Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ally executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wftpserver.com - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
CVE ID: CVE-2025-47812 State: PUBLISHED Published: 2025-07-10T00:00:00.000Z Last Updated: 2025-10-21T22:45:22.604Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: wftpserver Products: Wing FTP Server Problem Types: CWE-158 Description: In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP acco
code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wftpserver.com - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ - https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server - https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server
CVE ID: CVE-2025-47813 State: PUBLISHED Published: 2025-07-10T00:00:00.000Z Last Updated: 2025-07-10T18:17:47.258Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wftpserver Products: Wing FTP Server Problem Types: CWE-209 Description: loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wftpserver.com - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt
CVE ID: CVE-2025-47814 State: PUBLISHED Published: 2025-05-10T00:00:00.000Z Last Updated: 2025-05-13T14:44:19.323Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: GNU Products: PSPP Problem Types: CWE-122 Description: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from spv_read_xml_member) in zip-reader.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?67074
CVE ID: CVE-2025-47815 State: PUBLISHED Published: 2025-05-10T00:00:00.000Z Last Updated: 2025-05-12T19:01:58.396Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: GNU Products: PSPP Problem Types: CWE-122 Description: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from zip_member_read_all) in zip-reader.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?67075
CVE ID: CVE-2025-47816 State: PUBLISHED Published: 2025-05-10T00:00:00.000Z Last Updated: 2025-05-12T19:01:03.486Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: GNU Products: PSPP Problem Types: CWE-125 Description: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at the end of a document. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?67073
CVE ID: CVE-2025-47817 State: PUBLISHED Published: 2025-05-10T00:00:00.000Z Last Updated: 2025-05-12T18:59:36.462Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: BlueWave Products: Checkmate Problem Types: CWE-472 Description: In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bluewave-labs/Checkmate/pull/2161 - https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-rq7r-p9cq-5q4f - https://github.com/bluewave-labs/Checkmate/commit/b387ebaae96fc3a23b090a8baea7a9ebaa70f052
CVE ID: CVE-2025-47818 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-09-02T16:22:58.439Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Flock Safety Products: Gunshot Detection devices Problem Types: CWE-259 Description: Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert - https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safe
season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdf - https://gainsec.com/2025/06/19/plucked-and-rooted-device-1-debug-shell-on-flock-safetys-raven-gunshot-detection-system/
CVE ID: CVE-2025-47819 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-09-02T16:24:24.424Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Flock Safety Products: Gunshot Detection devices Problem Types: CWE-1191 Description: Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert - https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/wp-content/uploa
5/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdf - https://gainsec.com/2025/06/19/plucked-and-rooted-device-1-debug-shell-on-flock-safetys-raven-gunshot-detection-system/
CVE ID: CVE-2025-47820 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-09-02T16:26:12.446Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Flock Safety Products: Gunshot Detection devices Problem Types: CWE-312 Description: Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert - https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-s
-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdf - https://gainsec.com/2025/06/19/plucked-and-rooted-device-1-debug-shell-on-flock-safetys-raven-gunshot-detection-system/
CVE ID: CVE-2025-47821 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-09-02T16:27:32.117Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Flock Safety Products: Gunshot Detection devices Problem Types: CWE-259 Description: Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert - https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safety-re
n-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdf - https://gainsec.com/2025/06/19/plucked-and-rooted-device-1-debug-shell-on-flock-safetys-raven-gunshot-detection-system/
CVE ID: CVE-2025-47822 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-09-02T16:12:06.946Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Flock Safety Products: License Plate Reader Problem Types: CWE-1191 Description: Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert - https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.c
s://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/2025/06/19/grounded-flight-device-2-root-shell-on-flock-safetys-falcon-sparrow-automated-license-plate-reader/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdf
CVE ID: CVE-2025-47823 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-09-02T16:13:25.835Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Flock Safety Products: License Plate Reader Problem Types: CWE-259 Description: Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert - https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/2025/06/19/grounded-fli
/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/2025/06/19/grounded-flight-device-2-root-shell-on-flock-safetys-falcon-sparrow-automated-license-plate-reader/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdf
CVE ID: CVE-2025-47824 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-09-02T16:10:30.962Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Flock Safety Products: License Plate Reader Problem Types: CWE-312 Description: Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.flocksafety.com/articles/gunshot-detection-and-license-plate-reader-security-alert - https://gainsec.com/2025/06/19/bird-hunting-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/2025/06/19/grounded-flight-device
ing-season-security-research-on-flock-safety-anti-crime-systems/ - https://gainsec.com/2025/06/19/grounded-flight-device-2-root-shell-on-flock-safetys-falcon-sparrow-automated-license-plate-reader/ - https://gainsec.com/wp-content/uploads/2025/06/flock-safety-researcher-summary.pdf
CVE ID: CVE-2025-47827 State: PUBLISHED Published: 2025-06-05T00:00:00.000Z Last Updated: 2025-10-21T22:55:13.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Zedeldi/igelfs - https://github.com/Zedeldi/CVE-2025-47827
CVE ID: CVE-2025-47828 State: PUBLISHED Published: 2025-05-11T00:00:00.000Z Last Updated: 2025-05-12T14:38:42.773Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Lumi Products: H5P-Nodejs-library Problem Types: CWE-79 Description: Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3 - https://github.com/Lumieducation/H5P-Nodejs-library/pull/3894
CVE ID: CVE-2025-47849 State: PUBLISHED Published: 2025-06-10T23:07:54.526Z Last Updated: 2025-06-14T03:56:15.872Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-269 Description: A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and re
counts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following: * Strict validation on Role Type hierarchy: the caller's role must be equal to or higher than the target user's role. * API privilege comparison: the caller must possess all privileges of the user they are operating on. * Two new domain-level settings (restricted to the default admin):
ss all privileges of the user they are operating on. * Two new domain-level settings (restricted to the default admin): - role.types.allowed.for.operations.on.accounts.of.same.role.type: Defines which role types are allowed to act on users of the same role type. Default: "Admin, DomainAdmin, ResourceAdmin". - allow.operations.on.users.in.same.account: Allows/disallows user operations within the same account. Default: true. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/ - https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/ - https://lists.apache.o
blue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/ - https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60
CVE ID: CVE-2025-47850 State: PUBLISHED Published: 2025-05-20T17:37:43.234Z Last Updated: 2025-05-20T17:51:14.017Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-306 Description: In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-47851 State: PUBLISHED Published: 2025-05-20T17:37:44.096Z Last Updated: 2025-05-20T17:51:01.230Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-47852 State: PUBLISHED Published: 2025-05-20T17:37:44.700Z Last Updated: 2025-05-20T17:50:48.261Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-47853 State: PUBLISHED Published: 2025-05-20T17:37:45.475Z Last Updated: 2025-05-20T17:50:35.889Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-47854 State: PUBLISHED Published: 2025-05-20T17:37:46.240Z Last Updated: 2025-05-20T17:50:22.528Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-601 Description: In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-47856 State: PUBLISHED Published: 2025-10-14T13:42:47.612Z Last Updated: 2025-10-14T13:57:19.331Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:X/RC:C) Vendors: Fortinet Products: FortiVoice Problem Types: CWE-78 Description: Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-250
CVE ID: CVE-2025-47857 State: PUBLISHED Published: 2025-08-12T19:00:05.087Z Last Updated: 2025-08-13T20:13:28.582Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-253
CVE ID: CVE-2025-47858 State: REJECTED Published: N/A Last Updated: 2025-05-13T02:55:08.273Z Description: No description available.
CVE ID: CVE-2025-47859 State: REJECTED Published: N/A Last Updated: 2025-05-13T02:55:07.799Z Description: No description available.
CVE ID: CVE-2025-47860 State: REJECTED Published: N/A Last Updated: 2025-05-13T02:55:07.353Z Description: No description available.
CVE ID: CVE-2025-47861 State: REJECTED Published: N/A Last Updated: 2025-05-13T02:55:06.905Z Description: No description available.
CVE ID: CVE-2025-47862 State: REJECTED Published: N/A Last Updated: 2025-05-13T02:55:06.465Z Description: No description available.
CVE ID: CVE-2025-47863 State: REJECTED Published: N/A Last Updated: 2025-05-13T02:55:05.780Z Description: No description available.
CVE ID: CVE-2025-47864 State: REJECTED Published: N/A Last Updated: 2025-05-13T02:55:05.296Z Description: No description available.
CVE ID: CVE-2025-47865 State: PUBLISHED Published: 2025-06-17T17:42:30.922Z Last Updated: 2025-06-18T03:56:07.629Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex Central Problem Types: CWE-475 Description: A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019355 - https://www.zerodayinitiative.com/advisories/ZDI-25-295/
CVE ID: CVE-2025-47866 State: PUBLISHED Published: 2025-06-17T17:42:42.396Z Last Updated: 2025-06-17T18:36:07.522Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Trend Micro, Inc. Products: Trend Micro Apex Central Problem Types: CWE-475 Description: An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019355 - https://www.zerodayinitiative.com/advisories/ZDI-25-296/
CVE ID: CVE-2025-47867 State: PUBLISHED Published: 2025-06-17T17:42:55.846Z Last Updated: 2025-06-18T03:56:08.682Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex Central Problem Types: CWE-74 Description: A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0019355 - https://www.zerodayinitiative.com/advisories/ZDI-25-297/
CVE ID: CVE-2025-47868 State: PUBLISHED Published: 2025-06-16T11:00:05.293Z Last Updated: 2025-06-16T16:12:13.504Z Vendors: Apache Software Foundation Products: Apache NuttX RTOS: tools/bdf-converter. Problem Types: CWE-787, CWE-122 Description: Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part of Apache NuttX RTOS repository. This standalone program is optional and neither part of NuttX RTOS nor Applications runtime, but active bdf-converter users may be affected when this tool is exposed to external provided user data data (i.e. publicly available automation). This issue affects Apac
n this tool is exposed to external provided user data data (i.e. publicly available automation). This issue affects Apache NuttX: from 6.9 before 12.9.0. Users are recommended to upgrade to version 12.9.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/nuttx/pull/16000 - https://lists.apache.org/thread/p4o2lcqgspx3ws1n2p4wmoqbqow1w1pw
CVE ID: CVE-2025-47869 State: PUBLISHED Published: 2025-06-16T11:00:37.755Z Last Updated: 2025-06-16T16:10:04.916Z Vendors: Apache Software Foundation Products: Apache NuttX RTOS Problem Types: CWE-119 Description: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In this example application device stats structure that stored remotely provided parameters had hardcoded buffer size which could lead to buffer overflow. Structure members buffers were updated to valid size of CONFIG_XMLRPC_STRINGSIZE+1. This issue affects Apache NuttX RTOS users that may have used or base their code on exampl
f CONFIG_XMLRPC_STRINGSIZE+1. This issue affects Apache NuttX RTOS users that may have used or base their code on example application as presented in releases from 6.22 before 12.9.0. Users of XMLRPC in Apache NuttX RTOS are advised to review their code for this pattern and update buffer sizes as presented in the version of the example in release 12.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/nuttx-apps/pull/3027 - https://lists.apache.org/thread/306qcqyc3bpb2ozh015yxjo9kqs4jbvj