Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4922 State: PUBLISHED Published: 2025-06-11T13:24:18.976Z Last Updated: 2025-06-11T13:53:55.809Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-266 Description: Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-12-nomad-vulnerable-to-incorrect-acl-policy-l
ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-12-nomad-vulnerable-to-incorrect-acl-policy-lookup-attached-to-a-job/75396
CVE ID: CVE-2025-4923 State: PUBLISHED Published: 2025-05-19T08:00:07.659Z Last Updated: 2025-05-19T15:47:52.790Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Client Database Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown processing of the file /user_delivery_update.php. The manipulation of the argument uploaded_file_cancelled leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - C
k may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309485 - https://vuldb.com/?ctiid.309485 - https://vuldb.com/?submit.579104 - https://github.com/akihi0342/cve/issues/1 - https://www.sourcecodester.com/
CVE ID: CVE-2025-4924 State: PUBLISHED Published: 2025-05-19T08:31:05.514Z Last Updated: 2025-05-19T14:41:44.981Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Client Database Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. Affected is an unknown function of the file /user_void_transaction.php. The manipulation of the argument order_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309486 - https://vuldb.com/?ctiid.309486 - https://vuldb.com/?submit.579111 - https://github.com/akihi0342/cve/issues/2 - https://www.sourcecodester.com/
CVE ID: CVE-2025-4925 State: PUBLISHED Published: 2025-05-19T09:00:11.199Z Last Updated: 2025-05-19T14:39:30.812Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Daily Expense Tracker System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /expense-monthwise-reports-detailed.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
nched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309487 - https://vuldb.com/?ctiid.309487 - https://vuldb.com/?submit.579105 - https://github.com/f1rstb100d/myCVE/issues/24 - https://phpgurukul.com/
CVE ID: CVE-2025-4926 State: PUBLISHED Published: 2025-05-19T09:31:05.412Z Last Updated: 2025-05-19T14:28:07.770Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: PHPGurukul Products: Car Rental Project Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in PHPGurukul Car Rental Project 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/post-avehical.php. The manipulation of the argument img1/img2/img3/img4/img5 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309488 - https://vuldb.com/?ctiid.309488 - https://vuldb.com/?submit.579163 - https://github.com/6BXK6/cve/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-4927 State: PUBLISHED Published: 2025-05-19T10:00:08.241Z Last Updated: 2025-05-19T14:19:05.939Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Online Marriage Registration System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Online Marriage Registration System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/between-dates-application-report.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vu
e attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309489 - https://vuldb.com/?ctiid.309489 - https://vuldb.com/?submit.579300 - https://github.com/sknadklasdls/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4928 State: PUBLISHED Published: 2025-05-19T10:31:04.052Z Last Updated: 2025-05-19T14:10:56.025Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Lawyer Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /save_lawyer_edit_profile.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected. Additional Analyst Notes: - CISA ADP Vulnrichment
to the public and may be used. Multiple parameters might be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309490 - https://vuldb.com/?ctiid.309490 - https://vuldb.com/?submit.579313 - https://github.com/hhhanxx/attack/issues/8
CVE ID: CVE-2025-4929 State: PUBLISHED Published: 2025-05-19T11:00:07.350Z Last Updated: 2025-05-19T14:03:32.588Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Shopping Portal Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file /my-account.php. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309491 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309491 - https://vuldb.com/?ctiid.309491 - https://vuldb.com/?submit.579467 - https://github.com/N1sa26/CVE/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-4930 State: PUBLISHED Published: 2025-05-19T11:31:04.398Z Last Updated: 2025-05-19T13:34:43.271Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Shopping Portal Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /my-cart.php. The manipulation of the argument billingaddress leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309492 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309492 - https://vuldb.com/?ctiid.309492 - https://vuldb.com/?submit.579468 - https://github.com/N1sa26/CVE/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-4931 State: PUBLISHED Published: 2025-05-19T12:00:08.335Z Last Updated: 2025-05-19T13:31:06.714Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in projectworlds Online Lawyer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /user_registation.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309493 - https://vuldb.com/?ctiid.309493 - https://vuldb.com/?submit.579481 - https://github.com/hhhanxx/attack/issues/11
CVE ID: CVE-2025-4932 State: PUBLISHED Published: 2025-05-19T12:31:04.018Z Last Updated: 2025-05-19T12:57:52.109Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Lawyer Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in projectworlds Online Lawyer Management System 1.0. Affected by this issue is some unknown functionality of the file /lawyer_registation.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ly. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309494 - https://vuldb.com/?ctiid.309494 - https://vuldb.com/?submit.579676 - https://github.com/hhhanxx/attack/issues/12
CVE ID: CVE-2025-4933 State: PUBLISHED Published: 2025-05-19T13:00:07.934Z Last Updated: 2025-05-19T13:38:49.828Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ponaravindb Products: Hospital-Management-System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in ponaravindb Hospital-Management-System 1.0. This affects an unknown part of the file /doctor-panel.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309495 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309495 - https://vuldb.com/?ctiid.309495 - https://vuldb.com/?submit.579678 - https://github.com/zylv0002/SQLi-ponaravindb-HMS
CVE ID: CVE-2025-4934 State: PUBLISHED Published: 2025-05-19T13:31:05.881Z Last Updated: 2025-05-19T15:21:46.324Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: User Registration & Login and User Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul User Registration & Login and User Management System 3.3 and classified as critical. This vulnerability affects unknown code of the file /edit-profile.php. The manipulation of the argument Contact leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
iated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309496 - https://vuldb.com/?ctiid.309496 - https://vuldb.com/?submit.579759 - https://github.com/LitBot123/mycve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4935 State: PUBLISHED Published: 2025-05-19T14:00:06.383Z Last Updated: 2025-05-19T15:21:40.383Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Stock Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /php_action/changePassword.php. The manipulation of the argument user_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309497 - https://vuldb.com/?ctiid.309497 - https://vuldb.com/?submit.579798 - https://github.com/hubCVE2025/CVE/issues/2 - https://www.sourcecodester.com/
CVE ID: CVE-2025-4936 State: PUBLISHED Published: 2025-05-19T14:31:04.591Z Last Updated: 2025-05-19T15:21:33.808Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Food Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Food Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin-page.php. The manipulation of the argument 1_price leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309498 - https://vuldb.com/?ctiid.309498 - https://vuldb.com/?submit.579823 - https://github.com/sknadklasdls/CVE/issues/3
CVE ID: CVE-2025-4937 State: PUBLISHED Published: 2025-05-19T15:00:08.309Z Last Updated: 2025-05-19T15:18:13.574Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Apartment Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Addi
remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309499 - https://vuldb.com/?ctiid.309499 - https://vuldb.com/?submit.579830 - https://github.com/Angel12345623/CVE/blob/main/CVE_3.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-4938 State: PUBLISHED Published: 2025-05-19T15:31:05.423Z Last Updated: 2025-05-19T15:56:14.804Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Employee Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Employee Record Management System 1.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registererms.php. The manipulation of the argument Email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309500 - https://vuldb.com/?ctiid.309500 - https://vuldb.com/?submit.579848 - https://github.com/WuYanneko/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-4939 State: PUBLISHED Published: 2025-05-19T16:00:11.270Z Last Updated: 2025-05-19T16:52:45.945Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Credit Card Application Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in PHPGurukul Credit Card Application Management System 1.0. This vulnerability affects unknown code of the file /admin/new-ccapplication.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309502 - https://vuldb.com/?ctiid.309502 - https://vuldb.com/?submit.580119 - https://github.com/GIRISH05/credit-card-application-management-system-using-php-and-mysql/blob/main/Stored%20Cross-Site%20Scripting%20(XSS).md - https://phpgurukul.com/
CVE ID: CVE-2025-4940 State: PUBLISHED Published: 2025-05-19T16:31:04.731Z Last Updated: 2025-05-19T16:57:38.633Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Daily College Class Work Report Book Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Daily College Class Work Report Book 1.0. This issue affects some unknown processing of the file /admin_info.php. The manipulation of the argument batch leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309503 - https://vuldb.com/?ctiid.309503 - https://vuldb.com/?submit.580161 - https://github.com/ubfbuz3/cve/issues/15 - https://1000projects.org/
CVE ID: CVE-2025-4941 State: PUBLISHED Published: 2025-05-19T17:00:10.281Z Last Updated: 2025-05-20T14:06:11.513Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Credit Card Application Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Credit Card Application Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309504 - https://vuldb.com/?ctiid.309504 - https://vuldb.com/?submit.580167 - https://github.com/GIRISH05/Credit-card-application-management-system/blob/main/SQL-Injection.md - https://phpgurukul.com/
CVE ID: CVE-2025-4943 State: PUBLISHED Published: 2025-05-30T06:42:49.476Z Last Updated: 2025-05-30T13:56:38.648Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: choijun Products: LA-Studio Element Kit for Elementor Problem Types: CWE-79 Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-lakit-element-link’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c5822b9-7fd0-4c39-a298-70d0debcc136?source=cve - https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/assets/js/addons/wrapper-links.min.js - https://wordpress.org/plugins/lastudio-element-kit/#developers - https://plugins.trac.wordpress.org/changeset/3302784/
CVE ID: CVE-2025-4944 State: PUBLISHED Published: 2025-05-30T11:15:09.733Z Last Updated: 2025-05-30T12:25:41.372Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: choijun Products: LA-Studio Element Kit for Elementor Problem Types: CWE-79 Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widgets in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scrip
is makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68ae8404-6dfa-4b13-b2a6-bd4554f1043f?source=cve - https://wordpress.org/plugins/lastudio-element-kit/#developers - https://plugins.trac.wordpress.org/changeset/3302784/
CVE ID: CVE-2025-4945 State: PUBLISHED Published: 2025-05-19T17:03:09.472Z Last Updated: 2025-11-25T05:13:23.815Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services f
Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-190 Description: A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value
other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:19713 - https://access.redhat.com/errata/RHSA-2025:19714 - https://access.redhat.com/errata/RHSA-2025:19720 - https://access.redhat.com/errata/RHSA-2025:20959