Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-27216 State: PUBLISHED Published: 2025-08-21T00:01:24.177Z Last Updated: 2025-08-21T14:46:58.533Z Vendors: Ubiquiti Inc Products: UISP Application Description: Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-053/b0c4aa38-90aa-412d-b5b9-6395e057d822
CVE ID: CVE-2025-27217 State: PUBLISHED Published: 2025-08-21T00:01:24.159Z Last Updated: 2025-08-21T14:47:06.360Z Vendors: Ubiquiti Inc Products: UISP Application Description: A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/UISP-Application-2-4-220/b428b276-c4a6-4b90-b97b-1860ff2bb46d
CVE ID: CVE-2025-27218 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-20T20:17:06.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535
CVE ID: CVE-2025-27219 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-11-03T21:13:23.842Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: ruby-lang Products: CGI Problem Types: CWE-770 Description: In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/
ookies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2936778 - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
CVE ID: CVE-2025-27220 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-11-03T21:13:25.250Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: ruby-lang Products: CGI Problem Types: CWE-1333 Description: In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2890322 - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml
CVE ID: CVE-2025-27221 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-11-03T21:13:26.685Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: ruby-lang Products: URI Problem Types: CWE-212 Description: In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hackerone.com/reports/2957667 - https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
CVE ID: CVE-2025-27222 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T20:24:10.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rocketsoftware.com/products/ro
rise itself. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise - https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27222.txt
CVE ID: CVE-2025-27223 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T13:43:04.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise - https://www.rcesecurity.c
.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise - https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27223.txt
CVE ID: CVE-2025-27224 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T13:38:42.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to write to any filename with any file type at any location on the local server, ultimately allowing execution of arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integrati
Notes: - CISA ADP Vulnrichment: References: - https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise - https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27224.txt
CVE ID: CVE-2025-27225 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T18:51:30.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise - https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/
- https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27225.txt
CVE ID: CVE-2025-27231 State: PUBLISHED Published: 2025-10-03T11:25:14.205Z Last Updated: 2025-10-03T13:55:51.559Z Vendors: Zabbix Products: Zabbix Problem Types: CWE-522 Description: The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-27062
CVE ID: CVE-2025-27233 State: PUBLISHED Published: 2025-09-12T10:32:36.174Z Last Updated: 2025-09-12T11:58:28.618Z Vendors: Zabbix Products: Zabbix Problem Types: CWE-77 Description: Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-26987
CVE ID: CVE-2025-27234 State: PUBLISHED Published: 2025-09-12T10:31:58.770Z Last Updated: 2025-09-13T03:55:34.603Z Vendors: Zabbix Products: Zabbix Problem Types: CWE-78 Description: Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-26985
CVE ID: CVE-2025-27236 State: PUBLISHED Published: 2025-10-03T11:28:09.810Z Last Updated: 2025-10-03T13:52:36.578Z Vendors: Zabbix Products: Zabbix Problem Types: CWE-863 Description: A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-27060
CVE ID: CVE-2025-27237 State: PUBLISHED Published: 2025-10-03T11:28:43.076Z Last Updated: 2025-10-04T03:55:24.833Z Vendors: Zabbix Products: Zabbix Problem Types: CWE-427 Description: In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-27061
CVE ID: CVE-2025-27238 State: PUBLISHED Published: 2025-09-12T10:33:17.753Z Last Updated: 2025-09-15T18:48:19.882Z Vendors: Zabbix Products: Zabbix Problem Types: : Description: Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-26988
CVE ID: CVE-2025-27240 State: PUBLISHED Published: 2025-09-12T10:33:46.484Z Last Updated: 2025-09-15T12:49:03.144Z Vendors: Zabbix Products: Zabbix Problem Types: CWE-89 Description: A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.zabbix.com/browse/ZBX-26986
CVE ID: CVE-2025-27241 State: PUBLISHED Published: 2025-05-06T09:03:33.143Z Last Updated: 2025-05-06T14:54:50.262Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-476 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-05.md
CVE ID: CVE-2025-27242 State: PUBLISHED Published: 2025-06-08T11:47:18.615Z Last Updated: 2025-06-09T14:59:32.250Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-20 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-06.md
CVE ID: CVE-2025-27244 State: PUBLISHED Published: 2025-04-02T03:21:11.828Z Last Updated: 2025-04-02T15:41:04.823Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Hammock Corporation Products: AssetView, AssetView CLOUD Problem Types: CWE-201 Description: AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent data to the developer. If exploited, sensitive information may be obtained by a remote unauthenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hammock.jp/assetview/info/250325.html - https://jvn.jp/en/jp/JVN26321838/
CVE ID: CVE-2025-27246 State: PUBLISHED Published: 2025-11-11T16:50:19.068Z Last Updated: 2025-11-13T04:55:15.412Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Processor Identification Utility Problem Types: Escalation of Privilege, CWE-276 Description: Incorrect default permissions for the Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present
ay enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01334.html
CVE ID: CVE-2025-27247 State: PUBLISHED Published: 2025-06-08T11:47:25.245Z Last Updated: 2025-06-09T13:59:06.332Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-281 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-06.md
CVE ID: CVE-2025-27248 State: PUBLISHED Published: 2025-05-06T09:03:26.206Z Last Updated: 2025-05-06T15:01:25.369Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-476 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-05.md
CVE ID: CVE-2025-27249 State: PUBLISHED Published: 2025-11-11T16:50:20.767Z Last Updated: 2025-11-12T20:00:30.749Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Gaudi software Problem Types: Denial of Service, CWE-400 Description: Uncontrolled resource consumption for some Gaudi software before version 1.21.0 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user intera
via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01374.html
CVE ID: CVE-2025-27250 State: PUBLISHED Published: 2025-08-12T16:59:26.966Z Last Updated: 2025-08-13T20:15:29.221Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Edge Orchestrator software Problem Types: Denial of Service, CWE-400 Description: Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01317.html
CVE ID: CVE-2025-27253 State: PUBLISHED Published: 2025-03-10T09:04:34.413Z Last Updated: 2025-10-07T14:16:49.710Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: GE Vernova Products: N60 multilin, B30 Multilin, B90 Multilin, C30 Multilin, C60 Multilin, C70 Multilin, C95 Multilin, D30 Multilin, D60 Multilin, F35 Multilin, F60 Multilin, G30 Multilin, G60 Multilin, L30 Multilin, L60 Multilin, L90 Multilin, M60 Multilin, T35 Multilin, T60 Multilin Problem Types: CWE-15 Description: A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a
in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27253
CVE ID: CVE-2025-27254 State: PUBLISHED Published: 2025-03-10T09:05:08.963Z Last Updated: 2025-10-07T14:18:35.592Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: GE Vernova Products: EnerVista UR Setup Problem Types: CWE-282 Description: CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 - https://www.nozominetworks.com/labs/vulnerability
m/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27254
CVE ID: CVE-2025-27255 State: PUBLISHED Published: 2025-03-10T09:05:17.222Z Last Updated: 2025-03-12T11:10:21.030Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: GE Vernova Products: EnerVista UR Setup Problem Types: CWE-798 Description: Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcoded password retrievable by an attacker analyzing the application code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 - https://www.nozominetworks.com/labs/vulne
rnova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27255
CVE ID: CVE-2025-27256 State: PUBLISHED Published: 2025-03-10T09:05:25.962Z Last Updated: 2025-03-12T11:10:35.187Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: GE Vernova Products: EnerVista UR Setup Problem Types: CWE-306 Description: Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH server authentication. Since the client connection is not authenticated, an attacker may perform a man-in-the-middle attack on the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=ur
yst Notes: - CISA ADP Vulnrichment: References: - https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27256
CVE ID: CVE-2025-27257 State: PUBLISHED Published: 2025-03-10T09:05:34.817Z Last Updated: 2025-03-12T11:10:57.902Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: GE Vernova Products: N60 multilin, B30 Multilin, B90 Multilin, C30 Multilin, C60 Multilin, C70 Multilin, C95 Multilin, D30 Multilin, D60 Multilin, F35 Multilin, F60 Multilin, G30 Multilin, G60 Multilin, L30 Multilin, L60 Multilin, L90 Multilin, M60 Multilin, T35 Multilin, T60 Multilin Problem Types: CWE-345 Description: Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature
in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27257
CVE ID: CVE-2025-27258 State: PUBLISHED Published: 2025-10-13T06:25:32.326Z Last Updated: 2025-10-14T15:29:59.253Z Vendors: Ericsson Products: Ericsson Network Manager(ENM) Problem Types: CWE-284 Description: Ericsson Network Manager (ENM) versions prior to ENM 25.1 GA contain a vulnerability, if exploited, can result in an escalation of privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-enm-october-2025
CVE ID: CVE-2025-27259 State: PUBLISHED Published: 2025-10-13T06:16:37.104Z Last Updated: 2025-10-14T16:06:38.469Z Vendors: Ericsson Products: Ericsson Network Manager(ENM) Problem Types: CWE-79 Description: Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sites or domains. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-enm-october-2025
CVE ID: CVE-2025-27261 State: PUBLISHED Published: 2025-09-25T13:47:06.233Z Last Updated: 2025-09-30T12:12:39.842Z Vendors: Ericsson Products: Indoor Connect 8855 Problem Types: CWE-89 Description: Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25
CVE ID: CVE-2025-27262 State: PUBLISHED Published: 2025-09-25T14:43:29.803Z Last Updated: 2025-09-30T12:13:16.746Z Vendors: Ericsson Products: Indoor Connect 8855 Problem Types: CWE-78 Description: Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25