Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-27444 State: PUBLISHED Published: 2025-06-04T07:24:18.757Z Last Updated: 2025-06-05T13:20:53.740Z Vendors: rsjoomla.com Products: RSform!Pro component for Joomla Problem Types: CWE-79 Description: A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filter[dateFrom] GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin or editor privileges to inject arbitrary JavaScript code by crafting a malicious URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rsjoomla.com/
CVE ID: CVE-2025-27445 State: PUBLISHED Published: 2025-06-05T13:20:40.631Z Last Updated: 2025-06-19T04:39:50.364Z Vendors: rsjoomla.com Products: RSFirewall component for Joomla Problem Types: CWE-35 Description: A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused by insufficient sanitization of user-supplied input in file path parameters, allowing attackers to exploit directory traversal sequences (e.g., ../) to access sensitive files Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rsjoomla.com/
CVE ID: CVE-2025-27446 State: PUBLISHED Published: 2025-07-06T06:05:15.144Z Last Updated: 2025-11-04T22:06:33.259Z Vendors: Apache Software Foundation Products: Apache APISIX Java Plugin Runner Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0. Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/qwxnxolt0j5nvjfpr0mlz6h7nrtvyzng
CVE ID: CVE-2025-27447 State: PUBLISHED Published: 2025-07-03T11:23:20.043Z Last Updated: 2025-07-03T13:16:41.793Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-79 Description: The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victimâ€™s browser when an authenticated administrator clicks the link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resourc
nrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27448 State: PUBLISHED Published: 2025-07-03T11:24:00.307Z Last Updated: 2025-07-03T13:16:36.782Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-79 Description: The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard name which will be executed when the website is loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://ww
ess.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27449 State: PUBLISHED Published: 2025-07-03T11:25:45.104Z Last Updated: 2025-07-03T13:16:31.757Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-307 Description: The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1
t - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27450 State: PUBLISHED Published: 2025-07-03T11:26:33.462Z Last Updated: 2025-07-03T13:16:27.030Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-614 Description: The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencrypted HTTP connection to the server and intercept the request containing the PHPSESSID cookie. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-pra
- https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27451 State: PUBLISHED Published: 2025-07-03T11:27:35.372Z Last Updated: 2025-07-03T13:16:21.696Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-204 Description: For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ic
ment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27452 State: PUBLISHED Published: 2025-07-03T11:29:04.003Z Last Updated: 2025-07-03T13:16:16.586Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-548 Description: The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activated that are not required for the operation of the FNADE4 web application. The functionality of the some modules pose a risk to the webserver which enable dircetory listing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https:
ble dircetory listing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27453 State: PUBLISHED Published: 2025-07-03T11:29:48.216Z Last Updated: 2025-07-03T13:16:11.391Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-1004 Description: The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/whi
ources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27454 State: PUBLISHED Published: 2025-07-03T11:30:19.944Z Last Updated: 2025-07-03T13:16:05.545Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-352 Description: The application is vulnerable to cross-site request forgery. An attacker can trick a valid, logged in user into submitting a web request that they did not intend. The request uses the victim's browser's saved authorization to execute the request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ic
CVE ID: CVE-2025-27455 State: PUBLISHED Published: 2025-07-03T11:30:49.265Z Last Updated: 2025-07-03T13:15:59.115Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-1021 Description: The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of their computer while clicking on seemingly innocuous objects. Additional Analyst Notes: - CISA ADP Vulnrichment:
rol of their computer while clicking on seemingly innocuous objects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27456 State: PUBLISHED Published: 2025-07-03T11:32:21.466Z Last Updated: 2025-07-03T13:15:53.469Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-307 Description: The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/
/sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27457 State: PUBLISHED Published: 2025-07-03T11:32:59.576Z Last Updated: 2025-07-03T13:15:48.078Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-319 Description: All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-kno
s-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27458 State: PUBLISHED Published: 2025-07-03T11:33:30.605Z Last Updated: 2025-07-03T13:15:43.013Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-327 Description: The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does the same encryption locally and if the responses match it is prooven that the client knows the correct password. Since all VNC communication is unencrypted, an atta
nses match it is prooven that the client knows the correct password. Since all VNC communication is unencrypted, an attacker can obtain the challenge and response and try to derive the password from this information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27459 State: PUBLISHED Published: 2025-07-03T11:33:53.899Z Last Updated: 2025-07-03T13:15:37.506Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-257 Description: The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.c
gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27460 State: PUBLISHED Published: 2025-07-03T11:34:21.220Z Last Updated: 2025-07-03T13:15:32.379Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-312 Description: The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login. The attacker can read from and write to all files on the hard drives. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
can read from and write to all files on the hard drives. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27461 State: PUBLISHED Published: 2025-07-03T11:34:52.786Z Last Updated: 2025-07-03T13:15:27.472Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Endress+Hauser Products: Endress+Hauser MEAC300-FNADE4 Problem Types: CWE-862 Description: During startup, the device automatically logs in the EPC2 Windows user without requesting a password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.endress.com - https://sick.com/psirt - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https:/
ttps://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - https://sick.com/psirt - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
CVE ID: CVE-2025-27465 State: PUBLISHED Published: 2025-07-16T09:08:39.931Z Last Updated: 2025-11-04T21:09:50.127Z Vendors: Xen Products: Xen Description: Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executable stub. Some instructions may raise an exception, which is supposed to be handled gracefully. Certain replayed instructions have additional logic to set up and recover the changes to the arithmetic flags. For replayed instructions where the flags recovery logic is used, the metadata for exception handling was incorrect, preventing Xen from handling the the exception gracefully, treating it as fatal inst
r exception handling was incorrect, preventing Xen from handling the the exception gracefully, treating it as fatal instead. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-470.html
CVE ID: CVE-2025-27466 State: PUBLISHED Published: 2025-09-11T14:05:29.525Z Last Updated: 2025-11-04T21:09:51.419Z Vendors: Xen Products: Xen Description: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can
sage has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-472.html
CVE ID: CVE-2025-27467 State: PUBLISHED Published: 2025-04-08T17:23:56.402Z Last Updated: 2025-06-04T17:53:11.093Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Windows Digital Media allows an authorized
2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27467
CVE ID: CVE-2025-27468 State: PUBLISHED Published: 2025-05-13T16:58:47.262Z Last Updated: 2025-09-10T00:09:24.154Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Window
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-269 Description: Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27468
CVE ID: CVE-2025-27469 State: PUBLISHED Published: 2025-04-08T17:23:56.958Z Last Updated: 2025-06-04T17:53:11.644Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
n: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27469
CVE ID: CVE-2025-27470 State: PUBLISHED Published: 2025-04-08T17:23:15.343Z Last Updated: 2025-06-04T17:52:29.232Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-400 Description: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny servi
resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27470