Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3917 State: PUBLISHED Published: 2025-05-15T03:21:38.842Z Last Updated: 2025-05-15T14:22:38.309Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: kelerkgibo Products: 百度站长SEO合集(支持百度/神马/Bing/头条推送) Problem Types: CWE-434 Description: The 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download_remote_image_to_media_library function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CI
itrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/70361501-8adc-499a-91d2-cf91fab5934a?source=cve - https://wordpress.org/plugins/baiduseo/ - https://plugins.trac.wordpress.org/browser/baiduseo/tags/2.0.6/inc/index/youhua.php#L371
CVE ID: CVE-2025-3918 State: PUBLISHED Published: 2025-05-03T01:43:06.908Z Last Updated: 2025-05-06T15:03:50.627Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nootheme Products: Job Listings Problem Types: CWE-285 Description: The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1 to 0.1.1. The plugin’s registration handler reads the client-supplied $_POST['user_role'] and passes it directly to wp_insert_user() without restricting to a safe set of roles. This makes it possible for unauthenticated attackers to elevate their privileges to that of an ad
o a safe set of roles. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9cd43f5-c3d0-4eb2-9c18-1af2edca37ff?source=cve - https://plugins.trac.wordpress.org/browser/job-listings/trunk/includes/forms/class-jlt-form-member.php#L68 - https://wordpress.org/plugins/job-listings/#developers
CVE ID: CVE-2025-3919 State: PUBLISHED Published: 2025-06-02T22:22:35.834Z Last Updated: 2025-06-03T02:05:33.927Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webtoffee Products: WordPress Comments Import & Export Problem Types: CWE-79 Description: The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbi
s parameters. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page. The vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bc8863-04a9-4631-9510-624f98ea1e75?source=cve - https://plugins.trac.wordpress.org/browser/comments-import-export-woocommerce/trunk/includes/settings/class-hf_cmt_impexpcsv-settings.php?rev=3278076 - https://plugins.trac.wordpress.org/changeset
e/trunk/includes/settings/class-hf_cmt_impexpcsv-settings.php?rev=3278076 - https://plugins.trac.wordpress.org/changeset/3288894/ - https://plugins.trac.wordpress.org/changeset/3301183/
CVE ID: CVE-2025-3920 State: PUBLISHED Published: 2025-07-07T08:21:54.231Z Last Updated: 2025-07-07T17:50:28.306Z Vendors: SUR-FBD CMMS Products: SUR-FBD CMMS Problem Types: CWE-259 Description: A vulnerability was identified in SUR-FBD CMMS where hard-coded credentials were found within a compiled DLL file. These credentials correspond to a built-in administrative account of the software. An attacker with local access to the system or the application's installation directory could extract these credentials, potentially leading to a complete compromise of the application's administrative functions. This issue was fixed in version 2025.03.27 of the SUR-FBD CMMS software. Additional Analyst No
administrative functions. This issue was fixed in version 2025.03.27 of the SUR-FBD CMMS software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/07/CVE-2025-3920/
CVE ID: CVE-2025-3921 State: PUBLISHED Published: 2025-05-07T01:43:08.850Z Last Updated: 2025-05-07T14:03:00.745Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: peprodev Products: PeproDev Ultimate Profile Solutions Problem Types: CWE-285 Description: The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0. Additiona
a which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a881ca02-cef9-4f4b-8a62-e241c4c80004?source=cve - https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L1483 - https://wordpress.org/plugins/peprodev-ups/#developers
CVE ID: CVE-2025-3923 State: PUBLISHED Published: 2025-04-25T05:25:07.625Z Last Updated: 2025-04-25T15:08:04.350Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: buildwps Products: Prevent Direct Access – Protect WordPress Files Problem Types: CWE-200 Description: The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can deter
or unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can determine the file name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f648a9ca-a72f-418e-bf1b-ad4ecc27d365?source=cve - https://plugins.svn.wordpress.org/prevent-direct-access/tags/2.8.8/includes/helper.php - https://plugins.trac.wordpress.org/browser/prevent-direct-access/trunk/includes/helper.php#L16
CVE ID: CVE-2025-3924 State: PUBLISHED Published: 2025-05-07T01:43:07.782Z Last Updated: 2025-05-07T14:03:17.735Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: peprodev Products: PeproDev Ultimate Profile Solutions Problem Types: CWE-285 Description: The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized access of data via its publicly exposed reset-password endpoint. The plugin looks up the 'valid_email' value based solely on a supplied username parameter, without verifying that the requester is associated with that user account. This allows unauthenticated attackers to enumerate email addresses for any user, including
ated with that user account. This allows unauthenticated attackers to enumerate email addresses for any user, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb36c0f-68b3-492e-9f08-fe6228b0363f?source=cve - https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L1483 - https://wordpress.org/plugins/peprodev-ups/#developers - https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L2659 - https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L2810
CVE ID: CVE-2025-3925 State: PUBLISHED Published: 2025-05-07T20:18:22.457Z Last Updated: 2025-05-08T14:04:48.853Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: BrightSign Products: BrightSign OS series 4 players, BrightSign OS series 5 players Problem Types: CWE-250 Description: BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 contain an execution with unnecessary privileges vulnerability, allowing for privilege escalation on the device once code execution has been obtained. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-03 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-03 - https://www.brightsign.biz/resources/software-downloads/
CVE ID: CVE-2025-3927 State: PUBLISHED Published: 2025-05-02T14:36:49.042Z Last Updated: 2025-05-12T15:54:40.334Z Vendors: Digigram Products: PYKO-OUT Problem Types: CWE-1391: Use of Weak Credentials Description: Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and compromise the device, potentially pivoting to connected network or hardware devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.digigram.com/download/pyko-out-user-manual-en-jan-2019/
CVE ID: CVE-2025-3928 State: PUBLISHED Published: 2025-04-25T15:56:28.112Z Last Updated: 2025-10-21T22:55:17.806Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Commvault Products: Web Server Problem Types: CWE-noinfo Not enough information Description: Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Cata
217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928 - https://www.commvault.com/blogs/security-advisory-march-7-2025 - https://www.commvault.com/blogs/notice-security-advisory-update - https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic - https://www.commvault.co
22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic - https://www.commvault.com/blogs/customer-security-update
CVE ID: CVE-2025-3929 State: PUBLISHED Published: 2025-04-29T11:36:33.507Z Last Updated: 2025-04-29T13:19:29.916Z Vendors: MDaemon Products: Email Server Problem Types: CWE-79 Description: An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window, and access user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mdaemon.com/pages/downloads-critical-updates
CVE ID: CVE-2025-3930 State: PUBLISHED Published: 2025-10-16T10:43:21.382Z Last Updated: 2025-10-22T06:59:29.045Z Vendors: Strapi Products: Strapi Problem Types: CWE-613 Description: Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1. Additional Analyst Notes: - CISA
her increasing the impact of this attack. This issue has been fixed in version 5.24.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/06/CVE-2025-3930 - https://github.com/strapi/strapi - https://strapi.io/ - https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve-October-2025
CVE ID: CVE-2025-3931 State: PUBLISHED Published: 2025-05-14T11:54:50.290Z Last Updated: 2025-11-11T09:57:52.248Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Satellite 6 Problem Types: CWE-280 Description: A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yg
ers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages. This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:7592 - https://access.redhat.com/security/cv
ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:7592 - https://access.redhat.com/security/cve/CVE-2025-3931 - https://bugzilla.redhat.com/show_bug.cgi?id=2362345 - https://github.com/RedHatInsights/yggdrasil/pull/336
CVE ID: CVE-2025-3932 State: PUBLISHED Published: 2025-05-14T16:56:43.939Z Last Updated: 2025-11-03T19:58:40.582Z Vendors: Mozilla Products: Thunderbird Problem Types: Tracking Links in Attachments Bypassed Remote Content Blocking Description: It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1. Additional
tachment-URL header of an email. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1960412 - https://www.mozilla.org/security/advisories/mfsa2025-34/ - https://www.mozilla.org/security/advisories/mfsa2025-35/
CVE ID: CVE-2025-3933 State: PUBLISHED Published: 2025-07-11T09:22:27.103Z Last Updated: 2025-07-11T15:07:34.839Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due
e regex pattern `<s_(.*?)>` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/25282953-5827-4384-bb6f-5790d275721b - https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93
CVE ID: CVE-2025-3935 State: PUBLISHED Published: 2025-04-25T18:27:44.244Z Last Updated: 2025-10-21T22:55:17.656Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ConnectWise Products: ScreenConnect Problem Types: CWE-502 Description: ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState
el access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4 - https://www.connectwise.com/company/trust/advisories
CVE ID: CVE-2025-3936 State: PUBLISHED Published: 2025-05-22T12:20:42.337Z Last Updated: 2025-05-22T17:29:38.532Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Tridium Products: Niagara Framework, Niagara Enterprise Security Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recomme
efore 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.niagara-community.com/category/tech_bull - https://www.honeywell.com/us/en/product-security#security-notices
CVE ID: CVE-2025-3937 State: PUBLISHED Published: 2025-05-22T12:23:42.058Z Last Updated: 2025-05-22T14:43:13.538Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Tridium Products: Niagara Framework, Niagara Enterprise Security Problem Types: CWE-916 Description: Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagar
10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.niagara-community.com/category/tech_bull - https://www.honeywell.com/us/en/product-security#security-notices
CVE ID: CVE-2025-3938 State: PUBLISHED Published: 2025-05-22T12:32:01.669Z Last Updated: 2025-05-22T14:10:21.621Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Tridium Products: Niagara Framework, Niagara Enterprise Security Problem Types: CWE-325 Description: Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Secu
ity: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honeywell.com/us/en/product-security#security-notices - https://docs.niagara-community.com/category/tech_bull
CVE ID: CVE-2025-3939 State: PUBLISHED Published: 2025-05-22T12:33:48.250Z Last Updated: 2025-05-22T14:02:22.839Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Tridium Products: Niagara Framework, Niagara Enterprise Security Problem Types: CWE-204 Description: Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise
Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://honeywell.com/us/en/product-security#security-notices - https://docs.niagara-community.com/category/tech_bull
CVE ID: CVE-2025-3940 State: PUBLISHED Published: 2025-05-22T12:35:14.174Z Last Updated: 2025-05-22T14:00:58.907Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Tridium Products: Niagara Framework, Niagara Enterprise Security Problem Types: CWE-1173 Description: Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framewor
gara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://honeywell.com/us/en/product-security#security-notices - https://docs.niagara-community.com/category/tech_bull