Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-40780 State: PUBLISHED Published: 2025-10-22T15:48:27.146Z Last Updated: 2025-11-04T21:10:16.728Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: ISC Products: BIND 9 Problem Types: CWE-341 Description: In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. Additional Analyst Notes: -
16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2025-40780
CVE ID: CVE-2025-40795 State: PUBLISHED Published: 2025-09-09T08:48:00.987Z Last Updated: 2025-10-14T09:15:22.312Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: SIMATIC PCS neo V4.1, SIMATIC PCS neo V5.0, SIMATIC PCS neo V6.0, User Management Component (UMC) Problem Types: CWE-121 Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a stack-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated
ontain a stack-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-722410.html
CVE ID: CVE-2025-40796 State: PUBLISHED Published: 2025-09-09T08:48:02.550Z Last Updated: 2025-10-14T09:15:23.497Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: SIMATIC PCS neo V4.1, SIMATIC PCS neo V5.0, SIMATIC PCS neo V6.0, User Management Component (UMC) Problem Types: CWE-125 Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attack
in a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-722410.html
CVE ID: CVE-2025-40797 State: PUBLISHED Published: 2025-09-09T08:48:03.853Z Last Updated: 2025-10-14T09:15:24.703Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: SIMATIC PCS neo V4.1, SIMATIC PCS neo V5.0, SIMATIC PCS neo V6.0, User Management Component (UMC) Problem Types: CWE-125 Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attack
CVE ID: CVE-2025-40798 State: PUBLISHED Published: 2025-09-09T08:48:05.138Z Last Updated: 2025-10-14T09:15:26.323Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: SIMATIC PCS neo V4.1, SIMATIC PCS neo V5.0, SIMATIC PCS neo V6.0, User Management Component (UMC) Problem Types: CWE-125 Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attack
CVE ID: CVE-2025-40802 State: PUBLISHED Published: 2025-09-09T08:48:06.428Z Last Updated: 2025-09-09T19:33:45.612Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Siemens Products: RUGGEDCOM RST2428P Problem Types: CWE-400 Description: A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device may be susceptible to resource exhaustion when subjected to high volumes of query requests. This could allow an attacker to cause a temporary denial of service, with the system recovering once the activity stops. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/h
ty stops. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-494539.html
CVE ID: CVE-2025-40803 State: PUBLISHED Published: 2025-09-09T08:48:07.758Z Last Updated: 2025-09-09T19:33:24.620Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Siemens Products: RUGGEDCOM RST2428P Problem Types: CWE-200 Description: A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes certain non-critical information from the device. This could allow an unauthenticated attacker to access sensitive data, potentially leading to a breach of confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-494539.html
CVE ID: CVE-2025-40804 State: PUBLISHED Published: 2025-09-09T08:48:09.048Z Last Updated: 2025-09-09T19:32:58.905Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Siemens Products: SIMATIC Virtualization as a Service (SIVaaS) Problem Types: CWE-732 Description: A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a network share without any authentication. This could allow an attacker to access or alter sensitive data without proper authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-534283.html
CVE ID: CVE-2025-40809 State: PUBLISHED Published: 2025-10-14T09:15:27.478Z Last Updated: 2025-10-14T19:03:33.965Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Solid Edge SE2024, Solid Edge SE2025 Problem Types: CWE-787 Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichm
sh the application or execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-541582.html
CVE ID: CVE-2025-40810 State: PUBLISHED Published: 2025-10-14T09:15:28.668Z Last Updated: 2025-10-14T19:03:57.041Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Solid Edge SE2024, Solid Edge SE2025 Problem Types: CWE-787 Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichm
CVE ID: CVE-2025-40811 State: PUBLISHED Published: 2025-10-14T09:15:29.918Z Last Updated: 2025-10-14T19:04:17.527Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Solid Edge SE2024, Solid Edge SE2025 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichme
h the application or execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-541582.html
CVE ID: CVE-2025-40812 State: PUBLISHED Published: 2025-10-14T09:15:32.119Z Last Updated: 2025-10-14T19:04:38.253Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Solid Edge SE2024, Solid Edge SE2025 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichme
CVE ID: CVE-2025-40815 State: PUBLISHED Published: 2025-11-11T20:20:37.904Z Last Updated: 2025-11-12T18:29:21.159Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: LOGO! 12/24RCE, LOGO! 12/24RCEo, LOGO! 230RCE, LOGO! 230RCEo, LOGO! 24CE, LOGO! 24CEo, LOGO! 24RCE, LOGO! 24RCEo, SIPLUS LOGO! 12/24RCE, SIPLUS LOGO! 12/24RCEo, SIPLUS LOGO! 230RCE, SIPLUS LOGO! 230RCEo, SIPLUS LOGO! 24CE, SIPLUS LOGO! 24CEo, SIPLUS LOGO! 24RCE, SIPLUS LOGO! 24RCEo Problem Types: CWE-120 Description: A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1F
24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo
! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not properly validate the structure of TCP packets in several methods. This could allow an attacker to cause buffer overflows, get control over the instruction counter and run custom code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-267056.html
CVE ID: CVE-2025-40816 State: PUBLISHED Published: 2025-11-11T20:20:39.123Z Last Updated: 2025-11-12T14:39:43.852Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Siemens Products: LOGO! 12/24RCE, LOGO! 12/24RCEo, LOGO! 230RCE, LOGO! 230RCEo, LOGO! 24CE, LOGO! 24CEo, LOGO! 24RCE, LOGO! 24RCEo, SIPLUS LOGO! 12/24RCE, SIPLUS LOGO! 12/24RCEo, SIPLUS LOGO! 230RCE, SIPLUS LOGO! 230RCEo, SIPLUS LOGO! 24CE, SIPLUS LOGO! 24CEo, SIPLUS LOGO! 24RCE, SIPLUS LOGO! 24RCEo Problem Types: CWE-306 Description: A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1F
! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-267056.html
CVE ID: CVE-2025-40817 State: PUBLISHED Published: 2025-11-11T20:20:42.082Z Last Updated: 2025-11-12T14:38:40.704Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Siemens Products: LOGO! 12/24RCE, LOGO! 12/24RCEo, LOGO! 230RCE, LOGO! 230RCEo, LOGO! 24CE, LOGO! 24CEo, LOGO! 24RCE, LOGO! 24RCEo, SIPLUS LOGO! 12/24RCE, SIPLUS LOGO! 12/24RCEo, SIPLUS LOGO! 230RCE, SIPLUS LOGO! 230RCEo, SIPLUS LOGO! 24CE, SIPLUS LOGO! 24CEo, SIPLUS LOGO! 24RCE, SIPLUS LOGO! 24RCEo Problem Types: CWE-306 Description: A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-
2/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24C
GO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to change time of the device, which means the device could behave differently. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-267056.html
CVE ID: CVE-2025-40827 State: PUBLISHED Published: 2025-11-11T20:20:43.538Z Last Updated: 2025-11-12T14:11:50.216Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Siemens Software Center, Solid Edge SE2025 Problem Types: CWE-427 Description: A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10). The affected application is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code via placing a crafted DLL file on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/ht
system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-365596.html
CVE ID: CVE-2025-40834 State: PUBLISHED Published: 2025-11-17T11:39:22.373Z Last Updated: 2025-11-17T14:08:48.152Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Siemens Products: Mendix RichText Problem Types: CWE-79 Description: A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could allow an attacker to execute cross-site scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-190588.html
CVE ID: CVE-2025-40836 State: PUBLISHED Published: 2025-09-25T14:49:02.613Z Last Updated: 2025-09-30T12:14:36.904Z Vendors: Ericsson Products: Indoor Connect 8855 Problem Types: CWE-20 Description: Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25
CVE ID: CVE-2025-40837 State: PUBLISHED Published: 2025-09-25T14:52:23.376Z Last Updated: 2025-09-30T12:15:13.648Z Vendors: Ericsson Products: Indoor Connect 8855 Problem Types: CWE-862 Description: Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges than intended. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25
CVE ID: CVE-2025-40838 State: PUBLISHED Published: 2025-09-25T14:54:43.229Z Last Updated: 2025-09-30T12:15:44.492Z Vendors: Ericsson Products: Indoor Connect 8855 Problem Types: CWE-522 Description: Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disclosure of certain information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25
CVE ID: CVE-2025-40843 State: PUBLISHED Published: 2025-10-28T18:49:49.516Z Last Updated: 2025-10-28T19:30:25.737Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Ericsson Products: CodeChecker Problem Types: CWE-121 Description: CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command. This issue affects CodeChecker: through 6.26.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Ericsson/codechecker/securi
6.26.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Ericsson/codechecker/security/advisories/GHSA-5xf2-f6ch-6p8r
CVE ID: CVE-2025-40846 State: PUBLISHED Published: 2025-05-08T08:15:06.510Z Last Updated: 2025-05-08T14:07:49.368Z Vendors: HaloITSM Products: ITSM Problem Types: CWE-20, CWE-601 Description: Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to malicious websites (Open Redirect) and inject JavaScript code to perform cross site scripting attack. The vulnerability affects Halo versions up to 2.174.101 and all versions between 2.175.1 and 2.184.21 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.haloservicedesk.com/kb?id=2501
CVE ID: CVE-2025-40885 State: PUBLISHED Published: 2025-10-07T12:35:57.566Z Last Updated: 2025-10-07T13:35:18.140Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-89 Description: A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:6-01
CVE ID: CVE-2025-40886 State: PUBLISHED Published: 2025-10-07T12:36:34.324Z Last Updated: 2025-10-07T13:10:08.763Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-89 Description: A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SQL statements on the DBMS used by the web application, potentially exposing unauthorized data, altering their structure and content, and/or affecting their availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
and content, and/or affecting their availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:7-01
CVE ID: CVE-2025-40887 State: PUBLISHED Published: 2025-10-07T12:37:10.142Z Last Updated: 2025-10-07T13:09:33.674Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-89 Description: A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:8-01
CVE ID: CVE-2025-40888 State: PUBLISHED Published: 2025-10-07T12:38:39.042Z Last Updated: 2025-10-07T13:08:15.336Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-89 Description: A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:10-01
CVE ID: CVE-2025-40889 State: PUBLISHED Published: 2025-10-07T12:37:58.635Z Last Updated: 2025-10-07T13:08:57.420Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-22 Description: A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenticated user with limited privileges, by issuing a specifically-crafted request, can potentially alter the structure and content of files in the /data folder, and/or affect their availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.
ct their availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:9-01
CVE ID: CVE-2025-40906 State: PUBLISHED Published: 2025-05-16T15:15:49.810Z Last Updated: 2025-09-09T13:54:31.287Z Vendors: MONGODB Products: BSON::XS Problem Types: CWE-1395, CWE-1104, CWE-122, CWE-190 Description: BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.
ust 13, 2020 and is no longer supported. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html - https://www.mongodb.com/community/forums/t/mongodb-perl-driver-end-of-life/7890