Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
alyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T378885 - https://gerrit.wikimedia.org/r/q/Ic9547e80a8296d707ad8a157eb8ba7aa26fb08dc
CVE ID: CVE-2025-23073 State: PUBLISHED Published: 2025-01-14T18:45:31.542Z Last Updated: 2025-10-16T22:47:37.467Z Vendors: Wikimedia Foundation Products: Mediawiki - GlobalBlocking Extension Problem Types: CWE-200, CWE-88 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded Sensitive Data. This issue briefly impacted the master branch of MediaWiki’s GlobalBlocking Extension. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T377855 - https://gerrit.wikimedia.org/r/q/I2a2d32aedf6328be0a9f1b4e04a6567a25f19486
CVE ID: CVE-2025-23074 State: PUBLISHED Published: 2025-01-14T18:58:20.037Z Last Updated: 2025-01-31T16:51:45.996Z Vendors: Wikimedia Foundation Products: Mediawiki - SocialProfile Extension Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misuse.This issue affects Mediawiki - SocialProfile Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T373265 - https://gerrit.wikimedia.org/r/q/I4b77ced314bc6cea0ef3657a82e7467
erences: - https://phabricator.wikimedia.org/T373265 - https://gerrit.wikimedia.org/r/q/I4b77ced314bc6cea0ef3657a82e7467d3661fe2a
CVE ID: CVE-2025-23078 State: PUBLISHED Published: 2025-01-10T17:57:20.927Z Last Updated: 2025-01-13T19:02:35.058Z Vendors: Wikimedia Foundation Products: Mediawiki - Breadcrumbs2 extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Breadcrumbs2 extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.5, from 1.42.X before 1.42.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T382043 - https://gerrit.wikimedia.org/r
Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T382043 - https://gerrit.wikimedia.org/r/q/I7878f8f7bc067080f80427b90f8d85337f172711
CVE ID: CVE-2025-23079 State: PUBLISHED Published: 2025-01-10T19:03:15.208Z Last Updated: 2025-01-13T17:52:17.561Z Vendors: Wikimedia Foundation Products: Mediawiki - ArticleFeedbackv5 extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - ArticleFeedbackv5 extension: from 1.42.X before 1.42.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T381753 - https://gerrit.wikimedia.org/r/q/I6ee51c8b518bda41739fd666fa2891cc12e7
es: - https://phabricator.wikimedia.org/T381753 - https://gerrit.wikimedia.org/r/q/I6ee51c8b518bda41739fd666fa2891cc12e79ac3
CVE ID: CVE-2025-23080 State: PUBLISHED Published: 2025-01-14T16:40:41.795Z Last Updated: 2025-01-14T17:20:49.366Z Vendors: Wikimedia Foundation Products: Mediawiki - OpenBadges Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - OpenBadges Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - OpenBadges Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T381220 - https://gerrit.wikimedia.org/r/q/Ic9
- CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T381220 - https://gerrit.wikimedia.org/r/q/Ic9448312fa7f1cbc8feac3f852bc8720568522e2
CVE ID: CVE-2025-23081 State: PUBLISHED Published: 2025-01-14T16:56:42.009Z Last Updated: 2025-03-13T14:33:03.926Z Vendors: Wikimedia Foundation Products: Mediawiki - DataTransfer Extension Problem Types: CWE-352, CWE-79 Description: Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
rom 1.41.X before 1.41.3, from 1.42.X before 1.42.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T379749 - https://gerrit.wikimedia.org/r/q/I773c616db781d2f3f30893ad01ef503bf251a2b3 - https://gerrit.wikimedia.org/r/q/I7c9de4c8dcdb3276ba923c6bc7c8eef3531324c7 - https://gerrit.wikimedia.org/r/q/I9223c31f02f31f1e06e1a8cddf7d539cc8d3a3d9 - https://gerrit.wikimedia.org/r/q/I5e1538a3bf66378810f905834c05626e1d2c82f0 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1093931 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1080451
CVE ID: CVE-2025-23082 State: PUBLISHED Published: 2025-01-14T01:46:14.729Z Last Updated: 2025-01-14T15:51:53.014Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Veeam Products: Backup for Microsoft Azure Description: Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4709
CVE ID: CVE-2025-23083 State: PUBLISHED Published: 2025-01-22T01:11:30.802Z Last Updated: 2025-07-22T15:23:52.842Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: NodeJS Products: Node Description: With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: R
-permission) on Node.js v20, v22, and v23. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
CVE ID: CVE-2025-23084 State: PUBLISHED Published: 2025-01-28T04:35:15.236Z Last Updated: 2025-11-04T21:09:38.409Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: NodeJS Products: Node Description: A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` AP
le separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
CVE ID: CVE-2025-23085 State: PUBLISHED Published: 2025-02-07T07:09:25.804Z Last Updated: 2025-11-03T21:00:17.709Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: NodeJS Products: Node Description: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x. Additional Anal
ain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
CVE ID: CVE-2025-23086 State: PUBLISHED Published: 2025-01-21T04:26:10.943Z Last Updated: 2025-03-22T14:00:42.023Z Vendors: Brave Products: Desktop Browser Description: On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability on a trusted site, this could allow a malicious site to initiate a download whose origin in the file select dialog appears as the trusted site which initiated the redirect. Additional Analyst Notes: - CISA ADP Vu
the file select dialog appears as the trusted site which initiated the redirect. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/2888770
CVE ID: CVE-2025-23087 State: REJECTED Published: 2025-01-22T01:11:30.821Z Last Updated: 2025-03-01T01:57:38.637Z Description: No description available.
CVE ID: CVE-2025-23088 State: REJECTED Published: 2025-01-22T01:11:30.829Z Last Updated: 2025-03-01T01:57:38.952Z Description: No description available.
CVE ID: CVE-2025-23089 State: REJECTED Published: 2025-01-22T01:11:30.822Z Last Updated: 2025-03-01T01:57:39.264Z Description: No description available.
CVE ID: CVE-2025-23090 State: REJECTED Published: 2025-01-22T01:11:30.802Z Last Updated: 2025-07-18T23:02:35.042Z Description: No description available.
CVE ID: CVE-2025-23091 State: PUBLISHED Published: 2025-02-01T06:53:09.114Z Last Updated: 2025-03-13T12:54:46.381Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Ubiquiti Inc Products: UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDW, UNVR, UNVR PRO, UCKP, UCK, UCK-Enterprise, UCG-Max, EFG Description: An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle (MitM) attack during application update. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-045-045/6011bc61-f2eb-457f-b71d-755703817aaf
CVE ID: CVE-2025-23092 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-24T18:01:16.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mitel OpenScape Accounting Management through V5 R1.1.0 could allow an authenticated attacker with administrative privileges to conduct a path traversal attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to upload arbitrary files and execute unauthorized commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/mitel-product-security-advisory-misa-2025-0006
CVE ID: CVE-2025-23093 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-12T14:09:41.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0001
CVE ID: CVE-2025-23094 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-11T21:18:51.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and earlier could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the same privilege level as the web access process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/securit
b access process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0001
CVE ID: CVE-2025-23095 State: PUBLISHED Published: 2025-06-04T00:00:00.000Z Last Updated: 2025-06-04T20:36:53.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23095/
CVE ID: CVE-2025-23096 State: PUBLISHED Published: 2025-06-04T00:00:00.000Z Last Updated: 2025-06-04T20:36:02.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23096/
CVE ID: CVE-2025-23097 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-04T18:20:36.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 1380. The lack of a length check leads to out-of-bounds writes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23097/
CVE ID: CVE-2025-23098 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-04T18:20:49.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 980, 990, 1080, 2100, 1280, 2200, 1380. A Use-After-Free in the mobile processor leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23098/
CVE ID: CVE-2025-23099 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-03T01:53:09.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23099/
CVE ID: CVE-2025-23100 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-04T18:20:43.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. The absence of a NULL check leads to a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23100/
CVE ID: CVE-2025-23101 State: PUBLISHED Published: 2025-06-04T00:00:00.000Z Last Updated: 2025-06-04T20:37:47.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 1380. A Use-After-Free in the mobile processor leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23101/
CVE ID: CVE-2025-23102 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-09T13:50:00.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 980, 990, 1080, 2100, 1280, 2200, 1380, 1480 and 2400. A Double Free in the mobile processor leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23102/
CVE ID: CVE-2025-23103 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-03T16:03:54.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23103/
CVE ID: CVE-2025-23104 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-09T13:45:24.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 2200. A Use-After-Free in the mobile processor leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23104/
CVE ID: CVE-2025-23105 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-03T01:51:18.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23105/
CVE ID: CVE-2025-23106 State: PUBLISHED Published: 2025-06-04T00:00:00.000Z Last Updated: 2025-06-04T20:35:10.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23106/
CVE ID: CVE-2025-23107 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-03T17:38:38.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23107/
CVE ID: CVE-2025-23108 State: PUBLISHED Published: 2025-01-11T03:36:53.989Z Last Updated: 2025-01-13T17:46:18.921Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URI Description: Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability affects Firefox for iOS < 134. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1933172 - https://www.mozilla.org/security/advisories/mfsa2025-06/
CVE ID: CVE-2025-23109 State: PUBLISHED Published: 2025-01-11T03:36:55.235Z Last Updated: 2025-01-13T17:43:04.023Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Address bar spoofing on iOS using long hostnames Description: Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address This vulnerability affects Firefox for iOS < 134. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1419275 - https://www.mozilla.org/security/advisories/mfsa2025-06/
CVE ID: CVE-2025-23110 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T20:52:26.172Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Vanderbilt Products: REDCap Problem Types: CWE-79 Description: An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject field exists while performing an upload of a CSV file containing a list of alert configurations. An attacker can send the victim a CSV file containing the XSS payload in the email-subject. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim clicks on the email-subject valu
ads the file, he automatically lands on a page to view the uploaded data. If the victim clicks on the email-subject value, it triggers the XSS payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_VVVVVV/README.md
CVE ID: CVE-2025-23111 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T20:50:35.709Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Vanderbilt Products: REDCap Problem Types: CWE-79 Description: An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website. Thus, this allows malicious actions to be executed without user consent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://g
actions to be executed without user consent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_YYYY/README.md