Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-46014 State: PUBLISHED Published: 2025-06-30T00:00:00.000Z Last Updated: 2025-06-30T14:05:49.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or overly permissive security attributes, leading to a privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Souhardya/Exploit-PoCs/tree/main/HonorPCManager-PrivEsc
CVE ID: CVE-2025-46018 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T17:55:17.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cscsw.com/disclosure-process/ - https://github.com/niranjangaire1995/CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass
CVE ID: CVE-2025-46035 State: PUBLISHED Published: 2025-06-12T00:00:00.000Z Last Updated: 2025-06-12T15:44:29.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the /goform/openSchedWifi endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - http://ac6.com - https://github.com/XiDP0/MyCVE/blob/main/CVE/Tenda%20AC6%20V15.03.05.16/setSchedWifi/setSchedWifi.md
CVE ID: CVE-2025-46041 State: PUBLISHED Published: 2025-06-09T00:00:00.000Z Last Updated: 2025-06-09T19:47:45.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://anchor.com - https://github.com/binneko/CVE-2025-46041
CVE ID: CVE-2025-46047 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:32:18.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Silverpeas/Silverpeas-Core/pull/1399 - https://github.com/J0ey17/Silverpeas-Username-Enumeration-PoC
CVE ID: CVE-2025-46052 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-15T19:22:58.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.weberp.org/ - https://github.com/johnchd/CVEs/blob/main/WebERP/CVE-2025-46052%20-%20SQLi.md
CVE ID: CVE-2025-46053 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-19T18:17:14.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.weberp.org/ - https://github.com/johnchd/CVEs/blob/main/WebERP/CVE-2025-46053%20-%20SQLi.md
CVE ID: CVE-2025-46059 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-08-03T23:20:43.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component. This vulnerability allows attackers to execute arbitrary code and compromise the application via a crafted email message. NOTE: this is disputed by the Supplier because the code-execution issue was introduced by user-written code that does not adhere to the LangChain security practices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langchain-ai/langchain/issues/308
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langchain-ai/langchain/issues/30833 - https://github.com/Jr61-star/CVEs/blob/main/CVE-2025-46059.md - https://github.com/langchain-ai/langchain-community/issues/217#issuecomment-3144824471 - https://python.langchain.com/docs/security/
CVE ID: CVE-2025-46060 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-06-13T15:11:34.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://totolink.com - https://github.com/Luanruy/qax - https://github.com/Luanruy/qax/blob/main/CVE-2025-46060_Info.md
CVE ID: CVE-2025-46078 State: PUBLISHED Published: 2025-05-29T00:00:00.000Z Last Updated: 2025-05-29T14:02:03.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yggcwhat/test/blob/main/README.md - https://github.com/yggcwhat/CVE-2025-46078/
CVE ID: CVE-2025-46080 State: PUBLISHED Published: 2025-05-29T00:00:00.000Z Last Updated: 2025-05-29T14:09:30.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yggcwhat/test2/blob/main/README.md - https://github.com/yggcwhat/CVE-2025-46080/
CVE ID: CVE-2025-46093 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-05T16:22:50.895Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: LiquidFiles Products: LiquidFiles Problem Types: CWE-732 Description: LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript feature and the sudoers configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.liquidfiles.com/release_notes/version_4-1-x.html - https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce/ - https://gis
lease_notes/version_4-1-x.html - https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce/ - https://gist.github.com/nikolai0x/f61a8bfcdaa244e0c46931d74d10c4ea
CVE ID: CVE-2025-46094 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-05T16:12:39.322Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: LiquidFiles Products: LiquidFiles Problem Types: CWE-24 Description: LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.liquidfiles.com/release_notes/version_4-1-x.html - https://projectblack.io/blog/liquidfiles-vulnerability-authenticated-rce/
CVE ID: CVE-2025-46096 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-06-13T16:02:25.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opensolon/solon/issues/357 - https://gist.github.com/yaoyao-cool/1b7d80930fea88b6fd4839646cedc437
CVE ID: CVE-2025-46099 State: PUBLISHED Published: 2025-07-23T00:00:00.000Z Last Updated: 2025-07-23T13:54:38.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://pluck.com - https://github.com/0xC4J/CVE-Lists/blob/main/CVE-2025-46099/CVE-2025-46099.md
CVE ID: CVE-2025-46101 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-24T16:02:28.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Beakon Software Beakon Learning Management System Sharable Content Object Reference Model (SCORM) version before 5.4.3 allows a remote attacker to obtain sensitive information via the ks parameter in json_scorm.php file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstorm.news/files/id/200942/
CVE ID: CVE-2025-46102 State: PUBLISHED Published: 2025-07-17T00:00:00.000Z Last Updated: 2025-07-17T19:49:35.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Beakon Software Beakon Learning Management System Sharable Content Object Reference Model (SCORM) version V.5.4.3 allows a remote attacker to obtain sensitive information via the URL parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://beakons.com - https://beakon.com.au - https://au.beakon.io/%7Bclient_dir%7D/courses/lms/scorm/loader.html?id=asdf&v=SCORM_12&preview=0&l=asdf&s=asdf&u=1&url=javascript:alert%28document.cookie - https://packetstorm.news/file
ml?id=asdf&v=SCORM_12&preview=0&l=asdf&s=asdf&u=1&url=javascript:alert%28document.cookie - https://packetstorm.news/files/id/207103
CVE ID: CVE-2025-46109 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-18T15:24:09.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to obtain sensitive information via a crafted GET request Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cocr.cc/2025/04/17/pbootcms/ - https://github.com/pbootcmspro/PbootCMS/issues/22
CVE ID: CVE-2025-46116 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T16:53:31.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command `!v54!` via a management API call and then invoke it to escape the restricted shell and obtain a root shell on the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/
DP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
CVE ID: CVE-2025-46117 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-23T17:21:00.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hidden debug script `.ap_debug.sh` invoked from the restricted CLI does not properly sanitize its input, allowing an authenticated attacker to execute arbitrary commands as root on the controller or specified target. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.n
ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
CVE ID: CVE-2025-46118 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-28T19:37:41.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-coded credentials for the ftpuser account provide FTP access to the controller, enabling a remote attacker to upload or retrieve arbitrary files from writable firmware directories and thereby expose sensitive information or compromise the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulleti
er. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
CVE ID: CVE-2025-46119 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-23T17:19:32.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where an authenticated request to the management endpoint `/admin/_cmdstat.jsp` discloses the administrator password in a trivially reversible obfuscated form. The same obfuscation method persists in configuration prior to 200.18.7.1.302, allowing anyone who obtains the system configuration to recover the plaintext credentials. Additional Analyst Notes: - CISA ADP Vulnrichme
o obtains the system configuration to recover the plaintext credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
CVE ID: CVE-2025-46120 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-23T17:18:49.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outside permitted directories, allowing a remote unauthenticated attacker who can upload a template (e.g., via FTP) to escalate privileges and run arbitrary template code on the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.r
rary template code on the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
CVE ID: CVE-2025-46121 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-28T19:42:06.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stamgr_cfg_adpt_addStaIot` pass a client hostname directly to snprintf as the format string. A remote attacker can exploit this flaw either by sending a crafted request to the authenticated endpoint `/admin/_conf.jsp`, or without authentication and without direct network access to the controller by spoofing the MAC address of a favourite station and embedding malici
without direct network access to the controller by spoofing the MAC address of a favourite station and embedding malicious format specifiers in the DHCP hostname field, resulting in unauthenticated format-string processing and arbitrary code execution on the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
CVE ID: CVE-2025-46122 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-23T17:16:46.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/post/2025-07-ruckus-unlea
es: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
CVE ID: CVE-2025-46123 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-24T20:25:38.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the authenticated configuration endpoint `/admin/_conf.jsp` writes the Wi-Fi guest password to memory with snprintf using the attacker-supplied value as the format string; a crafted password therefore triggers uncontrolled format-string processing and enables remote code execution on the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
enables remote code execution on the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/330 - https://sector7.computest.nl/post/2025-07-ruckus-unleashed/
CVE ID: CVE-2025-46148 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-25T18:47:30.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/151198 - https://gist.github.com/shaoyuyoung/65a587a579dfdff887b9b35bb79b9093 - https://github.com/pytorch/pytorch/pull/152993 - https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a
CVE ID: CVE-2025-46149 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-25T18:44:23.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/147848 - https://github.com/pytorch/pytorch/pull/147961 - https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a
CVE ID: CVE-2025-46150 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-25T18:40:55.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/141538 - https://github.com/pytorch/pytorch/issues/141538#issuecomment-2537424658 - https://github.com/pytorch/pytorch/pull/144395 - https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a
CVE ID: CVE-2025-46152 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-25T18:38:40.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/143555 - https://github.com/pytorch/pytorch/pull/143635 - https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a
CVE ID: CVE-2025-46153 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-25T18:33:13.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d for fallback_random=True. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pytorch/pytorch/issues/142853 - https://github.com/pytorch/pytorch/pull/143460 - https://gist.github.com/shaoyuyoung/e636f2e7a306105b7e96809e2b85c28a - https://github.com/pytorch/pytorch/compare/v2.
- https://gist.github.com/shaoyuyoung/e636f2e7a306105b7e96809e2b85c28a - https://github.com/pytorch/pytorch/compare/v2.6.0...v2.7.0 - https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a
CVE ID: CVE-2025-46154 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-03T14:07:09.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxcms v1.25 has a SQL time injection in the $_POST['dbname'] parameter of installdb.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Yf3te/CVE/blob/main/CVE-2025-46154
CVE ID: CVE-2025-46157 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-18T13:57:43.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave request form Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://efrotech.com - http://timetrax.com - https://github.com/morphine009/CVE-2025-46157
CVE ID: CVE-2025-46158 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-26T15:17:42.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in redoxOS kernel before commit 5d41cd7c allows a local attacker to cause a denial of service via the `setitimer` syscall Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.redox-os.org/redox-os/kernel/-/issues/164 - https://gitlab.redox-os.org/redox-os/kernel/-/merge_requests/386 - https://github.com/Marsman1996/pocs/tree/master/redox/CVE-2025-46158
CVE ID: CVE-2025-46171 State: PUBLISHED Published: 2025-07-23T00:00:00.000Z Last Updated: 2025-07-23T15:46:25.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vbulletin.com - https://github.com/oiyl/CVE-2025-46171
CVE ID: CVE-2025-46173 State: PUBLISHED Published: 2025-05-27T00:00:00.000Z Last Updated: 2025-05-27T20:19:31.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.invicti.com/learn/blind-cross-site-scripting/ - https://github.com/pruthuraut/CVE-2025-46173
CVE ID: CVE-2025-46176 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-23T18:54:16.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR-816L v2.06B01 allow attackers to remotely execute arbitrary commands via firmware analysis. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/namberino/cve/tree/main/CVE-2025-46176