Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-31678 State: PUBLISHED Published: 2025-03-31T21:38:07.302Z Last Updated: 2025-04-29T15:40:38.758Z Vendors: Drupal Products: AI (Artificial Intelligence) Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-004
CVE ID: CVE-2025-31679 State: PUBLISHED Published: 2025-03-31T21:38:50.510Z Last Updated: 2025-04-29T15:39:15.545Z Vendors: Drupal Products: Ignition Error Pages Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-007
CVE ID: CVE-2025-31680 State: PUBLISHED Published: 2025-03-31T21:39:31.274Z Last Updated: 2025-04-29T15:38:13.666Z Vendors: Drupal Products: Matomo Analytics Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-008
CVE ID: CVE-2025-31681 State: PUBLISHED Published: 2025-03-31T21:39:50.247Z Last Updated: 2025-04-29T15:37:04.473Z Vendors: Drupal Products: Authenticator Login Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-009
CVE ID: CVE-2025-31682 State: PUBLISHED Published: 2025-03-31T21:40:33.099Z Last Updated: 2025-04-29T15:35:27.114Z Vendors: Drupal Products: Google Tag Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-011
CVE ID: CVE-2025-31683 State: PUBLISHED Published: 2025-03-31T21:41:01.996Z Last Updated: 2025-04-29T15:33:53.583Z Vendors: Drupal Products: Google Tag Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-012
CVE ID: CVE-2025-31684 State: PUBLISHED Published: 2025-03-31T21:43:06.076Z Last Updated: 2025-04-29T15:33:07.247Z Vendors: Drupal Products: OAuth2 Client Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-013
CVE ID: CVE-2025-31685 State: PUBLISHED Published: 2025-03-31T21:43:27.662Z Last Updated: 2025-04-29T15:31:06.666Z Vendors: Drupal Products: Open Social Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-014
CVE ID: CVE-2025-31686 State: PUBLISHED Published: 2025-03-31T21:44:08.763Z Last Updated: 2025-04-29T15:29:04.156Z Vendors: Drupal Products: Open Social Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-015
CVE ID: CVE-2025-31687 State: PUBLISHED Published: 2025-03-31T21:44:50.483Z Last Updated: 2025-04-29T15:26:59.461Z Vendors: Drupal Products: SpamSpan filter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-016
CVE ID: CVE-2025-31688 State: PUBLISHED Published: 2025-03-31T21:45:16.458Z Last Updated: 2025-04-29T15:28:10.316Z Vendors: Drupal Products: Configuration Split Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-017
CVE ID: CVE-2025-31689 State: PUBLISHED Published: 2025-03-31T21:45:37.759Z Last Updated: 2025-04-29T15:25:26.911Z Vendors: Drupal Products: General Data Protection Regulation Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-018
CVE ID: CVE-2025-31690 State: PUBLISHED Published: 2025-03-31T21:49:18.300Z Last Updated: 2025-04-29T15:23:27.313Z Vendors: Drupal Products: Cache Utility Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-019
CVE ID: CVE-2025-31691 State: PUBLISHED Published: 2025-03-31T21:49:42.796Z Last Updated: 2025-04-29T15:20:48.207Z Vendors: Drupal Products: OAuth2 Server Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-020
CVE ID: CVE-2025-31692 State: PUBLISHED Published: 2025-03-31T21:50:34.673Z Last Updated: 2025-04-03T17:23:24.605Z Vendors: Drupal Products: AI (Artificial Intelligence) Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-021
CVE ID: CVE-2025-31693 State: PUBLISHED Published: 2025-03-31T21:51:17.459Z Last Updated: 2025-04-03T17:24:33.215Z Vendors: Drupal Products: AI (Artificial Intelligence) Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-022
CVE ID: CVE-2025-31694 State: PUBLISHED Published: 2025-03-31T21:51:40.451Z Last Updated: 2025-04-29T15:19:38.757Z Vendors: Drupal Products: Two-factor Authentication (TFA) Problem Types: CWE-288 Description: Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-023
CVE ID: CVE-2025-31695 State: PUBLISHED Published: 2025-03-31T21:52:55.173Z Last Updated: 2025-04-29T15:18:04.701Z Vendors: Drupal Products: Link field display mode formatter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-024
CVE ID: CVE-2025-31696 State: PUBLISHED Published: 2025-03-31T21:55:01.951Z Last Updated: 2025-04-29T15:17:13.268Z Vendors: Drupal Products: RapiDoc OAS Field Formatter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-025
CVE ID: CVE-2025-31697 State: PUBLISHED Published: 2025-03-31T21:55:59.521Z Last Updated: 2025-04-29T15:16:16.212Z Vendors: Drupal Products: Formatter Suite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-026
CVE ID: CVE-2025-31698 State: PUBLISHED Published: 2025-06-19T10:07:46.733Z Last Updated: 2025-06-20T13:32:19.681Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-284 Description: ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue. Additional Analyst Notes: - C
2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/15t32nxbypqg1m2smp640vjx89o6v5f8
CVE ID: CVE-2025-31700 State: PUBLISHED Published: 2025-07-23T06:54:37.996Z Last Updated: 2025-07-23T14:19:19.313Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dahua Products: IPC, SD Description: A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern. Add
ch reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/775
CVE ID: CVE-2025-31701 State: PUBLISHED Published: 2025-07-23T06:55:20.001Z Last Updated: 2025-07-23T14:14:04.669Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dahua Products: IPC, SD Description: A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern. Add
CVE ID: CVE-2025-31702 State: PUBLISHED Published: 2025-10-15T05:53:35.664Z Last Updated: 2025-10-15T13:25:09.791Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Dahua Products: IPC, SD Problem Types: CWE-732 Description: A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected. Additional Analyst Notes: -
password, leading to privilege escalation. Systems with only admin account are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/777
CVE ID: CVE-2025-31710 State: PUBLISHED Published: 2025-06-03T05:50:51.239Z Last Updated: 2025-06-03T15:19:39.406Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300 Problem Types: cwe-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
ith no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1929773763314909186
CVE ID: CVE-2025-31711 State: PUBLISHED Published: 2025-06-03T05:50:52.353Z Last Updated: 2025-06-03T15:20:01.057Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300 Problem Types: cwe-476 NULL Pointer Dereference Description: In cplog service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1929773763314909186
CVE ID: CVE-2025-31712 State: PUBLISHED Published: 2025-06-03T05:50:53.405Z Last Updated: 2025-06-03T15:20:29.396Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300 Problem Types: cwe-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Description: In cplog service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
ice with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1929773763314909186
CVE ID: CVE-2025-31713 State: PUBLISHED Published: 2025-08-18T00:34:28.435Z Last Updated: 2025-08-18T16:31:07.724Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152 Problem Types: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
ge with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1944933773300793346
CVE ID: CVE-2025-31714 State: PUBLISHED Published: 2025-08-18T00:34:29.399Z Last Updated: 2025-08-18T16:22:50.535Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152 Problem Types: CWE-20 Improper Input Validation Description: In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1944933773300793346
CVE ID: CVE-2025-31715 State: PUBLISHED Published: 2025-08-18T00:34:30.378Z Last Updated: 2025-08-18T16:09:44.247Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SL8521E/SL8521ET/ SL8541E/UIS8141E/UWS6137/UWS6137E/UWS6151(E)/UWS6152 Problem Types: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1944933773300793346
CVE ID: CVE-2025-31716 State: PUBLISHED Published: 2025-08-01T05:55:00.365Z Last Updated: 2025-08-01T13:35:27.882Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000 Problem Types: cwe-121 Stack-based Buffer Overflow Description: In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/19511579
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1951157990262374401
CVE ID: CVE-2025-31717 State: PUBLISHED Published: 2025-10-11T00:26:51.490Z Last Updated: 2025-10-15T00:52:26.264Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T750/T765/T760/T770/T820/S8000/T8300/T9300 Problem Types: CWE-20 Improper Input Validation Description: In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en/support/announcement/1976557615080263681
CVE ID: CVE-2025-31718 State: PUBLISHED Published: 2025-10-11T00:26:52.570Z Last Updated: 2025-10-15T00:52:27.257Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: T606/T612/T616/T750/T765/T760/T770/T820/S8000/T8300/T9300 Problem Types: CWE-20 Improper Input Validation Description: In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en/support/announcement/1976557615080263681
CVE ID: CVE-2025-31719 State: PUBLISHED Published: 2025-11-11T00:33:24.431Z Last Updated: 2025-11-14T19:25:21.404Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300 Problem Types: cwe-665 Improper Initialization Description: In TEE EcDSA algorithm, there is a possible memory consistency issue. This could lead to generated incorrect signature results with low probability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en/support/announcement/1987692028719517698
CVE ID: CVE-2025-31720 State: PUBLISHED Published: 2025-04-02T14:59:49.570Z Last Updated: 2025-04-02T16:49:21.599Z Vendors: Jenkins Project Products: Jenkins Description: A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended Read permission to copy an agent, gaining access to its configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3512
CVE ID: CVE-2025-31721 State: PUBLISHED Published: 2025-04-02T14:59:50.144Z Last Updated: 2025-04-02T16:51:08.706Z Vendors: Jenkins Project Products: Jenkins Description: A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configure permission to copy an agent, gaining access to encrypted secrets in its configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3513
CVE ID: CVE-2025-31722 State: PUBLISHED Published: 2025-04-02T14:59:50.726Z Last Updated: 2025-04-04T03:55:28.415Z Vendors: Jenkins Project Products: Jenkins Templating Engine Plugin Description: In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3505
CVE ID: CVE-2025-31723 State: PUBLISHED Published: 2025-04-02T14:59:51.305Z Last Updated: 2025-04-02T16:59:30.175Z Vendors: Jenkins Project Products: Jenkins Simple Queue Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3469
CVE ID: CVE-2025-31724 State: PUBLISHED Published: 2025-04-02T14:59:51.859Z Last Updated: 2025-04-03T13:29:16.707Z Vendors: Jenkins Project Products: Jenkins Cadence vManager Plugin Description: Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3537