Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54906 State: PUBLISHED Published: 2025-09-09T17:00:57.894Z Last Updated: 2025-11-21T18:18:06.799Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Office 2016 Problem Types: CWE-416 Description: Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vul
ap in Microsoft Office allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54906
CVE ID: CVE-2025-54907 State: PUBLISHED Published: 2025-09-09T17:00:58.387Z Last Updated: 2025-11-21T18:18:07.442Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024 Problem Types: CWE-122 Description: Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54907
CVE ID: CVE-2025-54908 State: PUBLISHED Published: 2025-09-09T17:00:58.996Z Last Updated: 2025-11-21T18:18:07.933Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft PowerPoint 2016 Problem Types: CWE-416 Description: Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54908
CVE ID: CVE-2025-54910 State: PUBLISHED Published: 2025-09-09T17:01:28.456Z Last Updated: 2025-11-21T18:18:38.905Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2024, Microsoft Office 2016 Problem Types: CWE-122 Description: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54910
CVE ID: CVE-2025-54911 State: PUBLISHED Published: 2025-09-09T17:01:29.123Z Last Updated: 2025-11-21T18:18:39.555Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54911
CVE ID: CVE-2025-54912 State: PUBLISHED Published: 2025-09-09T17:01:29.642Z Last Updated: 2025-11-21T18:18:40.139Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54912
CVE ID: CVE-2025-54913 State: PUBLISHED Published: 2025-09-09T17:00:59.724Z Last Updated: 2025-11-21T18:18:08.587Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54913
CVE ID: CVE-2025-54914 State: PUBLISHED Published: 2025-09-04T23:09:51.840Z Last Updated: 2025-11-21T18:18:45.793Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Networking Problem Types: CWE-284 Description: Azure Networking Elevation of Privilege Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54914
CVE ID: CVE-2025-54915 State: PUBLISHED Published: 2025-09-09T17:01:30.249Z Last Updated: 2025-11-21T18:18:40.725Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
atible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54915
CVE ID: CVE-2025-54916 State: PUBLISHED Published: 2025-09-09T17:01:00.277Z Last Updated: 2025-11-21T18:18:09.175Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-121 Description: Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ndows NTFS allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54916
CVE ID: CVE-2025-54917 State: PUBLISHED Published: 2025-09-09T17:01:30.944Z Last Updated: 2025-11-21T18:18:41.369Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-693 Description: Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Additional Analyst No
Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54917
CVE ID: CVE-2025-54918 State: PUBLISHED Published: 2025-09-09T17:01:00.822Z Last Updated: 2025-11-21T18:18:09.756Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
s NTLM allows an authorized attacker to elevate privileges over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54918
CVE ID: CVE-2025-54919 State: PUBLISHED Published: 2025-09-09T17:01:01.459Z Last Updated: 2025-11-21T18:18:10.307Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362 Description: Concurrent execution using shared resour
indows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54919
CVE ID: CVE-2025-54923 State: PUBLISHED Published: 2025-08-20T13:30:04.988Z Last Updated: 2025-08-20T17:23:04.154Z Vendors: Schneider Electric Products: EcoStruxure™ Power Monitoring Expert (PME), EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Problem Types: CWE-502 Description: CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enD
s: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE ID: CVE-2025-54924 State: PUBLISHED Published: 2025-08-20T13:39:10.986Z Last Updated: 2025-08-20T17:22:38.019Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: EcoStruxure™ Power Monitoring Expert (PME), EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Problem Types: CWE-918 Description: CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially crafted document to a vulnerable endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=S
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE ID: CVE-2025-54925 State: PUBLISHED Published: 2025-08-20T13:44:21.662Z Last Updated: 2025-08-20T17:22:14.962Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: EcoStruxure™ Power Monitoring Expert (PME), EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Problem Types: CWE-918 Description: CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-202
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE ID: CVE-2025-54926 State: PUBLISHED Published: 2025-08-20T13:48:02.393Z Last Updated: 2025-08-20T17:21:50.700Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure™ Power Monitoring Expert (PME), EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Problem Types: CWE-22 Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious file over HTTP which then gets executed. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
ploads a malicious file over HTTP which then gets executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE ID: CVE-2025-54927 State: PUBLISHED Published: 2025-08-20T13:51:04.959Z Last Updated: 2025-08-20T17:21:29.791Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: EcoStruxure™ Power Monitoring Expert (PME), EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Problem Types: CWE-22 Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
s a crafted path input that is processed by the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE ID: CVE-2025-54939 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-20T19:55:50.645Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: litespeedtech Products: LSQUIC Problem Types: CWE-770 Description: LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/litespeedtech/lsquic/blob/70486141724f85e97b08f510673e29f399bbae8f/CHANGELOG#L1-L3 - https://github.com/litespeedtech/lsquic/commit/4cd9252e77fb4a36b572e2167a84067d603d3b23 - https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote
b4a36b572e2167a84067d603d3b23 - https://www.imperva.com/blog/quic-leak-cve-2025-54939-new-high-risk-pre-handshake-remote-denial-of-service-in-lsquic-quic-implementation/ - https://blog.litespeedtech.com/2025/08/18/litespeed-security-update/
CVE ID: CVE-2025-54940 State: PUBLISHED Published: 2025-08-08T04:34:02.380Z Last Updated: 2025-08-08T16:11:14.551Z Severity: LOW (CVSS 3.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: WPEngine, Inc. Products: Advanced Custom Fields Problem Types: CWE-94 Description: An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advancedcustomfields.com/blog/acf-6-4-3-security-release/ - https://jvn.jp/en/jp/JVN21048820/
CVE ID: CVE-2025-54941 State: PUBLISHED Published: 2025-10-30T09:45:26.712Z Last Updated: 2025-11-04T21:12:56.896Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-78 Description: An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes implemented in Airflow 3.0.5 accordingly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
and apply the changes implemented in Airflow 3.0.5 accordingly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1
CVE ID: CVE-2025-54942 State: PUBLISHED Published: 2025-08-30T03:37:02.439Z Last Updated: 2025-09-02T17:27:19.628Z Vendors: SUNNET Technology Co., Ltd. Products: Corporate Training Management System Problem Types: CWE-306 Description: A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deployment functionality without prior authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/
CVE ID: CVE-2025-54943 State: PUBLISHED Published: 2025-08-30T03:42:00.229Z Last Updated: 2025-09-02T17:39:00.673Z Vendors: SUNNET Technology Co., Ltd. Products: Corporate Training Management System Problem Types: CWE-862 Description: A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/
CVE ID: CVE-2025-54944 State: PUBLISHED Published: 2025-08-30T03:45:58.614Z Last Updated: 2025-09-02T17:39:19.510Z Vendors: SUNNET Technology Co., Ltd. Products: Corporate Training Management System Problem Types: CWE-434 Description: An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to write malicious code in a specific file, which may lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/
CVE ID: CVE-2025-54945 State: PUBLISHED Published: 2025-08-30T03:50:54.588Z Last Updated: 2025-09-02T17:39:37.982Z Vendors: SUNNET Technology Co., Ltd. Products: Corporate Training Management System Problem Types: CWE-73 Description: An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/
CVE ID: CVE-2025-54946 State: PUBLISHED Published: 2025-08-30T03:58:59.408Z Last Updated: 2025-09-02T17:25:14.327Z Vendors: SUNNET Technology Co., Ltd. Products: Corporate Training Management System Problem Types: CWE-89 Description: A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zuso.ai/advisory/
CVE ID: CVE-2025-54948 State: PUBLISHED Published: 2025-08-05T13:00:19.905Z Last Updated: 2025-10-21T22:45:21.386Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex One Problem Types: CWE-78 Description: A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/en-US/solution/KA-0020652