Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Was ZDI-CAN-25606. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-225/
CVE ID: CVE-2025-1051 State: PUBLISHED Published: 2025-06-02T19:05:27.126Z Last Updated: 2025-06-03T02:02:08.294Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sonos Products: Era 300 Problem Types: CWE-122 Description: Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of ALAC data. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffe
results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Was ZDI-CAN-25865. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-311/
CVE ID: CVE-2025-1052 State: PUBLISHED Published: 2025-02-11T19:54:06.776Z Last Updated: 2025-02-12T14:33:28.204Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Mintty Products: Mintty Problem Types: CWE-122 Description: Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mintty. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of sixel images. The issue results from the lack of proper validation of
e. The specific flaw exists within the parsing of sixel images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23382. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-084/
CVE ID: CVE-2025-1053 State: PUBLISHED Published: 2025-02-14T03:47:35.931Z Last Updated: 2025-09-09T19:03:10.704Z Vendors: Brocade Products: Brocade SANnav Problem Types: CWE-532 Description: Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANnav. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25399
CVE ID: CVE-2025-1054 State: PUBLISHED Published: 2025-04-23T09:23:38.653Z Last Updated: 2025-04-23T15:40:20.802Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: uicore Products: UiCore Elements – Free Elementor widgets and templates Problem Types: CWE-79 Description: The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the UI Counter, UI Icon Box, UI Testimonial Slider, UI Testimonial Grid, and UI Testimonial Carousel widgets in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi
.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d74e8541-9726-4bc2-9fbd-f6016490e0ea?source=cve - https://plugins.trac.wordpress.org/changeset/3253371/uicore-elements
CVE ID: CVE-2025-1055 State: PUBLISHED Published: 2025-06-10T23:23:19.887Z Last Updated: 2025-06-11T13:48:09.364Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: K7 Security Products: K7 Security Anti-Malware Problem Types: CWE-862 Description: A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected by the operating system. This flaw stems from missing access control in the driver's IOCTL handler, enabling unprivileged us
he operating system. This flaw stems from missing access control in the driver's IOCTL handler, enabling unprivileged users to perform privileged actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical services or privileged applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pentraze.com/ - https://pentraze.com/vulnerability-reports/
CVE ID: CVE-2025-1056 State: PUBLISHED Published: 2025-04-23T05:18:10.120Z Last Updated: 2025-04-23T13:09:33.255Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Axis Communications AB Products: AXIS Camera Station Pro Problem Types: CWE-73 Description: Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the server is using. A non-admin user can modify this file to either create files or change the content of files in an admin-protected location. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional
sion for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/e4/2e/b2/cve-2025-1056pdf-en-US-479106.pdf
CVE ID: CVE-2025-1057 State: PUBLISHED Published: 2025-03-15T08:50:48.649Z Last Updated: 2025-11-20T20:00:38.850Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 Problem Types: CWE-704 Description: A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registr
data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-1057 - https://bugzilla.redhat.com/show_bug.cgi?id=2343894
CVE ID: CVE-2025-1058 State: PUBLISHED Published: 2025-02-13T05:45:05.513Z Last Updated: 2025-02-13T16:30:26.270Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Electric Products: ASCO 5310 Single-Channel Remote Annunciator, ASCO 5350 Eight Channel Remote Annunciator Problem Types: CWE-494 Description: CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=sevd-2025-042-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-
chneider-electric.com/files?p_Doc_Ref=sevd-2025-042-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-01.pdf
CVE ID: CVE-2025-1059 State: PUBLISHED Published: 2025-02-13T05:49:51.234Z Last Updated: 2025-02-13T16:30:37.195Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: ASCO 5310 Single-Channel Remote Annunciator, ASCO 5350 Eight Channel Remote Annunciator Problem Types: CWE-770 Description: CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to the webserver of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=sevd-2025-042-01&p_enDocType=Security+and+Saf
ent: References: - https://download.schneider-electric.com/files?p_Doc_Ref=sevd-2025-042-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-01.pdf
CVE ID: CVE-2025-1060 State: PUBLISHED Published: 2025-02-13T05:53:14.338Z Last Updated: 2025-02-13T15:57:42.661Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: ASCO 5310 Single-Channel Remote Annunciator, ASCO 5350 Eight Channel Remote Annunciator Problem Types: CWE-319 Description: CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed by an attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=sevd-2025-042-01&p_enDocType=Security+and+Safety+Notice&p_
es: - https://download.schneider-electric.com/files?p_Doc_Ref=sevd-2025-042-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-01.pdf
CVE ID: CVE-2025-1061 State: PUBLISHED Published: 2025-02-07T01:41:10.227Z Last Updated: 2025-02-07T15:58:52.665Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nextendweb Products: Nextend Social Login Pro Problem Types: CWE-288 Description: The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
cated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6494e54c-db04-41f9-8b91-6ad12528cf01?source=cve - https://nextendweb.com/nextend-social-login-docs/provider-apple/ - https://nextendweb.com/nextend-social-login-docs/pro-addon-changelog/
CVE ID: CVE-2025-1062 State: PUBLISHED Published: 2025-03-24T06:00:10.384Z Last Updated: 2025-03-24T18:09:24.897Z Vendors: Unknown Products: Slider, Gallery, and Carousel by MetaSlider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/657b355b-e38f-46d6-b574-7ce736d25f31
lyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/657b355b-e38f-46d6-b574-7ce736d25f31/
CVE ID: CVE-2025-1063 State: PUBLISHED Published: 2025-02-25T06:58:31.877Z Last Updated: 2025-02-25T14:37:36.278Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: techlabpro1 Products: Classified Listing – Classified ads & Business Directory Plugin Problem Types: CWE-200 Description: The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens. Additional Analyst Notes: - CISA ADP Vulnri
enticated attackers to extract sensitive data including API keys and tokens. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e701b771-59f2-4783-b0a1-bea4d6c3d245?source=cve - https://plugins.trac.wordpress.org/changeset/3241883/classified-listing
CVE ID: CVE-2025-1064 State: PUBLISHED Published: 2025-02-20T08:22:06.626Z Last Updated: 2025-02-20T16:11:16.886Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xootix Products: Login/Signup Popup ( Inline Form + Woocommerce ) Problem Types: CWE-79 Description: The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode in all versions up to, and including, 2.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrar
ributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd62a072-8619-4f51-a52f-2ada7e455cb1?source=cve - https://plugins.trac.wordpress.org/changeset/3239293/easy-login-woocommerce
CVE ID: CVE-2025-1065 State: PUBLISHED Published: 2025-02-19T05:22:52.516Z Last Updated: 2025-02-19T14:56:01.047Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Visualizer: Tables and Charts Manager for WordPress Problem Types: CWE-79 Description: The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From File feature in all versions up to, and including, 3.11.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to
ser supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17c1de7b-5178-4fbe-a515-169de4323ae7?source=cve - https://plugins.trac.wordpress.org/changeset/3240066/visualizer
CVE ID: CVE-2025-1066 State: PUBLISHED Published: 2025-02-05T23:39:42.167Z Last Updated: 2025-03-20T13:24:21.384Z Vendors: openPLC Products: OpenPLC Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: OpenPLC_V3 contains an arbitrary file upload vulnerability, which could be leveraged for malvertising or phishing campaigns. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thiagoralves/OpenPLC_v3/commit/d1b1a3b7e97f2b3fef0876056cf9d7879991744a - https://medium.com/@alimuhammadsecured/cyberforce-2024-how-i-found-my-first-cve-openplcv3-16c058b114b0
CVE ID: CVE-2025-1067 State: PUBLISHED Published: 2025-02-25T16:26:03.580Z Last Updated: 2025-02-26T00:03:50.613Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Esri Products: ArcGIS Pro Problem Types: CWE-732 Description: There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1. Additional Analy
icious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-pro-and-arcgis-allsource-patches-address-high-severity-vulnerabilities
CVE ID: CVE-2025-1068 State: PUBLISHED Published: 2025-02-25T16:26:18.161Z Last Updated: 2025-02-26T00:05:24.143Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Esri Products: ArcGIS AllSource Problem Types: CWE-426 Description: There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS AllSource, the file could execute and run malicious commands under the context of the victim. This issue is corrected in ArcGIS AllSource 1.2.1 and 1.3.1.
and run malicious commands under the context of the victim. This issue is corrected in ArcGIS AllSource 1.2.1 and 1.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-pro-and-arcgis-allsource-patches-address-high-severity-vulnerabilities
CVE ID: CVE-2025-1070 State: PUBLISHED Published: 2025-02-13T05:55:55.497Z Last Updated: 2025-02-13T14:27:22.782Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Electric Products: ASCO 5310 Single-Channel Remote Annunciator, ASCO 5350 Eight Channel Remote Annunciator Problem Types: CWE-434 Description: CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=sevd-2025-042-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025
oad.schneider-electric.com/files?p_Doc_Ref=sevd-2025-042-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-01.pdf
CVE ID: CVE-2025-1071 State: PUBLISHED Published: 2025-02-14T13:20:48.780Z Last Updated: 2025-02-14T14:05:47.670Z Vendors: WatchGuard Products: Fireware OS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00001
CVE ID: CVE-2025-1072 State: PUBLISHED Published: 2025-02-07T04:05:20.188Z Last Updated: 2025-02-07T15:58:01.767Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/463093 - https://hackerone.com/reports/2504059 - http
hment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/463093 - https://hackerone.com/reports/2504059 - https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#denial-of-service-by-importing-malicious-crafted-fogbugz-import-payload
CVE ID: CVE-2025-1073 State: PUBLISHED Published: 2025-04-10T11:16:33.999Z Last Updated: 2025-04-15T03:39:35.888Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: Panasonic Products: IR Control Hub (IR Blaster) Problem Types: CWE-1299 Description: Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lsin.panasonic.com/release-notes
CVE ID: CVE-2025-1074 State: PUBLISHED Published: 2025-02-06T14:00:12.576Z Last Updated: 2025-02-06T14:30:20.917Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Webkul Products: QloApps Problem Types: CWE-352, CWE-862 Description: A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it. Additio
. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294834 - https://vuldb.com/?ctiid.294834 - https://vuldb.com/?submit.491600 - https://github.com/mano257200/qloapps-csrf-logout-vulnerability
CVE ID: CVE-2025-1075 State: PUBLISHED Published: 2025-02-19T09:49:55.695Z Last Updated: 2025-11-13T12:54:20.274Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17495
CVE ID: CVE-2025-1076 State: PUBLISHED Published: 2025-02-06T13:33:07.077Z Last Updated: 2025-02-13T13:47:45.237Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Holded Products: Holded Problem Types: CWE-79 Description: A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-vulnerability-holded
CVE ID: CVE-2025-1077 State: PUBLISHED Published: 2025-02-07T08:32:01.813Z Last Updated: 2025-02-07T15:53:44.186Z Vendors: IBL Software Engineering Products: Visual Weather, NAMIS, Aero Weather, Satellite Weather Problem Types: CWE-502, CWE-20 Description: A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The vulnerability is present in the Product Delivery Service (PDS) component in specific server configurations where the PDS pipeline utilizes the IPDS pipeline with Message Editor Output Filters enabled. A remote unauthenticated attacker can exploit this vulnerability to send unauthenti