Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-59431 State: PUBLISHED Published: 2025-09-19T19:29:13.163Z Last Updated: 2025-09-19T19:42:16.930Z Vendors: MapServer Products: MapServer Problem Types: CWE-89 Description: MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MapServer/MapServer/security/advisories/GHSA-256m-rx4h-r55w
CVE ID: CVE-2025-59432 State: PUBLISHED Published: 2025-09-22T19:22:37.117Z Last Updated: 2025-09-22T19:40:11.294Z Vendors: ongres Products: scram Problem Types: CWE-208, CWE-385 Description: SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. Th
rays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted. This vulnerability has been patched in version 3.1 by replacing Arrays.equals with MessageDigest.isEqual, which ensures constant-time comparison. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ongres/scram/security/advisories/GHSA-3wfh-36rx-9537 - https://github.com/ongres/scram/commit/f04975680d4a67bc84cc6c61bbffd5186223e2e2 - https://docs.oracle.com/
h-36rx-9537 - https://github.com/ongres/scram/commit/f04975680d4a67bc84cc6c61bbffd5186223e2e2 - https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/security/MessageDigest.html#isEqual(byte%5B%5D,byte%5B%5D)
CVE ID: CVE-2025-59433 State: PUBLISHED Published: 2025-09-22T19:14:54.237Z Last Updated: 2025-09-22T19:41:56.799Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H) Vendors: conventional-changelog Products: conventional-changelog Problem Types: CWE-88 Description: Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/git-client has an argument injection vulnerability. This vulnerability manifests with the library's getTags() API, which allows extra parameters to be passed to the git log command. In another API by this library, getRawCommits(), there are secure practic
arameters to be passed to the git log command. In another API by this library, getRawCommits(), there are secure practices taken to ensure that the extra parameter path is unable to inject an argument by ending the git log command with the special shell syntax --. However, the library does not follow the same practice for getTags() as it does not attempt to sanitize for user input, validate the given params, or restrict them to an allow list. Nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options. Thus, allowing users to exploit an argument injection vulnerability in Git due to the --output= command-line op
options. Thus, allowing users to exploit an argument injection vulnerability in Git due to the --output= command-line option that results with overwriting arbitrary files. This issue has been patched in version 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/conventional-changelog/conventional-changelog/security/advisories/GHSA-vh25-5764-9wcr - https://github.com/conventional-changelog/conventional-changelog/commit/d95c9ffac05af58228bd89fa0ba37ad65741c6a2
CVE ID: CVE-2025-59434 State: PUBLISHED Published: 2025-09-22T19:39:03.774Z Last Updated: 2025-09-22T19:47:56.540Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-200, CWE-284 Description: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScript Function node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets — resul
node. This includes secrets such as OpenAI API keys, AWS credentials, Supabase tokens, and Google Cloud secrets — resulting in a full cross-tenant data exposure. This issue has been patched in the August 2025 Cloud-Hosted Flowise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-435c-mg9p-fv22
CVE ID: CVE-2025-59436 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T19:13:04.583Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: fedorindutny Products: ip Problem Types: CWE-918 Description: The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cosmosofcyberspace.github.io/CVE-Application-Document.html - https://github.com/indutny/node-ip/issues/160
CVE ID: CVE-2025-59437 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T19:14:07.798Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: fedorindutny Products: ip Problem Types: CWE-918 Description: The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. NOTE: in current versions of several applications, connection attempts to the IP address 0 (interpreted as 0.0.0.0) are blocked with error messages such as net::ERR_ADDRESS_INVALID. However, in some situations
(interpreted as 0.0.0.0) are blocked with error messages such as net::ERR_ADDRESS_INVALID. However, in some situations that depend on both application version and operating system, connection attempts to 0 and 0.0.0.0 are considered connection attempts to 127.0.0.1 (and, for this reason, a false value of isPublic would be preferable). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cosmosofcyberspace.github.io/CVE-Application-Document.html - https://github.com/indutny/node-ip/tags
CVE ID: CVE-2025-59438 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T16:09:21.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mbed TLS through 3.6.4 has an Observable Timing Discrepancy. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/ - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-invalid-padding-error/
CVE ID: CVE-2025-59447 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:10:34.726Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: YoSmart Products: YoLink Smart Hub Problem Types: CWE-497 Description: The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bishopfox.com/blog/advisories - https://shop.yosmart.com/pages/product-support - https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home
CVE ID: CVE-2025-59448 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:14:14.598Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: YoSmart Products: YoLink ecosystem Problem Types: CWE-319 Description: Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with the traffic to control affected devices. This affects YoLink Hub 0382, YoLink Mobile Application 1.40.41, and YoLink MQTT Broker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ink Mobile Application 1.40.41, and YoLink MQTT Broker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bishopfox.com/blog/advisories - https://shop.yosmart.com/pages/product-support - https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home
CVE ID: CVE-2025-59449 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:12:10.296Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: YoSmart Products: YoLink MQTT broker Problem Types: CWE-863 Description: The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the attacker obtains the associated device IDs. Because YoLink device IDs are predictable, an attacker can exploit this to gain full control over any other YoLink user's devices. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
this to gain full control over any other YoLink user's devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bishopfox.com/blog/advisories - https://shop.yosmart.com/pages/product-support - https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home
CVE ID: CVE-2025-59450 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:17:46.053Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: YoSmart Products: YoLink Smart Hub Problem Types: CWE-312 Description: The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bishopfox.com/blog/advisories - https://shop.yosmart.com/pages/product-support - https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home
CVE ID: CVE-2025-59451 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:17:19.191Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: YoSmart Products: YoLink application Problem Types: CWE-863 Description: The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bishopfox.com/blog/advisories - https://shop.yosmart.com/pages/product-support - https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home
CVE ID: CVE-2025-59452 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:16:55.103Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: YoSmart Products: YoLink API Problem Types: CWE-340 Description: The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bishopfox.com/blog/advisories - https://shop.yosmart.com/pages/product-support - https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home
CVE ID: CVE-2025-59453 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T19:14:45.112Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: clickstudios Products: Passwordstate Problem Types: CWE-669 Description: Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the Emergency Access web page, an unauthorized person can gain access to the Passwordstate Administration section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.clickstudios.com.au/passwordstate-changelog.aspx - https://www.clickstudios.com.au/se
ichment: References: - https://www.clickstudios.com.au/passwordstate-changelog.aspx - https://www.clickstudios.com.au/security/advisories/
CVE ID: CVE-2025-59455 State: PUBLISHED Published: 2025-09-17T09:04:01.021Z Last Updated: 2025-09-17T12:59:24.916Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-362 Description: In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-59456 State: PUBLISHED Published: 2025-09-17T09:04:02.094Z Last Updated: 2025-09-17T12:59:54.791Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) Vendors: JetBrains Products: TeamCity Problem Types: CWE-23 Description: In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-59457 State: PUBLISHED Published: 2025-09-17T09:04:02.731Z Last Updated: 2025-09-17T13:00:52.797Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-183 Description: In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-59458 State: PUBLISHED Published: 2025-09-17T09:04:03.342Z Last Updated: 2025-09-17T13:02:29.686Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: JetBrains Products: Junie Problem Types: CWE-77 Description: In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible due to improper command validation Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-59459 State: PUBLISHED Published: 2025-10-27T10:09:03.229Z Last Updated: 2025-10-27T13:20:18.768Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SICK AG Products: TLOC100-100 with Firmware <7.1.1, TLOC100-100 with Firmware >=7.1.1 Problem Types: CWE-770 Description: An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.
/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.pdf
CVE ID: CVE-2025-59460 State: PUBLISHED Published: 2025-10-27T10:10:31.105Z Last Updated: 2025-10-27T18:10:18.984Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SICK AG Products: TLOC100-100 with Firmware <7.1.1, TLOC100-100 with Firmware >=7.1.1 Problem Types: CWE-1391 Description: The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cyber
- https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.pdf
CVE ID: CVE-2025-59461 State: PUBLISHED Published: 2025-10-27T10:11:46.163Z Last Updated: 2025-10-27T18:08:15.868Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: SICK AG Products: TLOC100-100 all Firmware versions Problem Types: CWE-862 Description: A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
elines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.pdf
CVE ID: CVE-2025-59462 State: PUBLISHED Published: 2025-10-27T10:12:55.225Z Last Updated: 2025-10-27T18:07:30.977Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SICK AG Products: TLOC100-100 all Firmware versions Problem Types: CWE-248 Description: An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommende
rating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.pdf
CVE ID: CVE-2025-59463 State: PUBLISHED Published: 2025-10-27T10:14:31.607Z Last Updated: 2025-10-27T18:05:28.122Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SICK AG Products: TLOC100-100 all Firmware versions Problem Types: CWE-833 Description: An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.
by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0013.pdf
CVE ID: CVE-2025-59474 State: PUBLISHED Published: 2025-09-17T13:17:47.174Z Last Updated: 2025-11-04T21:13:51.125Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3594
CVE ID: CVE-2025-59475 State: PUBLISHED Published: 2025-09-17T13:17:47.879Z Last Updated: 2025-11-04T21:13:52.430Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allowing attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3625
CVE ID: CVE-2025-59476 State: PUBLISHED Published: 2025-09-17T13:17:48.559Z Last Updated: 2025-11-04T21:13:53.735Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-09-17/#SECURITY-3424
CVE ID: CVE-2025-59478 State: PUBLISHED Published: 2025-10-15T13:55:43.732Z Last Updated: 2025-10-16T03:56:56.625Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-824 Description: When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000152341
CVE ID: CVE-2025-59480 State: PUBLISHED Published: 2025-11-13T17:32:04.772Z Last Updated: 2025-11-13T18:02:26.585Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-352 Description: Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-59481 State: PUBLISHED Published: 2025-10-15T13:55:54.714Z Last Updated: 2025-10-16T03:56:42.187Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-250 Description: A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrich