Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22939 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-08-18T16:33:18.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1levaZk5aC6g6a2zPW8xlOIVAu9MFYvAz/view - https://www.youtube.com/watch?v=Aic-QaSqjxc - https://lanrat.com/posts/adtran-isp-hacking/
CVE ID: CVE-2025-22940 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-08-18T16:34:32.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Adtran 411 ONT L80.00.0011.M2 allows unauthorized attackers to arbitrarily set the admin password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1levaZk5aC6g6a2zPW8xlOIVAu9MFYvAz/view - https://lanrat.com/posts/adtran-isp-hacking/
CVE ID: CVE-2025-22941 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-08-18T16:35:49.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1levaZk5aC6g6a2zPW8xlOIVAu9MFYvAz/view - https://lanrat.com/posts/adtran-isp-hacking/
CVE ID: CVE-2025-22946 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-14T14:53:30.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://noisy-caravel-a9a.notion.site/Tenda_AC9V1-0_V15-03-05-19_formSetDeviceName_sprintf_bof-16f898c94eac8057afcbceb63fda7d24
CVE ID: CVE-2025-22949 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-14T14:51:26.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://noisy-caravel-a9a.notion.site/Tenda_AC9V1-0_V15-03-05-19_formSetSambaConf_doSystemCmd_CI-16f898c94eac80d5801bdaf777ac2b27
CVE ID: CVE-2025-22952 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-03-03T15:58:00.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos - https://elest.io/open-source/memos - https://github.com/usememos/memos/issues/4413 - https://github.com/usememos/memos/pull/4428
CVE ID: CVE-2025-22953 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-15T14:19:05.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting malicious SQL payloads into the filter parameter, enabling the unauthorized execution of arbitrary SQL commands on the backend database. If certain features (like xp_cmdshell) are enabled, this may lead to remote code execution. Add
on the backend database. If certain features (like xp_cmdshell) are enabled, this may lead to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tinted-hollyhock-92d.notion.site/EPICOR-HCM-Unauthenticated-Blind-SQL-Injection-CVE-2025-22953-170f1fdee211803988d1c9255a8cb904?pvs=4 - https://www.epiusers.help/t/alert-hcm-security-patch/124777 - https://github.com/maliktawfiq/CVE-2025-22953
CVE ID: CVE-2025-22954 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-03-18T13:15:54.560Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Koha Products: Koha Problem Types: CWE-89 Description: GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829 - https://koha-community.org/koha-24-11-02-released/
CVE ID: CVE-2025-22956 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-09T17:32:39.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead to privilege escalation if any ProductPropertyState contains a secret only intended to be accessible by a subset of clients. One example of this is a domain join account password for the windomain package. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://opsi.org/en/product/releases/#4.3-20250129054911
CVE ID: CVE-2025-22957 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-03-20T15:46:39.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication. This vulnerability could potentially allow attackers to gain unauthorized access to the database and extract sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.zzcms.net/ - https://github.com/youyouiooi/vulnerability-reports/blob/main/CVE-2025-22957/REANDE.md
CVE ID: CVE-2025-22960 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-03-17T18:43:32.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: A session hijacking vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters. Unauthenticated attackers can access exposed log files (/logs/debug/xteLog*), potentially revealing sensitive session-related information such as session IDs (sess_id) and authentication success tokens (user_check_password OK). Exploiting this flaw could allow attackers to hijack active sessions, gain unauthorized access, and escalate privileges on affected devices. Additional Analyst Notes: - CISA A
tive sessions, gain unauthorized access, and escalate privileges on affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-22960
CVE ID: CVE-2025-22961 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-03-12T18:56:37.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access Control (CWE-284). Unauthenticated attackers can directly access sensitive database backup files (snapshot_users.db) via publicly exposed URLs (/logs/devcfg/snapshot/ and /logs/devcfg/user/). Exploiting this vulnerability allows retrieval of sensitive user data, including login credentials, potentially leading to full system compromise. Additional Analyst Notes: -
itive user data, including login credentials, potentially leading to full system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-22961
CVE ID: CVE-2025-22962 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-14T15:42:44.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: A critical remote code execution (RCE) vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters when debugging mode is enabled. An attacker with a valid session ID (sess_id) can send specially crafted POST requests to the /json endpoint, enabling arbitrary command execution on the underlying system. This vulnerability can lead to full system compromise, including unauthorized access, privilege escalation, and potentially full device takeover. Additional Analyst Notes: - CISA A
ding unauthorized access, privilege escalation, and potentially full device takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-22962
CVE ID: CVE-2025-22963 State: PUBLISHED Published: 2025-01-13T00:00:00.000Z Last Updated: 2025-08-12T13:27:52.613Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sismics Products: Teedy Problem Types: CWE-352 Description: Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sota70/teedy-v1.11-csrf - https://blog.teedy.io/ - https://github.com/sismics/docs/releases/tag/v1.11 - https://github.com/samplev45/CVE-2025-22963
CVE ID: CVE-2025-22964 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-02-03T18:27:25.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly incorporating user-supplied input into database queries without proper escaping or validation. Exploiting this issue enables unauthorized access, manipulation of data, or exposure of sensitive information, posing significant risks to the integrity and confid
access, manipulation of data, or exposure of sensitive information, posing significant risks to the integrity and confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/padayali-JD/CVE-2025-22964
CVE ID: CVE-2025-22968 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-03-14T15:58:11.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/CRUNZEX/CVE-DLINK-LTE - https://github.com/CRUNZEX/CVE-2025-22968
CVE ID: CVE-2025-22973 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T17:35:25.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in QiboSoft QiboCMS X1.0 allows a remote attacker to obtain sensitive information via the http_curl() function in the '/application/common. php' file that directly retrieves the URL request response content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/202110420106/CVE/blob/master/CVE-2025-22973.md
CVE ID: CVE-2025-22974 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-25T14:34:14.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/202110420106/CVE/blob/master/seacms/CVE-2025-22974.md
CVE ID: CVE-2025-22976 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-02-03T18:29:32.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a local attacker to execute arbitrary code via not filtering the content correctly at the "checkOrder.php" shopId module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xiaosguang/cve/blob/main/dingfanzu/dingfanzu-CMS%20checkOrder.php%20shopId%20SQL-inject.md
CVE ID: CVE-2025-22978 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-13T14:47:56.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/elunez/eladmin/issues/863
CVE ID: CVE-2025-22980 State: PUBLISHED Published: 2025-01-22T00:00:00.000Z Last Updated: 2025-01-28T21:18:19.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan form on /admin/modules/circulation/loan.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/slims/slims9_bulian/issues/270 - https://mebroccoli.blogspot.com/2025/01/sql-injection-vulnerability-in-senayan.html
CVE ID: CVE-2025-22983 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-01-23T16:35:25.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/H3rmesk1t/vulnerability-paper/blob/main/iceCMS-2.2.0-Incorrect%20Access%20Control.md
CVE ID: CVE-2025-22984 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-01-23T16:33:57.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/H3rmesk1t/vulnerability-paper/blob/main/iceCMS-2.2.0-Incorrect%20Access%20Control2.md
CVE ID: CVE-2025-22992 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-06T20:53:20.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project >= 11.6.9. The vulnerability is caused by improper handling of user-supplied input in the data query parameter, allowing attackers to execute arbitrary SQL commands under specific conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emoncms/emoncms/issues/1916
CVE ID: CVE-2025-22994 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-03-19T14:41:31.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/o2oa/o2oa/issues/167
CVE ID: CVE-2025-22996 State: PUBLISHED Published: 2025-01-14T00:00:00 Last Updated: 2025-01-15T16:24:35.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the spf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/firmcrosser/blob/main/Linksys/E5600-2.md
CVE ID: CVE-2025-22997 State: PUBLISHED Published: 2025-01-14T00:00:00 Last Updated: 2025-01-15T16:19:08.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the prf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/firmcrosser/blob/main/Linksys/E5600-1.md
CVE ID: CVE-2025-23001 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-02-21T16:51:29.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's position is that the end user is supposed to edit the NGINX configuration template to set server_name (with this setting, Host header injection cannot occur). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s setting, Host header injection cannot occur). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CTFd/CTFd - https://codetoanbug.com/poc-cve-2025-23001-ctfd-english/ - https://blog.ctfd.io/ctfd-3-7-6/
CVE ID: CVE-2025-23006 State: PUBLISHED Published: 2025-01-23T11:37:41.148Z Last Updated: 2025-10-21T22:55:31.291Z Vendors: SonicWall Products: SMA1000 Problem Types: CWE-502 Description: Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002
CVE ID: CVE-2025-23007 State: PUBLISHED Published: 2025-01-30T09:44:17.800Z Last Updated: 2025-04-17T15:58:18.543Z Vendors: SonicWall Products: NetExtender Problem Types: CWE-269 Description: A vulnerability in the NetExtender Windows client log export function allows unauthorized access to sensitive Windows system files, potentially leading to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0005
CVE ID: CVE-2025-23008 State: PUBLISHED Published: 2025-04-10T18:55:06.669Z Last Updated: 2025-04-10T19:13:49.010Z Vendors: SonicWall Products: NetExtender Problem Types: CWE-250 Description: An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker to modify configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0006
CVE ID: CVE-2025-23009 State: PUBLISHED Published: 2025-04-10T18:55:52.641Z Last Updated: 2025-04-17T15:57:11.699Z Vendors: SonicWall Products: NetExtender Problem Types: CWE-250 Description: A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an arbitrary file deletion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0006
CVE ID: CVE-2025-23010 State: PUBLISHED Published: 2025-04-10T18:57:59.176Z Last Updated: 2025-04-17T15:56:20.519Z Vendors: SonicWall Products: NetExtender Problem Types: CWE-59 Description: An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to manipulate file paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0006
CVE ID: CVE-2025-23011 State: PUBLISHED Published: 2025-01-23T20:22:30.958Z Last Updated: 2025-02-06T21:27:16.765Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fedora Repository Products: Fedora Repository Problem Types: CWE-23 Description: Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23). A
released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json - https://github.com/fcrepo-exts/migration-utils - https://github.com/fcrepo/fcrepo/releases
CVE ID: CVE-2025-23012 State: PUBLISHED Published: 2025-01-23T20:25:00.614Z Last Updated: 2025-02-12T20:41:30.107Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Fedora Repository Products: Fedora Repository Problem Types: CWE-1392 Description: Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSA
5-01-23). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json - https://wiki.lyrasis.org/display/FEDORA38/XACML+Policy+Enforcement#XACMLPolicyEnforcement-4.1fedora-usersattributes - https://github.com/fcrepo-exts/migration-utils - https://github.com/fcrepo/fcrepo/releases
CVE ID: CVE-2025-23013 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-02-03T10:03:09.695Z Vendors: Yubico Products: pam-u2f Problem Types: CWE-394 Description: In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know
ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yubico.com/support/security-advisories/ysa-2025-01/
CVE ID: CVE-2025-23015 State: PUBLISHED Published: 2025-02-04T09:37:18.580Z Last Updated: 2025-02-15T00:10:34.356Z Vendors: Apache Software Foundation Products: Apache Cassandra Problem Types: CWE-267 Description: Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Users are recommended to upgrade
hes. This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/jmks4msbgkl65ssg69x728sv1m0hwz3s