: PUBLISHED Published: 2025-06-10T14:39:06.714Z Last Updated: 2025-06-11T04:01:31.667Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Ivanti Products: Workspace Control Problem Types: CWE-321 Description: A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-CVE-2025-5353-CVE-CVE-2025-22463-CVE-2025-22455
CVE ID: CVE-2025-22464 State: PUBLISHED Published: 2025-04-08T14:27:03.158Z Last Updated: 2025-04-08T15:04:45.498Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-822 Description: An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local access to write arbitrary data into memory causing a denial-of-service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2025-22465 State: PUBLISHED Published: 2025-04-08T14:27:27.199Z Last Updated: 2025-04-08T14:52:54.418Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-79 Description: Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6