Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-47948 State: PUBLISHED Published: 2025-05-17T18:42:24.382Z Last Updated: 2025-05-19T14:43:51.360Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: cocotais Products: cocotais-bot Problem Types: CWE-74 Description: Cocotais Bot is a QQ official robot framework based on qq-bot-sdk. Starting in version 1.5.0-test2-hotfix and prior to version 1.6.2, command echoing feature in the framework allows users to indirectly trigger privileged behavior by injecting special platform tags. Specifically, an unauthorized user can use the `/echo <qqbot-at-everyone />` command to cause the bot to send a message that mentions all members in the chat, bypassing any
o <qqbot-at-everyone />` command to cause the bot to send a message that mentions all members in the chat, bypassing any permission controls. This can lead to spam, disruption, or abuse of notification systems. Version 1.6.2 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cocotais/cocotais-bot/security/advisories/GHSA-mj2c-8hxf-ffvq - https://github.com/cocotais/cocotais-bot/commit/d1cf01a9a41b3131241d1833444b890c8d6e70b8
CVE ID: CVE-2025-47949 State: PUBLISHED Published: 2025-05-19T19:28:45.476Z Last Updated: 2025-05-20T13:00:40.340Z Vendors: tngan Products: samlify Problem Types: CWE-347 Description: samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tngan/samlify/security/advisories/GHSA-r683-v43c-6xqv - https://github.com/tngan/samlify/commit/115679acd89f0a37ea3ebd8ff
ngan/samlify/security/advisories/GHSA-r683-v43c-6xqv - https://github.com/tngan/samlify/commit/115679acd89f0a37ea3ebd8fff7db54fca3e8af3
CVE ID: CVE-2025-47950 State: PUBLISHED Published: 2025-06-06T17:32:30.218Z Last Updated: 2025-06-06T21:27:05.841Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: coredns Products: coredns Problem Types: CWE-770 Description: CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory cons
goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are
e 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://` block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage, and/or monitor QUIC connection patterns and alert on anomalies. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coredns/coredns/security/advisories/GHSA-cvx7-x8pj-x2gw - https://github.com/coredns/coredns/commit/efaed02c6a480ec147b1f799aab7cf815b17dfe1 - https://datatracker.ietf.org/doc/html/rfc9250 - https://github.com/qui
commit/efaed02c6a480ec147b1f799aab7cf815b17dfe1 - https://datatracker.ietf.org/doc/html/rfc9250 - https://github.com/quic-go/quic-go - https://www.usenix.org/conference/usenixsecurity23/presentation/botella
CVE ID: CVE-2025-47951 State: PUBLISHED Published: 2025-06-16T20:57:52.509Z Last Updated: 2025-06-17T18:52:13.582Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: WeblateOrg Products: weblate Problem Types: CWE-307 Description: Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in version 5.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WeblateOrg/weblate/security/advisories/GHSA-5
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WeblateOrg/weblate/security/advisories/GHSA-57jg-m997-cx3q - https://github.com/WeblateOrg/weblate/pull/14918 - https://github.com/WeblateOrg/weblate/commit/f806293451248c5d95e45b3b507e9d158bc4f384 - https://hackerone.com/reports/3150564 - https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.12.1
CVE ID: CVE-2025-47952 State: PUBLISHED Published: 2025-05-30T03:37:12.685Z Last Updated: 2025-05-30T12:44:38.661Z Vendors: traefik Products: traefik Problem Types: CWE-22 Description: Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a URL encoded string in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions
rget a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.25 and 3.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/traefik/traefik/security/advisories/GHSA-vrch-868g-9jx5 - https://github.com/traefik/traefik/commit/08d5dfee0164aa54dd44a467870042e18e8d3f00 - https://github.com/traefik/traefik/releases/tag/v2.11.25 - https://github.com/traefik/traefik/releases/tag/v3.4.1
CVE ID: CVE-2025-47953 State: PUBLISHED Published: 2025-06-10T17:02:24.328Z Last Updated: 2025-07-11T16:36:29.550Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office for Android, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Office 2016 Problem Types: CWE-641 Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/
code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47953
CVE ID: CVE-2025-47954 State: PUBLISHED Published: 2025-08-12T17:10:30.610Z Last Updated: 2025-11-10T00:12:35.276Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 (CU 20) Problem Types: CWE-89 Description: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47954
CVE ID: CVE-2025-47955 State: PUBLISHED Published: 2025-06-10T17:02:25.030Z Last Updated: 2025-07-11T16:36:30.217Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-269 Description: Improper privilege management in Windows Remote Access Connection Manager allows an authorized attacker to elevate pr
n: Improper privilege management in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47955
CVE ID: CVE-2025-47956 State: PUBLISHED Published: 2025-06-10T17:02:25.582Z Last Updated: 2025-07-11T16:36:55.339Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Security App Problem Types: CWE-73 Description: External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47956
CVE ID: CVE-2025-47957 State: PUBLISHED Published: 2025-06-10T17:02:05.558Z Last Updated: 2025-07-11T16:36:09.816Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024 Problem Types: CWE-416 Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47957
CVE ID: CVE-2025-47959 State: PUBLISHED Published: 2025-06-13T01:10:44.802Z Last Updated: 2025-07-11T16:36:51.763Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2022 version 17.12, Microsoft Visual Studio 2022 version 17.8, Microsoft Visual Studio 2022 version 17.10, Microsoft Visual Studio 2022 version 17.14 Problem Types: CWE-77 Description: Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-
code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47959
CVE ID: CVE-2025-47962 State: PUBLISHED Published: 2025-06-10T17:02:26.707Z Last Updated: 2025-07-11T16:36:31.447Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows SDK Problem Types: CWE-284 Description: Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47962
CVE ID: CVE-2025-47963 State: PUBLISHED Published: 2025-07-11T16:36:54.605Z Last Updated: 2025-07-14T16:13:58.688Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: Spoofing Description: No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47963
CVE ID: CVE-2025-47964 State: PUBLISHED Published: 2025-07-11T16:36:54.030Z Last Updated: 2025-07-14T15:59:48.065Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: Spoofing Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47964
CVE ID: CVE-2025-47966 State: PUBLISHED Published: 2025-06-05T20:59:02.172Z Last Updated: 2025-07-11T16:36:32.561Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Power Automate for Desktop Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47966
CVE ID: CVE-2025-47967 State: PUBLISHED Published: 2025-09-16T18:13:10.558Z Last Updated: 2025-11-21T18:18:17.676Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: CWE-357 Description: Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47967
CVE ID: CVE-2025-47968 State: PUBLISHED Published: 2025-06-10T17:02:45.023Z Last Updated: 2025-07-11T16:36:52.326Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft AutoUpdate for Mac Problem Types: CWE-20 Description: Improper input validation in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47968
CVE ID: CVE-2025-47969 State: PUBLISHED Published: 2025-06-10T17:02:27.277Z Last Updated: 2025-07-11T16:36:31.947Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-202
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47969
CVE ID: CVE-2025-47971 State: PUBLISHED Published: 2025-07-08T16:57:02.439Z Last Updated: 2025-08-23T00:39:21.805Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2019 (Server Core installation), Windows 10 Version 1809, Windows Server 2019, Windows 10 Version 21H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows 10 Version 1607, Windows Server 2016 (Server Core installation), Wi
ver Core installation), Windows Server 2025, Windows 10 Version 1607, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012 (Server Core installation), Windows 10 Version 1507, Windows Server 2012 R2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2012, Windows Server 2012 R2 (Server Core installation), Windows Server 2016 Problem Types: CWE-126 Description: Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. Additiona
n: Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47971
CVE ID: CVE-2025-47972 State: PUBLISHED Published: 2025-07-08T16:57:03.232Z Last Updated: 2025-08-23T00:39:22.860Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Window
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47972
CVE ID: CVE-2025-47973 State: PUBLISHED Published: 2025-07-08T16:57:28.952Z Last Updated: 2025-08-23T00:39:49.057Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-126 Description: Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. Additiona
n: Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47973
CVE ID: CVE-2025-47975 State: PUBLISHED Published: 2025-07-08T16:57:29.542Z Last Updated: 2025-08-23T00:39:49.714Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Window
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-415 Description: Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. Additional Analyst Not
Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47975
CVE ID: CVE-2025-47976 State: PUBLISHED Published: 2025-07-08T16:57:04.268Z Last Updated: 2025-08-23T00:39:23.771Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. Additional Analys
n: Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47976
CVE ID: CVE-2025-47977 State: PUBLISHED Published: 2025-06-10T17:02:45.604Z Last Updated: 2025-07-11T16:36:52.886Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Nuance Digital Engagement Platform Problem Types: CWE-79 Description: Improper neutralization of input during web page generation ('cross-site scripting') in Nuance Digital Engagement Platform allows an unauthorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47977