Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48703 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-11-04T23:20:24.060Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: centos-webpanel Products: CentOS Web Panel Problem Types: CWE-78 Description: CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fenrisk.com/rce-centos-webpanel
CVE ID: CVE-2025-48705 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-23T14:08:18.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in COROS PACE 3 through 3.0808.0. Due to a NULL pointer dereference vulnerability, sending a crafted BLE message forces the device to reboot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-027.txt
CVE ID: CVE-2025-48706 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-23T15:44:40.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces the device to reboot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-028.txt
CVE ID: CVE-2025-48707 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T20:05:50.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be shared among administrators, which can cause secret sharing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisories.stormshield.eu/2025-003/
CVE ID: CVE-2025-48708 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-24T00:11:29.484Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Artifex Products: Ghostscript Problem Types: CWE-212 Description: gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708446 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=b587663c623b4462f9e78686a31fd88020
cgi?id=708446 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=b587663c623b4462f9e78686a31fd880207303ee
CVE ID: CVE-2025-48709 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-11-14T17:10:21.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BMC Control-M 9.0.21.300. When Control-M Server has a database connection, it runs DBUStatus.exe frequently, which then calls dbu_connection_details.vbs with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Additional Analyst Notes: - CISA ADP Vulnrichment: BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access co
21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307. Reported to BMC by Derrick Polakoff. References: - https://bmc.com - https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Ser
- https://bmc.com - https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9021/Patches/Control-M-Server-PACTV-9-0-21-307/
CVE ID: CVE-2025-48710 State: PUBLISHED Published: 2025-06-04T05:50:48.639Z Last Updated: 2025-06-04T13:23:37.851Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: kro.run Products: kro Problem Types: CWE-441 Description: kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kro-ru
e execution on cluster nodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kro-run/kro/compare/v0.2.1...v0.2.2 - https://orca.security/resources/blog/kubernetes-crd-abstraction-risks-kro/
CVE ID: CVE-2025-48726 State: PUBLISHED Published: 2025-10-03T18:10:33.458Z Last Updated: 2025-10-03T18:57:50.791Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-48727 State: PUBLISHED Published: 2025-10-03T18:10:39.613Z Last Updated: 2025-10-03T18:58:24.023Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-48728 State: PUBLISHED Published: 2025-10-03T18:10:45.768Z Last Updated: 2025-10-03T18:59:15.931Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-48729 State: PUBLISHED Published: 2025-10-03T18:10:51.245Z Last Updated: 2025-10-06T17:16:57.435Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-48730 State: PUBLISHED Published: 2025-10-03T18:10:57.322Z Last Updated: 2025-10-03T20:47:53.789Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-134 Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.c
h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-36
CVE ID: CVE-2025-48731 State: PUBLISHED Published: 2025-08-11T18:56:59.077Z Last Updated: 2025-08-11T19:35:23.834Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-862 Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the user does not have access for via edit subscription endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-48732 State: PUBLISHED Published: 2025-07-24T15:10:56.720Z Last Updated: 2025-11-03T20:04:54.914Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: WWBN Products: AVideo Problem Types: CWE-184 Description: An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can request a .phar file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2213
CVE ID: CVE-2025-48733 State: PUBLISHED Published: 2025-07-22T21:35:52.983Z Last Updated: 2025-07-23T19:56:55.222Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: DuraComm Corporation Products: SPM-500 DP-10iN-100-MU Problem Types: CWE-306 Description: DuraComm SPM-500 DP-10iN-100-MU lacks access controls for a function that should require user authentication. This could allow an attacker to repeatedly reboot the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-01 - https://duracomm.com/contact-us/
CVE ID: CVE-2025-48734 State: PUBLISHED Published: 2025-05-28T13:32:08.300Z Last Updated: 2025-11-03T20:04:56.273Z Vendors: Apache Software Foundation Products: Apache Commons BeanUtils 1.x, Apache Commons BeanUtils 2.x Problem Types: CWE-284 Description: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 ad
nsequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a spe
y code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue
artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9
CVE ID: CVE-2025-48735 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-23T21:17:34.087Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: BOS Products: IP camera Problem Types: CWE-89 Description: A SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219 before 21.45.8.2.3_230220 allows remote attackers to obtain sensitive information from the database via crafted input in the request body. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bositaly.it/wp-content/uploads/2025/04/CAMERA-VULNERABILITY-REPORT-SQL-INJECTION.pdf
CVE ID: CVE-2025-48738 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-23T21:20:50.611Z Vendors: StrangeBee Products: TheHive Problem Types: CWE-770 Description: An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows unauthenticated remote attackers to use the password reset feature without limits. This can lead to several consequences, including mailbox storage exhaustion for targeted users, reputation damage to the SMTP server, potentially causing it to be blacklisted, and overload of the SMTP server's outbound mail queue. Additional Analyst Notes: - CISA ADP Vulnrichment
be blacklisted, and overload of the SMTP server's outbound mail queue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEC-ADV-2025-003.md
CVE ID: CVE-2025-48739 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-23T21:20:03.729Z Vendors: StrangeBee Products: TheHive Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows remote authenticated attackers with admin permissions (allowing them to access specific API endpoints) to manipulate URLs to direct requests to unexpected hosts or ports. This allows the attacker to use a TheHive server as a proxy to reach internal or otherwise restricted resources. This could be exploited to access other servers on the intern
proxy to reach internal or otherwise restricted resources. This could be exploited to access other servers on the internal network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEC-ADV-2025-002.md
CVE ID: CVE-2025-48740 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-23T21:18:48.947Z Vendors: StrangeBee Products: TheHive Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows a remote attacker to trigger requests on their victim's behalf, if the attacker lures a privileged user, authenticated with basic authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEC-ADV-2025-001.md
CVE ID: CVE-2025-48741 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-23T21:19:24.490Z Vendors: StrangeBee Products: TheHive Problem Types: CWE-266 Description: A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote, authenticated, and unprivileged users to retrieve alerts, cases, logs, observables, or tasks, regardless of the user's permissions, through a specific API endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/StrangeBeeCorp/Security/blob/main/Security%20advisories/SB-SEC-ADV-2025-004.md
CVE ID: CVE-2025-48742 State: PUBLISHED Published: 2025-05-27T00:00:00.000Z Last Updated: 2025-06-03T17:40:18.320Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: SIGB Products: PMB Problem Types: CWE-306 Description: The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sigb.net/index.php?lvl=cmspage&pageid=6&id_rubrique=553&opac_view=1 - https://forge.sigb.net/projects/pmb/wiki/Changelog_801#CHANGE-LOG-8012-2025-03-03
CVE ID: CVE-2025-48743 State: PUBLISHED Published: 2025-05-27T00:00:00.000Z Last Updated: 2025-05-27T13:43:47.223Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SIGB Products: PMB Problem Types: CWE-89 Description: SIGB PMB before 8.0.1.2 allows SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sigb.net/index.php?lvl=cmspage&pageid=6&id_rubrique=553&opac_view=1 - https://forge.sigb.net/projects/pmb/wiki/Changelog_801#CHANGE-LOG-8012-2025-03-03
CVE ID: CVE-2025-48744 State: PUBLISHED Published: 2025-05-27T00:00:00.000Z Last Updated: 2025-05-27T14:08:23.205Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: SIGB Products: PMB Problem Types: CWE-22 Description: In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sigb.net/index.php?lvl=cmspage&pageid=6&id_rubrique=553&opac_view=1 - https://forge.sigb.net/projects/pmb/wiki/Changelog_801#CHANGE-LOG-8012-2025-03-03
CVE ID: CVE-2025-48745 State: REJECTED Published: N/A Last Updated: 2025-06-02T12:31:40.061Z Description: No description available.
CVE ID: CVE-2025-48746 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-05-30T16:57:49.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authentication for a Critical Function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://netwrix.com - https://community.netwrix.com/t/adv-2025-014-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/13951
CVE ID: CVE-2025-48747 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-05-28T17:49:09.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwrix Directory Manager (formerly Imanami GroupID) before and including v.11.0.0.0 and after v.11.1.25134.03 has Incorrect Permission Assignment for a Critical Resource. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://netwrix.com - https://community.netwrix.com/t/adv-2025-014-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/13951
CVE ID: CVE-2025-48748 State: PUBLISHED Published: 2025-05-29T00:00:00.000Z Last Updated: 2025-05-29T15:20:20.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.netwrix.com/t/adv-2025-013-hard-coded-password-in-netwrix-directory-manager-formerly-imanami-groupid-v10-and-earlier/13945
CVE ID: CVE-2025-48749 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-05-28T18:09:35.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and before & after v.11.1.25134.03 inserts Sensitive Information into Sent Data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://netwrix.com - https://community.netwrix.com/t/adv-2025-014-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/13951
CVE ID: CVE-2025-48751 State: PUBLISHED Published: 2025-05-24T00:00:00.000Z Last Updated: 2025-05-24T10:21:12.718Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: tickbh Products: ProcessLock Problem Types: CWE-362 Description: The process_lock crate 0.1.0 for Rust allows data races in unlock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tickbh/ProcessLock/issues/1 - https://crates.io/crates/process_lock
CVE ID: CVE-2025-48752 State: PUBLISHED Published: 2025-05-24T00:00:00.000Z Last Updated: 2025-05-24T10:19:47.303Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Forestryks Products: process-sync-rs Problem Types: CWE-416 Description: In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Forestryks/process-sync-rs/issues/3 - https://crates.io/crates/process-sync
CVE ID: CVE-2025-48753 State: PUBLISHED Published: 2025-05-24T00:00:00.000Z Last Updated: 2025-05-24T10:19:20.813Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: obsidiandynamics Products: anode Problem Types: CWE-362 Description: In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/obsidiandynamics/anode/issues/1 - https://crates.io/crates/anode
CVE ID: CVE-2025-48754 State: PUBLISHED Published: 2025-05-24T00:00:00.000Z Last Updated: 2025-05-24T10:15:27.718Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: FractalFir Products: memory_pages Problem Types: CWE-369 Description: In the memory_pages crate 0.1.0 for Rust, division by zero can occur. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FractalFir/memory_pages/issues/1 - https://crates.io/crates/memory_pages
CVE ID: CVE-2025-48755 State: PUBLISHED Published: 2025-05-24T00:00:00.000Z Last Updated: 2025-05-24T10:14:00.839Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: blyssprivacy Products: sdk Problem Types: CWE-762 Description: In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/blyssprivacy/sdk/issues/36 - https://crates.io/crates/spiral-rs
CVE ID: CVE-2025-48756 State: PUBLISHED Published: 2025-05-24T00:00:00.000Z Last Updated: 2025-05-24T10:13:20.996Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: maboroshinokiseki Products: scsir Problem Types: CWE-843 Description: In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g., 5 bits) for group number. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/maboroshinokiseki/scsir/issues/4 - https://crates.io/crates/scsir