Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2998 State: PUBLISHED Published: 2025-03-31T14:00:12.169Z Last Updated: 2025-03-31T15:27:27.537Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: PyTorch Problem Types: CWE-119 Description: A vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.pad_packed_sequence. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302047 - https://vuldb.com/?ctiid.302
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302047 - https://vuldb.com/?ctiid.302047 - https://vuldb.com/?submit.524151 - https://github.com/pytorch/pytorch/issues/149622 - https://github.com/pytorch/pytorch/issues/149622#issue-2935495265
CVE ID: CVE-2025-2999 State: PUBLISHED Published: 2025-03-31T14:31:04.982Z Last Updated: 2025-03-31T15:15:18.302Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: PyTorch Problem Types: CWE-119 Description: A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302048 - https://vuldb.com/?ctiid.302048 - https://vuldb.com/?subm
ADP Vulnrichment: References: - https://vuldb.com/?id.302048 - https://vuldb.com/?ctiid.302048 - https://vuldb.com/?submit.524198 - https://github.com/pytorch/pytorch/issues/149622 - https://github.com/pytorch/pytorch/issues/149622#issue-2935495265
CVE ID: CVE-2025-30000 State: PUBLISHED Published: 2025-04-08T08:22:29.519Z Last Updated: 2025-04-08T13:25:21.043Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Siemens License Server (SLS) Problem Types: CWE-295 Description: A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application does not properly restrict permissions of the users. This could allow a lowly-privileged attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-525431.html
CVE ID: CVE-2025-30001 State: PUBLISHED Published: 2025-10-10T09:52:26.810Z Last Updated: 2025-11-04T21:09:55.311Z Vendors: Apache Software Foundation Products: Apache StreamPark Problem Types: CWE-279 Description: Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade to version 2.1.6, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/xfmsvhkcnr1831n0w5ovy3p44lsmfb7m
CVE ID: CVE-2025-30002 State: PUBLISHED Published: 2025-04-16T17:37:28.831Z Last Updated: 2025-04-16T18:03:51.229Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateConnectionVariables' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful a
and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25909) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-30003 State: PUBLISHED Published: 2025-04-16T17:37:30.275Z Last Updated: 2025-04-16T18:03:14.827Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProjectConnections' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful at
and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25910) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-30004 State: PUBLISHED Published: 2025-03-31T16:42:09.932Z Last Updated: 2025-03-31T18:58:36.812Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Xorcom Products: CompletePBX Problem Types: CWE-78 Description: Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/advisories/completepbx-authenticated-command-injection - https://www.xorcom.com/new-completepbx-release
://vulncheck.com/advisories/completepbx-authenticated-command-injection - https://www.xorcom.com/new-completepbx-release-5-2-36-1/
CVE ID: CVE-2025-30005 State: PUBLISHED Published: 2025-03-31T16:45:04.432Z Last Updated: 2025-03-31T18:47:13.896Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Xorcom Products: CompletePBX Problem Types: CWE-22 Description: Xorcom CompletePBX is vulnerable to a path traversal via the Diagnostics reporting module, which will allow reading of arbitrary files and additionally delete any retrieved file in place of the expected report. This issue affects CompletePBX: all versions up to and prior to 5.2.35 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/advisories/completepbx-path-traversal-file-deletion - https://www.xorc
Vulnrichment: References: - https://vulncheck.com/advisories/completepbx-path-traversal-file-deletion - https://www.xorcom.com/new-completepbx-release-5-2-36-1/
CVE ID: CVE-2025-30006 State: PUBLISHED Published: 2025-03-31T16:49:52.940Z Last Updated: 2025-03-31T17:53:14.134Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Xorcom Products: CompletePBX Problem Types: CWE-79 Description: Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel. This issue affects CompletePBX: all versions up to and prior to 5.2.35 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/advisories/completepbx-reflected-xss - https://www.xorcom.com/new-completepbx-release-5-2-36-1/
CVE ID: CVE-2025-30009 State: PUBLISHED Published: 2025-05-13T00:12:52.634Z Last Updated: 2025-05-13T14:06:31.756Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Supplier Relationship Management (Live Auction Cockpit) Problem Types: CWE-79 Description: he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has low impact on confidentiality and integrity within the scope of that victim�s browser, with no effect on availability of the applic
on confidentiality and integrity within the scope of that victim�s browser, with no effect on availability of the application Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3578900 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30010 State: PUBLISHED Published: 2025-05-13T00:13:04.776Z Last Updated: 2025-05-13T14:27:01.826Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Supplier Relationship Management (Live Auction Cockpit) Problem Types: CWE-601 Description: The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to craft a malicious link, which when clicked by a victim, redirects the browser to a malicious site. On successful exploitation, the attacker could cause low impact on confidentiality and integrity with n
malicious site. On successful exploitation, the attacker could cause low impact on confidentiality and integrity with no impact on the availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3578900 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30011 State: PUBLISHED Published: 2025-05-13T00:13:16.048Z Last Updated: 2025-05-13T18:39:20.127Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Supplier Relationship Management (Live Auction Cockpit) Problem Types: CWE-497 Description: The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an malicious request to the application, which could disclose the internal version details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity
rsion details of the affected system. This vulnerability has low impact on confidentiality, with no effect on integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3578900 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30012 State: PUBLISHED Published: 2025-05-13T00:14:21.258Z Last Updated: 2025-07-24T15:59:18.619Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Supplier Relationship Management (Live Auction Cockpit) Problem Types: CWE-502 Description: The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload request in a specific encoding format. The servlet will then decode this malicious request which will result in deserialization of data in the application leading to execution of arbitrary OS command on target
which will result in deserialization of data in the application leading to execution of arbitrary OS command on target as SAP Administrator. This vulnerability has High impact on confidentiality, integrity, and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3578900 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30013 State: PUBLISHED Published: 2025-04-08T07:14:07.797Z Last Updated: 2025-04-10T03:55:32.003Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP ERP BW Business Content Problem Types: CWE-94 Description: SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerability allows the execution of unintended commands on the underlying system, posing a significant security risk to the confidentiality, integrity and availability of
ands on the underlying system, posing a significant security risk to the confidentiality, integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3571093 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30014 State: PUBLISHED Published: 2025-04-08T07:14:25.929Z Last Updated: 2025-04-08T13:23:38.179Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP Capital Yield Tax Management Problem Types: CWE-35 Description: SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, hence causing a high impact on confidentiality. Integrity and Availability are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/2927164 - https://
t affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/2927164 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30015 State: PUBLISHED Published: 2025-04-08T07:14:37.019Z Last Updated: 2025-04-08T13:22:18.635Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP NetWeaver and ABAP Platform (Application Server ABAP) Problem Types: CWE-787 Description: Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges could execute certain forms of SQL queries leading to manipulation of content in the output variable. This vulnerability has a low impact on the confidentiality, integrity and the availability of the application. Additional Analys
nerability has a low impact on the confidentiality, integrity and the availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3565944 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30016 State: PUBLISHED Published: 2025-04-08T07:14:51.578Z Last Updated: 2025-04-10T03:55:34.053Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Financial Consolidation Problem Types: CWE-921 Description: SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises due to improper authentication mechanisms, due to which there is high impact on the Confidentiality, Integrity & Availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3572688 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30017 State: PUBLISHED Published: 2025-04-08T07:15:02.720Z Last Updated: 2025-04-08T13:17:57.793Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SAP_SE Products: SAP Solution Manager Problem Types: CWE-862 Description: Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3558864 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30018 State: PUBLISHED Published: 2025-05-13T00:16:20.584Z Last Updated: 2025-05-13T14:12:04.345Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP Supplier Relationship Management (Live Auction Cockpit) Problem Types: CWE-611 Description: The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the application's confidentiality, with no effect on integrity and availability of the application. Addit
high impact on the application's confidentiality, with no effect on integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3578900 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-30022 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-19T18:41:32.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fr1t0viski/PoCs/blob/main/SQL_Injection_AutoAtendimento
CVE ID: CVE-2025-30023 State: PUBLISHED Published: 2025-07-11T06:02:00.620Z Last Updated: 2025-07-11T16:36:45.516Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS Camera Station Pro, AXIS Camera Station, AXIS Device Manager Problem Types: CWE-502 Description: The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/9b/a5/72/cve-2025-30023pdf-en-US-485733.pdf
CVE ID: CVE-2025-30024 State: PUBLISHED Published: 2025-07-11T06:03:29.926Z Last Updated: 2025-07-11T16:28:42.727Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Axis Communications AB Products: AXIS Device Manager Problem Types: CWE-295 Description: The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/01/d9/24/cve-2025-30024pdf-en-US-485734.pdf
CVE ID: CVE-2025-30025 State: PUBLISHED Published: 2025-07-11T06:04:40.972Z Last Updated: 2025-07-11T13:22:38.539Z Vendors: Axis Communications AB Products: AXIS Device Manager, AXIS Camera Station Pro, AXIS Camera Station Problem Types: CWE-502 Description: The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/40/0e/03/cve-2025-30025pdf-en-US-485736.pdf
CVE ID: CVE-2025-30026 State: PUBLISHED Published: 2025-07-11T06:05:33.887Z Last Updated: 2025-07-11T16:19:20.584Z Vendors: Axis Communications AB Products: AXIS Camera Station Pro, AXIS Camera Station Problem Types: CWE-288 Description: The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/a3/42/92/cve-2025-30026pdf-en-US-485735.pdf
CVE ID: CVE-2025-30027 State: PUBLISHED Published: 2025-08-12T05:18:26.937Z Last Updated: 2025-08-14T03:56:11.818Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-1287 Description: An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/ab/9a
ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/ab/9a/a5/cve-2025-30027pdf-en-US-492762.pdf
CVE ID: CVE-2025-30030 State: PUBLISHED Published: 2025-04-16T17:37:31.712Z Last Updated: 2025-04-16T18:02:54.229Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ImportDatabase' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requi
to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25924) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-30031 State: PUBLISHED Published: 2025-04-16T17:37:33.194Z Last Updated: 2025-04-16T18:02:18.556Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateUsers' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires
the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25922) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-30032 State: PUBLISHED Published: 2025-04-16T17:37:34.628Z Last Updated: 2025-04-16T18:01:50.573Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateDatabaseSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful atta
d write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25921) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-30033 State: PUBLISHED Published: 2025-08-12T11:16:56.565Z Last Updated: 2025-11-11T20:20:29.488Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Automation License Manager V6.0, Automation License Manager V6.2, CEMAT V10.0, CP PtP Param configuring interface, Create MyConfig (CMC), Energy Support Library (EnSL), FM Configuration Package, Modular PID CTRL Tool, MultiFieldbus Configuration Tool (MFCT), OpenPCS 7 V10.0, OpenPCS 7 V9.1, Siemens Network Planner (SINETPLAN), SIMATIC Automation Tool, SIMATIC Automation Tool SDK Windows, SIMATIC BATCH V10.0, SIMATIC BATCH V9.1, SIMATIC Control Function Library (CFL) V1.x, SIMATIC Co