Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9975 State: PUBLISHED Published: 2024-10-15T11:00:07.457Z Last Updated: 2024-10-15T13:31:33.273Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Drag and Drop Image Upload Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Drag and Drop Image Upload 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280340 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280340 - https://vuldb.com/?ctiid.280340 - https://vuldb.com/?submit.423445 - https://github.com/JunMing27/CVE/blob/main/SourceCodester%20-%20Arbitrary%20File%20Upload%20vulnerability%20leads%20to%20RCE%20in%20Drag%20and%20Drop%20Image%20Upload%20without%20Refresh%20Reload%20Using%20PHP%20and%20Ajax.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-9976 State: PUBLISHED Published: 2024-10-15T11:00:09.138Z Last Updated: 2024-10-15T13:27:12.958Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the file /php/manage_customer.php?action=search. The manipulation of the argument text leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280341 - https://vuldb.com/?ctiid.280341 - https://vuldb.com/?submit.423448 - https://gist.github.com/higordiego/b57040961b993cb5f1bfe0005f6b57be - https://code-projects.org/
CVE ID: CVE-2024-9977 State: PUBLISHED Published: 2024-10-15T12:31:04.419Z Last Updated: 2024-10-15T13:27:02.177Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: MitraStar Products: GPT-2541GNAC Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected is an unknown function of the file /cgi-bin/settings-firewall.cgi of the component Firewall Settings Page. The manipulation of the argument SrcInterface leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. We tried to contact the vendor early about th
ck remotely. The exploit has been disclosed to the public and may be used. We tried to contact the vendor early about the disclosure but the official mail address was not working properly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280344 - https://vuldb.com/?ctiid.280344 - https://vuldb.com/?submit.423561 - https://github.com/peritocibernetico/VivoCodeExecutionFirewall/
CVE ID: CVE-2024-9978 State: PUBLISHED Published: 2024-12-03T12:15:29.123Z Last Updated: 2024-12-03T14:22:27.509Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125 Description: in OpenHarmony v4.1.1 and prior versions allow a local attacker cause information leak through out-of-bounds Read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-12.md
CVE ID: CVE-2024-9979 State: PUBLISHED Published: 2024-10-15T14:01:54.309Z Last Updated: 2025-11-20T19:59:29.920Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-416 Description: A flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or crashes via unsound borrowing from weak Python references. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-9979 - https://bugzilla.redhat.com/
CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-9979 - https://bugzilla.redhat.com/show_bug.cgi?id=2318646 - https://crates.io/crates/pyo3 - https://github.com/PyO3/pyo3/pull/4590 - https://rustsec.org/advisories/RUSTSEC-2024-0378.html
CVE ID: CVE-2024-9980 State: PUBLISHED Published: 2024-10-15T07:52:48.554Z Last Updated: 2024-10-15T13:56:27.287Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: FormosaSoft Products: ee-class Problem Types: CWE-89 Description: The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8142-cf0d3-1.html - https://www.twcert.org.tw/en/cp-139-8143-53d30-2.html
CVE ID: CVE-2024-9981 State: PUBLISHED Published: 2024-10-15T07:57:31.598Z Last Updated: 2024-10-15T13:54:14.734Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: FormosaSoft Products: ee-class Problem Types: CWE-98 Description: The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP file first and then exploit this vulnerability to include the file, resulting in arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8144-2885b-1.html - https://www.twcert.org.tw/en/cp-139-81
lnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8144-2885b-1.html - https://www.twcert.org.tw/en/cp-139-8145-15bea-2.html
CVE ID: CVE-2024-9982 State: PUBLISHED Published: 2024-10-15T08:04:36.002Z Last Updated: 2024-10-15T13:50:03.749Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ESi Technology Products: AIM LINE Marketing Platform Problem Types: CWE-89 Description: AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8146-497a2-1.html - https://www.twcert.org.tw/en/c
A ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8146-497a2-1.html - https://www.twcert.org.tw/en/cp-139-8147-eb650-2.html
CVE ID: CVE-2024-9983 State: PUBLISHED Published: 2024-10-15T08:12:17.228Z Last Updated: 2024-10-15T13:40:00.636Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Ragic Products: Enterprise Cloud Database Problem Types: CWE-23 Description: Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8148-ed790-1.html - https://www.twcert.org.tw/en/cp-139-8149-31424-2.html
CVE ID: CVE-2024-9984 State: PUBLISHED Published: 2024-10-15T08:15:30.938Z Last Updated: 2024-10-15T13:38:39.847Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ragic Products: Enterprise Cloud Database Problem Types: CWE-306 Description: Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionality to obtain any user's session cookie. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8150-c955a-1.html - https://www.twcert.org.tw/en/cp-139-8151-1a4b5-2.html
CVE ID: CVE-2024-9985 State: PUBLISHED Published: 2024-10-15T08:20:36.062Z Last Updated: 2024-10-15T13:37:34.053Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ragic Products: Enterprise Cloud Database Problem Types: CWE-434 Description: Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8152-09e81-1.html - https://www.twcert.org.tw/en/cp-139-8153-1120e-2.html
CVE ID: CVE-2024-9986 State: PUBLISHED Published: 2024-10-15T13:00:05.849Z Last Updated: 2024-10-15T13:52:33.574Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Blood Bank Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file member_register.php. The manipulation of the argument fullname/username/password/email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "pa
xploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "password" to be affected. But it must be assumed that other parameters are affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280349 - https://vuldb.com/?ctiid.280349 - https://vuldb.com/?submit.423887 - https://github.com/Lanxiy7th/lx_CVE_report-/issues/16 - https://code-projects.org/
CVE ID: CVE-2024-9987 State: PUBLISHED Published: 2024-10-22T09:00:57.871Z Last Updated: 2024-10-22T13:13:31.854Z Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-89 Description: A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora FMS: from 700 through <777.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2024-9988 State: PUBLISHED Published: 2024-10-29T16:31:29.682Z Last Updated: 2024-10-29T19:42:30.917Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: odude Products: Crypto Tool Problem Types: CWE-288 Description: The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due to missing validation on the user being supplied in the 'crypto_connect_ajax_process::register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. Additional Analyst Notes: - CISA ADP Vulnrichment
e site, such as an administrator, if they have access to the username. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7bfe87cf-9883-4f8f-a0f5-23bbc7bb9b7c?source=cve - https://plugins.trac.wordpress.org/browser/crypto/tags/2.10/includes/class-crypto_connect_ajax_register.php#L91
CVE ID: CVE-2024-9989 State: PUBLISHED Published: 2024-10-29T16:31:30.912Z Last Updated: 2024-10-29T19:41:11.105Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: odude Products: Crypto Tool Problem Types: CWE-288 Description: The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due a to limited arbitrary method call to 'crypto_connect_ajax_process::log_in' function in the 'crypto_connect_ajax_process' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. Additional Analyst Note
as any existing user on the site, such as an administrator, if they have access to the username. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e21bd924-1d96-4371-972a-5c99d67261cc?source=cve - https://plugins.trac.wordpress.org/browser/crypto/tags/2.10/includes/class-crypto_connect_ajax_register.php#L33 - https://plugins.trac.wordpress.org/browser/crypto/tags/2.10/includes/class-crypto_connect_ajax_register.php#L138
CVE ID: CVE-2024-9990 State: PUBLISHED Published: 2024-10-29T16:31:30.375Z Last Updated: 2024-10-29T19:41:54.343Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: odude Products: Crypto Tool Problem Types: CWE-352 Description: The Crypto plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.15. This is due to missing nonce validation in the 'crypto_connect_ajax_process::check' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator via a forged request granted they can trick a site administrator into performing an action such as clicking on
nistrator via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cea39157-94aa-4982-983e-9c3e4b1af86d?source=cve - https://plugins.trac.wordpress.org/browser/crypto/tags/2.10/includes/class-crypto_connect_ajax_register.php#L31 - https://plugins.trac.wordpress.org/browser/crypto/tags/2.10/includes/class-crypto_connect_ajax_register.php#L65
CVE ID: CVE-2024-9991 State: PUBLISHED Published: 2024-10-25T12:27:44.531Z Last Updated: 2024-10-25T18:48:23.746Z Vendors: Philips Lighting (Signify Innovations India) Products: Philips Smart Wi-Fi LED Batten 24-Watt, Philips Smart Wi-Fi LED T Beamer 20-Watt, Philips Smart Bulb 9,10,12-Watt, Philips Smart T-Bulb 10,12-Watt Problem Types: CWE-312 Description: This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the vulnerable device. Successful exploitation
yzing the binary data to obtain the plaintext Wi-Fi credentials stored on the vulnerable device. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the Wi-Fi network to which vulnerable device is connected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0329
CVE ID: CVE-2024-9993 State: PUBLISHED Published: 2025-06-07T11:17:51.323Z Last Updated: 2025-06-09T14:04:21.231Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Popular Elementor Templates and Widgets Problem Types: CWE-79 Description: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_event_details_text parameter of Event Calendar Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. Thi
up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8de8a0b-0b70-4e8a-8cc4-06cc50d06a02?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.0.7/includes/Elements/Event_Calendar.php#L3079
CVE ID: CVE-2024-9994 State: PUBLISHED Published: 2025-06-07T11:17:49.971Z Last Updated: 2025-06-09T15:07:49.754Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Popular Elementor Templates and Widgets Problem Types: CWE-79 Description: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_pricing_item_tooltip_content parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied at
all versions up to, and including, 6.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/855ae993-d887-4416-9b3c-8274a90dce5f?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.0.7/includes/Elements/Pricing_Table.php#L2164
CVE ID: CVE-2024-9996 State: PUBLISHED Published: 2024-10-29T21:45:17.527Z Last Updated: 2025-08-26T18:40:39.783Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, DWG TrueView, RealDWG Problem Types: CWE-787 Description: A maliciously crafted DWG file, when parsed in acdb25.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the cur
leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE ID: CVE-2024-9997 State: PUBLISHED Published: 2024-10-29T21:45:59.005Z Last Updated: 2025-08-26T18:41:04.035Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, DWG TrueView, RealDWG Problem Types: CWE-120 Description: A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current p
age this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
CVE ID: CVE-2024-9998 State: REJECTED Published: N/A Last Updated: 2024-11-12T10:30:45.676Z Description: No description available.
CVE ID: CVE-2024-9999 State: PUBLISHED Published: 2024-11-12T16:33:00.600Z Last Updated: 2024-11-12T17:19:06.940Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Progress Software Corporation Products: WS_FTP Server Problem Types: CWE-303 Description: In WS_FTP Server versions before 8.8.9 (2022.0.9), an Incorrect Implementation of Authentication Algorithm in the Web Transfer Module allows users to skip the second-factor verification and log in with username and password only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-November-2024 - https://www.progress.com/ftp-server
CVE ID: CVE-2025-0001 State: PUBLISHED Published: 2025-02-17T09:29:49.551Z Last Updated: 2025-02-18T19:31:29.625Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Abacus Research AG Products: Abacus Problem Types: CWE-36 Description: Abacus ERP is versions older than 2024.210.16036, 2023.205.15833, 2022.105.15542 are affected by an authenticated arbitrary file read vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://borelenzo.github.io/stuff/2025/02/15/CVE-2025-0001.html
CVE ID: CVE-2025-0003 State: PUBLISHED Published: 2025-11-24T20:36:37.989Z Last Updated: 2025-11-24T20:55:03.445Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: AMD Products: Xilinx Run Time (XRT) Problem Types: CWE-413 Description: Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE ID: CVE-2025-0005 State: PUBLISHED Published: 2025-11-24T19:45:12.857Z Last Updated: 2025-11-24T20:33:49.469Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: AMD Products: Xilinx Run Time (XRT) Problem Types: CWE-190 Description: Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE ID: CVE-2025-0007 State: PUBLISHED Published: 2025-11-24T20:35:18.474Z Last Updated: 2025-11-24T20:56:23.146Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AMD Products: Xilinx Run Time (XRT) Problem Types: CWE-710 Description: Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user space to kernel space, potentially compromising confidentiality, integrity, and/or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE ID: CVE-2025-0009 State: PUBLISHED Published: 2025-09-06T18:12:45.679Z Last Updated: 2025-09-08T14:35:46.513Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: AMD Products: AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics, AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics, AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics, AMD Ryzen™ 7000 Series Desktop Processors, AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics, AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics, AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7000 Ser
000 Series Processor with Radeon™ Graphics, AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7000 Series Mobile Processors, AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7000 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics, AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics, AMD Ryzen™ 9000 Series Desktop Processors, AMD Ryzen™ 4000 Series Desktop Processors, AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics, AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ Embedded 7000 Series Processors, AMD Ryzen™ Embedded 8000 Series Processors, AMD Radeon™ RX 5000 Series