Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22169 State: PUBLISHED Published: 2025-10-22T16:30:04.452Z Last Updated: 2025-10-22T17:24:43.243Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8638
CVE ID: CVE-2025-22170 State: PUBLISHED Published: 2025-10-22T16:30:04.355Z Last Updated: 2025-10-22T19:16:07.138Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8639
CVE ID: CVE-2025-22171 State: PUBLISHED Published: 2025-10-22T16:30:01.353Z Last Updated: 2025-10-23T18:11:55.056Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8640
CVE ID: CVE-2025-22172 State: PUBLISHED Published: 2025-10-22T16:30:03.984Z Last Updated: 2025-10-23T17:32:42.519Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read external reports without the required permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8641
CVE ID: CVE-2025-22173 State: PUBLISHED Published: 2025-10-22T16:30:04.376Z Last Updated: 2025-10-22T19:12:18.431Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without the required permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8642
CVE ID: CVE-2025-22174 State: PUBLISHED Published: 2025-10-22T16:30:04.050Z Last Updated: 2025-10-22T19:39:25.240Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the required permission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8643
CVE ID: CVE-2025-22175 State: PUBLISHED Published: 2025-10-22T16:30:00.592Z Last Updated: 2025-10-27T16:09:06.998Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8644
CVE ID: CVE-2025-22176 State: PUBLISHED Published: 2025-10-22T16:30:02.956Z Last Updated: 2025-10-23T17:40:48.512Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view audit log items. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8645
CVE ID: CVE-2025-22177 State: PUBLISHED Published: 2025-10-22T16:30:00.632Z Last Updated: 2025-10-22T18:48:41.714Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8646
CVE ID: CVE-2025-22178 State: PUBLISHED Published: 2025-10-22T16:30:04.731Z Last Updated: 2025-10-22T17:21:57.848Z Vendors: Atlassian Products: Jira Align Problem Types: Improper Authorization Description: Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the "Why" page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JIRAALIGN-8647
CVE ID: CVE-2025-22204 State: PUBLISHED Published: 2025-02-04T07:20:46.052Z Last Updated: 2025-02-06T10:48:29.681Z Vendors: regularlabs.com Products: Sourcerer for Joomla Problem Types: CWE-94 Description: Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://regularlabs.com/sourcerer
CVE ID: CVE-2025-22205 State: PUBLISHED Published: 2025-02-04T07:21:28.335Z Last Updated: 2025-02-06T10:49:12.694Z Vendors: www.admiror-design-studio.com Products: Admiror Gallery component for Joomla Problem Types: CWE-35 Description: Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.admiror-design-studio.com/admiror-joomla-extensions/admiror-gallery
CVE ID: CVE-2025-22206 State: PUBLISHED Published: 2025-02-04T14:20:48.002Z Last Updated: 2025-02-06T10:48:55.695Z Vendors: joomsky.com Products: JS Jobs component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://joomsky.com/js-jobs-joomla/ - https://decrypt.locker/obtaining-my-first-cve/
CVE ID: CVE-2025-22207 State: PUBLISHED Published: 2025-02-18T16:03:29.639Z Last Updated: 2025-02-18T16:25:24.340Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-89 Description: Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/958-20250201-core-sql-injection-vulnerability-in-scheduled-tasks-component.html
CVE ID: CVE-2025-22208 State: PUBLISHED Published: 2025-02-15T08:10:59.715Z Last Updated: 2025-02-21T12:16:40.762Z Vendors: joomsky.com Products: JS Jobs component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://joomsky.com/js-jobs-joomla/ - https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22208
CVE ID: CVE-2025-22209 State: PUBLISHED Published: 2025-02-15T08:10:58.539Z Last Updated: 2025-02-21T12:16:39.292Z Vendors: joomsky.com Products: JS Jobs component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://joomsky.com/js-jobs-joomla/ - https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22209
CVE ID: CVE-2025-22210 State: PUBLISHED Published: 2025-02-25T05:16:48.342Z Last Updated: 2025-04-04T04:35:49.991Z Vendors: hikashop.com Products: Hikashop component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikashop.com/ - https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22210
CVE ID: CVE-2025-22211 State: PUBLISHED Published: 2025-02-25T21:29:22.929Z Last Updated: 2025-03-04T04:33:50.194Z Vendors: webdesigner-profi.de Products: JoomShopping component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the country management area in backend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.webdesigner-profi.de/ - https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22211
CVE ID: CVE-2025-22212 State: PUBLISHED Published: 2025-03-05T15:15:51.874Z Last Updated: 2025-03-14T22:58:30.568Z Vendors: tassos.gr Products: Convert Forms component for Joomla Problem Types: CWE-89 Description: A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tassos.gr/ - https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22212
CVE ID: CVE-2025-22213 State: PUBLISHED Published: 2025-03-11T16:07:28.921Z Last Updated: 2025-03-11T19:24:44.754Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-434 Description: Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/961-20250301-core-malicious-file-uploads-via-media-managere-malicious-file-uploads-via-media-manager.html
CVE ID: CVE-2025-22214 State: PUBLISHED Published: 2025-01-02T00:00:00 Last Updated: 2025-01-02T18:19:18.434Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: CWE-89 Description: Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Zerone0x00/CVE/blob/main/%E8%93%9D%E5%87%8CEISsql%E6%B3%A8%E5%85%A5/1.md
CVE ID: CVE-2025-22215 State: PUBLISHED Published: 2025-01-08T06:43:32.023Z Last Updated: 2025-01-08T14:23:20.473Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: VMware Products: VMware Aria Automation, VMware Cloud Foundation (VMware Aria Automation) Description: VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/Securit
Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25312
CVE ID: CVE-2025-22216 State: PUBLISHED Published: 2025-01-31T05:47:24.901Z Last Updated: 2025-01-31T17:42:22.937Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Cloud Foundry Products: Cloud Foundry UAA Description: A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP can re-use their jsessionid to access other zones. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2025-22216-uaa-missing-zone-validation/
CVE ID: CVE-2025-22217 State: PUBLISHED Published: 2025-01-28T18:33:36.486Z Last Updated: 2025-01-29T15:21:32.047Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: N/A Products: VMware AVI Load Balancer Problem Types: CWE-89 Description: Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products. A malicious user with network access may be able to use specially crafted SQL queries to gain database access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25346
CVE ID: CVE-2025-22218 State: PUBLISHED Published: 2025-01-30T14:23:01.810Z Last Updated: 2025-03-13T15:14:07.312Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: VMware Products: VMware Aria Operations for Logs Description: VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria Operations for Logs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25329
CVE ID: CVE-2025-22219 State: PUBLISHED Published: 2025-01-30T15:26:16.027Z Last Updated: 2025-03-13T18:03:28.501Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: VMware Products: VMware Aria Operations for Logs Description: VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to inject a malicious script that (can perform stored cross-site scripting) may lead to arbitrary operations as admin user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisori
ent: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25329
CVE ID: CVE-2025-22220 State: PUBLISHED Published: 2025-01-30T15:28:13.266Z Last Updated: 2025-02-06T14:06:04.836Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: VMware Products: VMware Aria Operations for Logs Description: VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain operations in the context of an admin user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25329
CVE ID: CVE-2025-22221 State: PUBLISHED Published: 2025-01-30T15:30:12.218Z Last Updated: 2025-03-13T13:45:16.580Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: VMware Products: VMware Aria Operations for Logs Description: VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to inject a malicious script that could be executed in a victim's browser when performing a delete action in the Agent Configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/ex
yst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25329
CVE ID: CVE-2025-22222 State: PUBLISHED Published: 2025-01-30T15:32:00.829Z Last Updated: 2025-03-13T14:47:01.654Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: VMware Products: VMware Aria Operations Description: VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid service credential ID is known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25329
CVE ID: CVE-2025-22223 State: PUBLISHED Published: 2025-03-24T17:42:49.634Z Last Updated: 2025-03-24T18:06:24.575Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Spring Products: Spring Security Problem Types: CWE-290 Description: Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. You are not affected if you are not using @EnableMethodSecurity, or you do not have method security annotations on parameterized types or methods, or all method security annotations are attached to target methods Additional Analyst Notes: - CISA ADP Vulnrichment: References:
thod security annotations are attached to target methods Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2025-22223
CVE ID: CVE-2025-22224 State: PUBLISHED Published: 2025-03-04T11:56:12.317Z Last Updated: 2025-10-21T22:55:28.319Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: VMware Products: ESXi, Workstation, VMware Cloud Foundation, Telco Cloud Platform, Telco Cloud Infrastructure Problem Types: Heap-overflow vulnerability Description: VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Additional Analyst Notes: - CISA ADP
his issue to execute code as the virtual machine's VMX process running on the host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
CVE ID: CVE-2025-22225 State: PUBLISHED Published: 2025-03-04T11:56:27.537Z Last Updated: 2025-10-21T22:55:27.903Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: VMware ESXi, VMware Cloud Foundation, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure Problem Types: Arbitrary write vulnerability Description: VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/con
- CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
CVE ID: CVE-2025-22226 State: PUBLISHED Published: 2025-03-04T11:56:57.541Z Last Updated: 2025-10-21T22:55:26.649Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: ESXi, VMware Workstation, VMware Fusion, VMware Cloud Foundation, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure Problem Types: Information disclosure vulnerability Description: VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process. Additional Analyst Notes: - CISA
virtual machine may be able to exploit this issue to leak memory from the vmx process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
CVE ID: CVE-2025-22227 State: PUBLISHED Published: 2025-07-16T09:31:15.293Z Last Updated: 2025-07-16T14:39:58.789Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: VMware Products: Reactor Netty Description: In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2025-22227
CVE ID: CVE-2025-22228 State: PUBLISHED Published: 2025-03-20T05:49:19.275Z Last Updated: 2025-04-25T23:03:00.421Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Spring Products: Spring Security Description: BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2025-22228
CVE ID: CVE-2025-22230 State: PUBLISHED Published: 2025-03-25T14:06:35.413Z Last Updated: 2025-03-25T14:19:35.488Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: VMware Tools Problem Types: CWE-288 Description: VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25518
CVE ID: CVE-2025-22231 State: PUBLISHED Published: 2025-04-01T12:59:49.815Z Last Updated: 2025-04-01T16:06:30.689Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: VMware Products: VMware Aria operations Description: VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can escalate their privileges to root on the appliance running VMware Aria Operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25541