Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-30152 State: PUBLISHED Published: 2025-03-19T15:57:32.445Z Last Updated: 2025-03-19T18:26:39.691Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Sylius Products: PayPalPlugin Problem Types: CWE-472 Description: The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. Prior to 1.6.2, 1.7.2, and 2.0.2, a discovered vulnerability allows users to modify their shopping cart after completing the PayPal Checkout process and payment authorization. If a user initiates a PayPal transaction from a product page or the cart page and then returns to the order summary page, they can still manipulate the cart contents bef
roduct page or the cart page and then returns to the order summary page, they can still manipulate the cart contents before finalizing the order. As a result, the order amount in Sylius may be higher than the amount actually captured by PayPal, leading to a scenario where merchants deliver products or services without full payment. The issue is fixed in versions: 1.6.2, 1.7.2, 2.0.2 and above. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Sylius/PayPalPlugin/security/advisories/GHSA-hxg4-65p5-9w37 - https://github.com/Sylius/PayPalPlugin/commit/5613df827a6d4fc50862229295976200a68e97aa
CVE ID: CVE-2025-30153 State: PUBLISHED Published: 2025-03-19T16:03:26.947Z Last Updated: 2025-03-19T18:25:11.787Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: getkin Products: kin-openapi Problem Types: CWE-409 Description: kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulne
ipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getkin/kin-openapi/security/advisories/GHSA-wq9g-9vfc-cfq9 - https://github.com/getkin/kin-openapi/commit/67f0b233ffc01332f7d993f79490fbea5f4455f1 - https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275 - https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523 - https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom
08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523 - https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse
CVE ID: CVE-2025-30154 State: PUBLISHED Published: 2025-03-19T15:15:29.113Z Last Updated: 2025-10-21T22:55:23.147Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: reviewdog Products: reviewdog Problem Types: CWE-506 Description: reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-templ
compromised, regardless of version or pinning method, are reviewdog/action-shellcheck, reviewdog/action-composite-template, reviewdog/action-staticcheck, reviewdog/action-ast-grep, and reviewdog/action-typos. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc - https://github.com/reviewdog/reviewdog/issues/2079 - https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887 - https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec - https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup
CVE ID: CVE-2025-30155 State: PUBLISHED Published: 2025-03-31T15:58:30.058Z Last Updated: 2025-03-31T18:18:13.265Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-863 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in the REST API. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742392651 and Tuleap Enterprise Edition 16.5-5 and 16.4-8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-6hr4-h6px-7ppg - htt
: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-6hr4-h6px-7ppg - https://github.com/Enalean/tuleap/commit/0921df3a1c1aa20fc359b373f001a77c43b1b726 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0921df3a1c1aa20fc359b373f001a77c43b1b726 - https://tuleap.net/plugins/tracker/?aid=42237
CVE ID: CVE-2025-30157 State: PUBLISHED Published: 2025-03-21T14:49:18.113Z Last Updated: 2025-03-21T15:15:11.034Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-460 Description: Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10. Addit
r a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9 - https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c
CVE ID: CVE-2025-30158 State: PUBLISHED Published: 2025-04-18T15:50:49.309Z Last Updated: 2025-04-18T16:04:53.740Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: NamelessMC Products: Nameless Problem Types: CWE-400 Description: NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the forum allows users to post iframe elements inside forum topics/comments/feed with no restriction on the iframe's width and height attributes. This allows an authenticated attacker to perform a UI-based denial of service (DoS) by injecting oversized iframes that block the forum UI and disrupt normal user interactions. Thi
denial of service (DoS) by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This issue has been patched in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2prx-rgr7-hq5f - https://github.com/NamelessMC/Nameless/commit/caa42a975338a13fbc1658e8c440108f16135643 - https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0
CVE ID: CVE-2025-30159 State: PUBLISHED Published: 2025-05-13T15:07:02.920Z Last Updated: 2025-05-13T19:46:41.681Z Vendors: getkirby Products: kirby Problem Types: CWE-22, CWE-23 Description: Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the `snippet()` helper or `$kirby->snippet()` method with a dynamic snippet name (such as a snippet name that depends on request or user data). Sites that only use fixed calls to the `snippet()` helper/`$kirby->snippet()` method (i.e. calls with a simple string for the snippet name) are *not* affected. A missing path traversal check allowed attackers to na
ls with a simple string for the snippet name) are *not* affected. A missing path traversal check allowed attackers to navigate and access all files on the server that were accessible to the PHP process, including files outside of the snippets root or even outside of the Kirby installation. PHP code within such files was executed. Such attacks first require an attack vector in the site code that is caused by dynamic snippet names, such as `snippet('tags-' . get('tags'))`. It generally also requires knowledge of the site structure and the server's file system by the attacker, although it can be possible to find vulnerable setups through automated methods such as fuzzing. In a vulnerable setup,
although it can be possible to find vulnerable setups through automated methods such as fuzzing. In a vulnerable setup, this could cause damage to the confidentiality and integrity of the server. The problem has been patched in Kirby 3.9.8.3, Kirby 3.10.1.2, and Kirby 4.7.1. In all of the mentioned releases, Kirby maintainers have added a check for the snippet path that ensures that the resulting path is contained within the configured snippets root. Snippet paths that point outside of the snippets root will not be loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getkirby/kirby/security/advisories/GHSA-fw82-87p8-v6hp - https://github.com/getkirby/k
References: - https://github.com/getkirby/kirby/security/advisories/GHSA-fw82-87p8-v6hp - https://github.com/getkirby/kirby/releases/tag/3.10.1.2 - https://github.com/getkirby/kirby/releases/tag/3.9.8.3 - https://github.com/getkirby/kirby/releases/tag/4.7.1
CVE ID: CVE-2025-30160 State: PUBLISHED Published: 2025-03-20T18:09:48.763Z Last Updated: 2025-03-20T19:19:50.110Z Vendors: redlib-org Products: redlib Problem Types: CWE-400, CWE-502 Description: Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore_preferences form. This leads to excessive memory consumption and potential system instability, which can be exploited to disrupt Redlib instances. This vulnerability is fixed in 0.36.0. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
pt Redlib instances. This vulnerability is fixed in 0.36.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redlib-org/redlib/security/advisories/GHSA-g8vq-v3mg-7mrg - https://github.com/redlib-org/redlib/commit/15147cea8e42f6569a11603d661d71122f6a02dc - https://github.com/redlib-org/redlib/commit/2e95e1fc6e2064ccfae87964b4860bda55eddb9a
CVE ID: CVE-2025-30161 State: PUBLISHED Published: 2025-03-31T16:12:29.064Z Last Updated: 2025-03-31T18:21:55.232Z Vendors: openemr Products: openemr Problem Types: CWE-80 Description: OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form component of OpenEMR allows anyone who is able to edit a bronchitis form to steal credentials from administrators. This vulnerability is fixed in 7.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openemr/openemr/security/advisories/GHSA-59rv-645x-rg6p - https://github.com/openemr/openemr/blob/17ca5539bafcdc25a9042ebc1
nemr/openemr/security/advisories/GHSA-59rv-645x-rg6p - https://github.com/openemr/openemr/blob/17ca5539bafcdc25a9042ebc14480552e07867e4/interface/forms/bronchitis/view.php#L102-L103 - https://github.com/openemr/openemr/blob/17ca5539bafcdc25a9042ebc14480552e07867e4/interface/forms/bronchitis/view.php#L303-L304
CVE ID: CVE-2025-30162 State: PUBLISHED Published: 2025-03-24T18:44:07.927Z Last Updated: 2025-03-24T19:30:18.385Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-863 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will inc
ress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/G
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-24qp-4xx8-3jvj - https://github.com/cilium/proxy/pull/1172 - https://docs.cilium.io/en/stable/network/lb-ipam
CVE ID: CVE-2025-30163 State: PUBLISHED Published: 2025-03-24T18:46:35.407Z Last Updated: 2025-03-24T19:29:46.075Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-863 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in `fromNodes` and `toNodes` sections of network policies. Node based network policy is disabled by default in Cilium. This issue affects: Cilium v1.16 between v1.16.0 and v1.16.7 inclusive and v1.17 between
disabled by default in Cilium. This issue affects: Cilium v1.16 between v1.16.0 and v1.16.7 inclusive and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.16.8 and v1.17.2. Users can work around this issue by ensuring that the labels used in `fromNodes` and `toNodes` fields are used exclusively by nodes and not by other endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-c6pf-2v8j-96mc - https://github.com/cilium/cilium/pull/36657 - https://docs.cilium.io/en/stable/security/policy/language/#node-based
CVE ID: CVE-2025-30164 State: PUBLISHED Published: 2025-03-26T16:13:26.590Z Last Updated: 2025-05-12T15:41:08.237Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Icinga Products: icingaweb2 Problem Types: CWE-601 Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known w
edirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Icinga/icingaweb2/security/advisories/GHSA-8r73-6686-wv8q - https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5 - https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3
CVE ID: CVE-2025-30165 State: PUBLISHED Published: 2025-05-06T16:53:52.836Z Last Updated: 2025-05-06T17:26:58.974Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-502 Description: vLLM is an inference and serving engine for large language models. In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for some multi-node communication purposes. The secondary vLLM hosts open a `SUB` ZeroMQ socket and connect to an `XPUB` socket on the primary vLLM host. When data is received on this `SUB` socket, it is deserialized with `pickle`. This is unsafe, as it can be abused to execute code on a remote machine. S
UB` socket, it is deserialized with `pickle`. This is unsafe, as it can be abused to execute code on a remote machine. Since the vulnerability exists in a client that connects to the primary vLLM host, this vulnerability serves as an escalation point. If the primary vLLM host is compromised, this vulnerability could be used to compromise the rest of the hosts in the vLLM deployment. Attackers could also use other means to exploit the vulnerability without requiring access to the primary vLLM host. One example would be the use of ARP cache poisoning to redirect traffic to a malicious endpoint used to deliver a payload with arbitrary code to execute on the target machine. Note that this issue
malicious endpoint used to deliver a payload with arbitrary code to execute on the target machine. Note that this issue only affects the V0 engine, which has been off by default since v0.8.0. Further, the issue only applies to a deployment using tensor parallelism across multiple hosts, which we do not expect to be a common deployment pattern. Since V0 is has been off by default since v0.8.0 and the fix is fairly invasive, the maintainers of vLLM have decided not to fix this issue. Instead, the maintainers recommend that users ensure their environment is on a secure network in case this pattern is in use. The V1 engine is not affected by this issue. Additional Analyst Notes: - CISA ADP Vulnr
in case this pattern is in use. The V1 engine is not affected by this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-9pcc-gvx5-r5wm - https://github.com/vllm-project/vllm/blob/c21b99b91241409c2fdf9f3f8c542e8748b317be/vllm/distributed/device_communicators/shm_broadcast.py#L295-L301 - https://github.com/vllm-project/vllm/blob/c21b99b91241409c2fdf9f3f8c542e8748b317be/vllm/distributed/device_communicators/shm_broadcast.py#L468-L470
CVE ID: CVE-2025-30166 State: PUBLISHED Published: 2025-04-08T11:07:06.672Z Last Updated: 2025-04-08T13:02:13.897Z Vendors: pimcore Products: admin-ui-classic-bundle Problem Types: CWE-79 Description: Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during t
using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. This vulnerability is fixed in 1.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-x82r-6j37-vrgg - https://github.com/pimcore/admin-ui-classic-bundle/commit/76b690d4f8fcd9c9d41766bc5238c2513242e60e
CVE ID: CVE-2025-30167 State: PUBLISHED Published: 2025-06-03T16:42:16.357Z Last Updated: 2025-06-03T17:34:46.033Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: jupyter Products: jupyter_core Problem Types: CWE-427 Description: Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users
ecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user). Additional Analyst Notes: - CISA ADP Vulnrichmen
permissions (e.g. controlled by administrators _or_ the current user). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq
CVE ID: CVE-2025-30168 State: PUBLISHED Published: 2025-03-21T14:54:22.369Z Last Updated: 2025-03-21T15:12:37.719Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-287 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, the creden
. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, the credentials stored by one app can be used to authenticate the same user in the other app. Note that this only affects Parse Server apps that specifically use an affected 3rd party authentication provider for user authentication, for example by setting the Parse Server option auth to configure a Parse Server authentication adapter. The fix of this vulnerability requires to upgrade Parse Server to a version that includes the bug fix, as well as upgrade the client app to send a secure payload, which is different from the previous insecure payload. This vulnerability is fixed in 7.5.
app to send a secure payload, which is different from the previous insecure payload. This vulnerability is fixed in 7.5.2 and 8.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv - https://github.com/parse-community/parse-server/pull/9667 - https://github.com/parse-community/parse-server/pull/9668 - https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e - https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f - https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication
CVE ID: CVE-2025-30169 State: PUBLISHED Published: 2025-05-22T17:47:11.259Z Last Updated: 2025-05-22T18:03:23.908Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: ABB Products: ASPECT-Enterprise, NEXUS Series, MATRIX Series Problem Types: CWE-434 Description: File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A0021&LanguageCode=en&D
DP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A0021&LanguageCode=en&DocumentPartId=pdf&Action=Launch