Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-57625 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-17T15:14:17.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability. A low-privileged user can abuse these issues to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\SYSTEM by replacing DataSpotliteAgent.exe or any other binaries called by the Cyrisma_Agent service when it starts Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msry1.gitbook.io/thegoldenrecord/blog/vulnerability-and-bug-disclosures/cyrsma-sensor-version-less-than-2.5 - https
ps://msry1.gitbook.io/thegoldenrecord/blog/vulnerability-and-bug-disclosures/cyrsma-sensor-version-less-than-2.5 - https://youtu.be/2DScqXPtrWw
CVE ID: CVE-2025-57631 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-17T13:51:54.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in TDuckCloud v.5.1 allows a remote attacker to execute arbitrary code via the Add a file upload module Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TDuckCloud/tduck-platform - http://tduck-platform.com - https://github.com/TDuckCloud/tduck-platform/issues/31 - https://gist.github.com/Theresasu1/b1b57b3763a286d9491541180c99368b
CVE ID: CVE-2025-57632 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T20:14:32.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: libsmb2 6.2+ is vulnerable to Buffer Overflow. When processing SMB2 chained PDUs (NextCommand), libsmb2 repeatedly calls smb2_add_iovector() to append to a fixed-size iovec array without checking the upper bound of v->niov (SMB2_MAX_VECTORS=256). An attacker can craft responses with many chained PDUs to overflow v->niov and perform heap out-of-bounds writes, causing memory corruption, crashes, and potentially arbitrary code execution. The SMB2_OPLOCK_BREAK path bypasses message ID validation. Additional Analyst Notes: -
tially arbitrary code execution. The SMB2_OPLOCK_BREAK path bypasses message ID validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sahlberg/libsmb2 - https://github.com/sahlberg/libsmb2/blob/master/lib/compat.c#L569 - https://gist.github.com/ZjW1nd/0b95b63307ceee7890e88e4abc6f041e
CVE ID: CVE-2025-57633 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T14:06:40.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS commands. The /ftp.html endpoint's "Upload File" action constructs a shell command from the ftp_file parameter and executes it using os.system() without sanitization or escaping. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ajaypp123/FTP-Flask-python/blob/5173b6828244ff9729fa29cc144d74ccbea30a73/ftp_app.py - https://gist.github.com/Spendroslav/1c0c6a6
/FTP-Flask-python/blob/5173b6828244ff9729fa29cc144d74ccbea30a73/ftp_app.py - https://gist.github.com/Spendroslav/1c0c6a6556992291b19c3178e3cb5885
CVE ID: CVE-2025-57636 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-24T18:41:19.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command injection vulnerability in D-Link C1 2020-02-21. The sub_47F028 function in jhttpd contains a command injection vulnerability via the HTTP parameter "time". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/glkfc/IoT-Vulnerability/blob/main/D-Link/Dlink_1.md
CVE ID: CVE-2025-57637 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-24T18:39:03.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in D-Link DI-7100G 2020-02-21 in the sub_451754 function of the jhttpd service in the viav4 parameter allowing attackers to cause a denial of service or execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/glkfc/IoT-Vulnerability/blob/main/D-Link/Dlink_2.md
CVE ID: CVE-2025-57638 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-24T18:38:16.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in Tenda AC9 1.0 via the user supplied sys.vendor configuration value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glkfc/IoT-Vulnerability/blob/main/Tenda/tenda1.md
CVE ID: CVE-2025-57639 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-24T18:36:02.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command injection vulnerability in Tenda AC9 1.0 was discovered to contain a command injection vulnerability via the usb.samba.guest.user parameter in the formSetSambaConf function of the httpd file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glkfc/IoT-Vulnerability/blob/main/Tenda/tenda2.md
CVE ID: CVE-2025-57642 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-22T15:51:04.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to remote code execution and unauthorized access to the system. This can result in the compromise of sensitive data and system functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sohamjuhin/Tourism-Management-System/issues/2 - https://github.com/debug-security/CVE/tree/main/CVE-2025-57642
CVE ID: CVE-2025-57644 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T15:54:58.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In addition, improper input validation allows for arbitrary file write and server-side request forgery (SSRF), enabling interaction with internal or external systems. Successful exploitation can lead to full server compromise, unauthorized access to sensitive data, and further network exploitation. A
loitation can lead to full server compromise, unauthorized access to sensitive data, and further network exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.accela.com - https://medium.com/@anvarkh/cve-2025-57644-remote-code-execution-ssrf-in-accela-eedc6bc4adfb
CVE ID: CVE-2025-57665 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-22T15:38:50.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol validation, URL sanitization, or security headers. This allows attackers to inject malicious URLs using dangerous protocols (javascript:, data:, file:) or redirect users to external malicious sites. While native HTML anchor ele
gerous protocols (javascript:, data:, file:) or redirect users to external malicious sites. While native HTML anchor elements present similar risks, UI component libraries bear additional responsibility for implementing security safeguards and providing clear risk documentation. The vulnerability enables XSS attacks, phishing campaigns, and open redirect exploits affecting applications that use Element Plus Link components with user-controlled or untrusted URL inputs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-plus/element-plus - https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue - https://www.npmjs.com
us - https://github.com/element-plus/element-plus/blob/dev/packages/components/link/src/link.vue - https://www.npmjs.com/package/element-plus - https://element-plus.org/en-US/component/link.html - https://github.com/element-plus/element-plus/pull/21711
CVE ID: CVE-2025-57682 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-22T15:53:51.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudFront distribution via the "POST /api/file/s3/get-presigned-get-url-proxy" API Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://papermark.com/ - https://github.com/mfts/papermark - https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2025-57682
CVE ID: CVE-2025-57685 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-11-17T18:33:16.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, and BL-LTE300_DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/set_serial_cfg interface to gain the highest level of device privileges without authorization, enabling them to remotely execute malicious commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.b-link.net.cn
y execute malicious commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.b-link.net.cn/ - http://bl-ac2100.com - https://github.com/mono7s/LB-Link/blob/main/bs_SetSerial.md
CVE ID: CVE-2025-57692 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T20:43:15.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PiranhaCMS/piranha.core/releases/tag/v12.0 - https://github.com/Saconyfx/security-advisories/blob/main/CVE-2025-57692/advisory.md
CVE ID: CVE-2025-57697 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T17:14:18.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Since the _encode_image_bs64 function defined in entities.py opens the image specified by the user in the request body and returns the image content as a base64-encoded string without checking the legitimacy of the image path, attackers can construct a series of malicious URLs to read any specified file, resulting in sensitive data leakage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DY
ulting in sensitive data leakage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DYX217/vulnerability-explore/blob/main/1/README.md
CVE ID: CVE-2025-57698 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T17:08:41.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function `file.save`, so that the file in the request body can be saved to any location in the file system through directory traversal. Additional
hat the file in the request body can be saved to any location in the file system through directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DYX217/vulnerability-explore/blob/main/2/README.md
CVE ID: CVE-2025-57699 State: PUBLISHED Published: 2025-08-22T06:37:41.158Z Last Updated: 2025-08-22T10:48:56.664Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Western Digital Corporation Products: Western Digital Kitfox for Windows Problem Types: CWE-428 Description: Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with the SYSTEM privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-25004-wes
lyst Notes: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-25004-western-digital-kitfox-software-version-1-1-1-1 - https://jvn.jp/en/jp/JVN75211379/
CVE ID: CVE-2025-57700 State: PUBLISHED Published: 2025-08-18T06:28:55.514Z Last Updated: 2025-08-19T00:16:18.111Z Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: DIAEnergie - Stored Cross-site Scripting Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00012_DIAEnergie%20Cross-Site%20Scripting%20Vulnerabilities.pdf
CVE ID: CVE-2025-57701 State: PUBLISHED Published: 2025-08-18T06:41:55.539Z Last Updated: 2025-08-19T00:17:16.498Z Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: DIAEnergie - Reflected Cross-site Scripting Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00012_DIAEnergie%20Cross-Site%20Scripting%20Vulnerabilities.pdf
CVE ID: CVE-2025-57702 State: PUBLISHED Published: 2025-08-18T06:42:24.921Z Last Updated: 2025-08-19T00:17:38.206Z Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: DIAEnergie - Reflected Cross-site Scripting Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00012_DIAEnergie%20Cross-Site%20Scripting%20Vulnerabilities.pdf
CVE ID: CVE-2025-57703 State: PUBLISHED Published: 2025-08-18T06:42:48.812Z Last Updated: 2025-08-19T00:17:52.143Z Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: DIAEnergie - Reflected Cross-site Scripting Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00012_DIAEnergie%20Cross-Site%20Scripting%20Vulnerabilities.pdf
CVE ID: CVE-2025-57704 State: PUBLISHED Published: 2025-08-26T06:16:12.737Z Last Updated: 2025-08-27T00:48:47.734Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Delta Electronics Products: EIP Builder Problem Types: CWE-611 Description: Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00013_EIP%20Builder%20XML%20External%20Entity%20Processing%20Information%20Disclosure%20Vulnerability.pdf
CVE ID: CVE-2025-57706 State: PUBLISHED Published: 2025-11-07T15:11:47.864Z Last Updated: 2025-11-07T15:57:28.627Z Vendors: QNAP Systems Inc. Products: File Station 5 Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-38
CVE ID: CVE-2025-57712 State: PUBLISHED Published: 2025-11-07T15:11:14.888Z Last Updated: 2025-11-07T16:11:21.520Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.3 ( 2025/08/28 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-41
CVE ID: CVE-2025-57714 State: PUBLISHED Published: 2025-10-03T18:15:13.048Z Last Updated: 2025-10-07T03:55:57.195Z Vendors: QNAP Systems Inc. Products: NetBak Replicator Problem Types: CWE-428 Description: An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: NetBak Replicator 4.5.15.0807 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-39
CVE ID: CVE-2025-57716 State: PUBLISHED Published: 2025-10-14T15:23:10.215Z Last Updated: 2025-10-17T03:55:18.739Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-427 Description: An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local low privileged user to perform a DLL hijacking attack via placing a malicious DLL to the FortiClient Online Installer installation folder. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-685
CVE ID: CVE-2025-57717 State: REJECTED Published: N/A Last Updated: 2025-08-19T02:55:09.001Z Description: No description available.
CVE ID: CVE-2025-57718 State: REJECTED Published: N/A Last Updated: 2025-08-19T02:55:08.540Z Description: No description available.
CVE ID: CVE-2025-57719 State: REJECTED Published: N/A Last Updated: 2025-08-19T02:55:07.902Z Description: No description available.
CVE ID: CVE-2025-57720 State: REJECTED Published: N/A Last Updated: 2025-08-19T02:55:07.410Z Description: No description available.
CVE ID: CVE-2025-57721 State: REJECTED Published: N/A Last Updated: 2025-08-19T02:55:06.916Z Description: No description available.
CVE ID: CVE-2025-57722 State: REJECTED Published: N/A Last Updated: 2025-08-19T02:55:06.450Z Description: No description available.
CVE ID: CVE-2025-57723 State: REJECTED Published: N/A Last Updated: 2025-08-19T02:55:06.006Z Description: No description available.
CVE ID: CVE-2025-57724 State: REJECTED Published: N/A Last Updated: 2025-08-19T02:55:05.509Z Description: No description available.
CVE ID: CVE-2025-57725 State: REJECTED Published: N/A Last Updated: 2025-08-19T02:55:04.968Z Description: No description available.
CVE ID: CVE-2025-57727 State: PUBLISHED Published: 2025-08-20T09:13:57.151Z Last Updated: 2025-08-20T15:21:13.202Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: JetBrains Products: IntelliJ IDEA Problem Types: CWE-319 Description: In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-57728 State: PUBLISHED Published: 2025-08-20T09:13:57.934Z Last Updated: 2025-08-20T15:20:52.623Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: IntelliJ IDEA Problem Types: CWE-863 Description: In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-57729 State: PUBLISHED Published: 2025-08-20T09:13:58.579Z Last Updated: 2025-08-21T03:55:11.617Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: JetBrains Products: IntelliJ IDEA Problem Types: CWE-829 Description: In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-57730 State: PUBLISHED Published: 2025-08-20T09:13:59.164Z Last Updated: 2025-08-20T15:19:37.239Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: IntelliJ IDEA Problem Types: CWE-80 Description: In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-57731 State: PUBLISHED Published: 2025-08-20T09:13:59.700Z Last Updated: 2025-08-20T15:25:43.894Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-79 Description: In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-57732 State: PUBLISHED Published: 2025-08-20T09:14:00.271Z Last Updated: 2025-08-21T03:55:12.792Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-282 Description: In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-57733 State: PUBLISHED Published: 2025-08-20T09:14:00.896Z Last Updated: 2025-08-20T13:21:10.847Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-77 Description: In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-57734 State: PUBLISHED Published: 2025-08-20T09:14:01.457Z Last Updated: 2025-08-20T13:20:01.275Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-538 Description: In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-57738 State: PUBLISHED Published: 2025-10-20T14:43:39.985Z Last Updated: 2025-11-04T21:13:18.181Z Vendors: Apache Software Foundation Products: Apache Syncope Problem Types: CWE-653 Description: Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely