Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-0130 State: PUBLISHED Published: 2025-05-14T17:37:40.937Z Last Updated: 2025-05-15T13:49:45.683Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS, Prisma Access Problem Types: CWE-754 Description: A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this condition will cause the firewall to enter maintenance mode. This issue does not affect Cloud NGFW or Prisma Access. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
This issue does not affect Cloud NGFW or Prisma Access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0130
CVE ID: CVE-2025-0131 State: PUBLISHED Published: 2025-05-14T18:06:45.870Z Last Updated: 2025-05-21T21:11:37.004Z Vendors: OPSWAT Products: MetaDefender Endpoint Security SDK Problem Types: CWE-266 Description: An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user also successfully exploits a race condition, which makes this vulnerability difficult to exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: References
tion, which makes this vulnerability difficult to exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0131 - https://www.opswat.com/docs/mdsdk/release-notes/cve-2025-0131
CVE ID: CVE-2025-0132 State: PUBLISHED Published: 2025-05-14T18:07:15.351Z Last Updated: 2025-05-14T20:51:36.216Z Vendors: Palo Alto Networks Products: Cortex XDR Broker VM Problem Types: CWE-306 Description: A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM. The attacker must have network access to the Broker VM to exploit this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0132
CVE ID: CVE-2025-0133 State: PUBLISHED Published: 2025-05-14T18:07:36.381Z Last Updated: 2025-05-14T20:51:15.284Z Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN. There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers canno
nabled Clientless VPN. There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use this vulnerability to tamper with or modify contents or configurations of the GlobalProtect portal or gateways. The integrity impact of this vulnerability is limited to enabling an attacker to create phishing and credential-stealing links that appear to be hosted on the GlobalProtect portal. For GlobalProtect users with Clientless VPN enabled, there is a limited impact on confidentiality due to inherent risks of Clientless VPN that facilitate credential theft. You can read more about this risk in the informational bulletin PAN-SA-2025-0005 https://security.paloaltonet
ial theft. You can read more about this risk in the informational bulletin PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005 . There is no impact to confidentiality for GlobalProtect users if you did not enable (or you disable) Clientless VPN. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0133
CVE ID: CVE-2025-0134 State: PUBLISHED Published: 2025-05-14T18:07:54.706Z Last Updated: 2025-05-15T04:02:09.561Z Vendors: Palo Alto Networks Products: Cortex XDR Broker VM Problem Types: CWE-94 Description: A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0134
CVE ID: CVE-2025-0135 State: PUBLISHED Published: 2025-05-14T18:08:32.924Z Last Updated: 2025-05-14T20:50:20.200Z Vendors: Palo Alto Networks Products: GlobalProtect App, GlobalProtect UWP App Problem Types: CWE-266 Description: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0135
CVE ID: CVE-2025-0136 State: PUBLISHED Published: 2025-05-14T18:12:14.153Z Last Updated: 2025-05-14T19:43:47.169Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS, Prisma Access Problem Types: CWE-319 Description: Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PAN-OS firewall through IPSec. This issue does not affect Cloud NGFWs, Prisma® Access instances, or PAN-OS VM-Series firewalls. NOTE: The AES-128-CCM encryption algorithm is not recommended for use. Additional Analyst Notes: - CISA ADP Vulnr
walls. NOTE: The AES-128-CCM encryption algorithm is not recommended for use. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0136
CVE ID: CVE-2025-0137 State: PUBLISHED Published: 2025-05-14T18:09:32.036Z Last Updated: 2025-05-14T20:49:31.100Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS Problem Types: CWE-83 Description: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our
this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0137
CVE ID: CVE-2025-0138 State: PUBLISHED Published: 2025-05-14T18:10:16.979Z Last Updated: 2025-06-23T15:09:31.123Z Vendors: Palo Alto Networks Products: Prisma Cloud Compute Edition, Compute in Prisma Cloud Enterprise Edition Problem Types: CWE-613 Description: Web sessions in the web interface of Palo Alto Networks Prisma® Cloud Compute Edition do not expire when users are deleted, which makes Prisma Cloud Compute Edition susceptible to unauthorized access. Compute in Prisma Cloud Enterprise Edition is not affected by this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0138
CVE ID: CVE-2025-0139 State: PUBLISHED Published: 2025-07-09T22:57:56.688Z Last Updated: 2025-08-13T19:44:49.218Z Vendors: Palo Alto Networks Products: Autonomous Digital Experience Manager Problem Types: CWE-266 Description: An incorrect privilege assignment vulnerability in Palo Alto Networks Autonomous Digital Experience Manager allows a locally authenticated low privileged user on macOS endpoints to escalate their privileges to root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0139
CVE ID: CVE-2025-0140 State: PUBLISHED Published: 2025-07-09T22:58:28.536Z Last Updated: 2025-07-30T18:02:00.810Z Vendors: Palo Alto Networks Products: GlobalProtect App, GlobalProtect UWP App Problem Types: CWE-266 Description: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltone
t UWP app are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0140
CVE ID: CVE-2025-0141 State: PUBLISHED Published: 2025-07-09T22:58:54.755Z Last Updated: 2025-07-31T16:03:36.598Z Vendors: Palo Alto Networks Products: GlobalProtect App, GlobalProtect UWP App Problem Types: CWE-426 Description: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-0141
CVE ID: CVE-2025-0142 State: PUBLISHED Published: 2025-01-30T19:38:51.716Z Last Updated: 2025-01-31T15:39:15.080Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Zoom Communications, Inc Products: Zoom Jenkins Marketplace plugin Problem Types: CWE-312 Description: Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25001/
CVE ID: CVE-2025-0143 State: PUBLISHED Published: 2025-01-30T19:42:12.816Z Last Updated: 2025-01-31T15:38:36.360Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps for Linux Problem Types: CWE-787 Description: Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25002/
CVE ID: CVE-2025-0144 State: PUBLISHED Published: 2025-01-30T19:44:06.908Z Last Updated: 2025-01-30T21:29:47.382Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-787 Description: Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25003/
CVE ID: CVE-2025-0145 State: PUBLISHED Published: 2025-01-30T19:45:39.432Z Last Updated: 2025-01-30T21:23:22.776Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps for Windows Problem Types: CWE-426 Description: Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25004/
CVE ID: CVE-2025-0146 State: PUBLISHED Published: 2025-01-30T19:47:26.128Z Last Updated: 2025-01-30T21:22:42.397Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Zoom Communications, Inc Products: Zoom Workplace app for macOS Problem Types: CWE-59 Description: Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25005/
CVE ID: CVE-2025-0147 State: PUBLISHED Published: 2025-01-30T19:49:00.792Z Last Updated: 2025-01-30T20:08:44.020Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace App for Linux Problem Types: CWE-843 Description: Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25006/
CVE ID: CVE-2025-0148 State: PUBLISHED Published: 2025-02-03T22:35:56.288Z Last Updated: 2025-02-04T15:44:55.189Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Zoom Communications, Inc Products: Zoom Jenkins Marketplace plugin Problem Types: CWE-549 Description: Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25007/
CVE ID: CVE-2025-0149 State: PUBLISHED Published: 2025-03-11T17:04:02.453Z Last Updated: 2025-03-11T19:18:34.860Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Zoom Communications, Inc Products: Zoom Apps Problem Types: CWE-345 Description: Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25008/
CVE ID: CVE-2025-0150 State: PUBLISHED Published: 2025-03-11T17:06:43.951Z Last Updated: 2025-03-11T18:47:03.336Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps for iOS Problem Types: CWE-696 Description: Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25009/
CVE ID: CVE-2025-0151 State: PUBLISHED Published: 2025-03-11T17:08:50.327Z Last Updated: 2025-03-11T17:44:08.820Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-416 Description: Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25010/
CVE ID: CVE-2025-0154 State: PUBLISHED Published: 2025-04-02T15:15:46.997Z Last Updated: 2025-09-01T00:59:14.217Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: TXSeries for Multiplatforms Problem Types: CWE-644 Description: IBM TXSeries for Multiplatforms 9.1 and 11.1 could disclose sensitive information to a remote attacker due to improper neutralization of HTTP headers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7229880
CVE ID: CVE-2025-0158 State: PUBLISHED Published: 2025-02-06T20:32:03.556Z Last Updated: 2025-02-22T22:15:35.055Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: EntireX Problem Types: CWE-248 Description: IBM EntireX 11.1 could allow a local user to cause a denial of service due to an unhandled error and fault isolation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182693
CVE ID: CVE-2025-0159 State: PUBLISHED Published: 2025-02-28T19:01:26.669Z Last Updated: 2025-03-07T04:55:48.257Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: IBM Products: Storage Virtualize Problem Types: CWE-288 Description: IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker to bypass RPCAdapter endpoint authentication by sending a specifically crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichmen
endpoint authentication by sending a specifically crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184182
CVE ID: CVE-2025-0160 State: PUBLISHED Published: 2025-02-28T19:02:50.019Z Last Updated: 2025-02-28T19:50:37.531Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Storage Virtualize Problem Types: CWE-114 Description: IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker with access to the system to execute arbitrary Java code due to improper restrictions in the RPCAdapter service. Additional Analyst Notes: - CISA
to execute arbitrary Java code due to improper restrictions in the RPCAdapter service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184182
CVE ID: CVE-2025-0161 State: PUBLISHED Published: 2025-02-20T16:02:37.156Z Last Updated: 2025-08-11T16:53:22.730Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Access Problem Types: CWE-94 Description: IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improper restrictions on code generation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183788
CVE ID: CVE-2025-0162 State: PUBLISHED Published: 2025-03-07T16:38:40.598Z Last Updated: 2025-09-01T01:08:29.283Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: Aspera Shares Problem Types: CWE-611 Description: IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185096
CVE ID: CVE-2025-0163 State: PUBLISHED Published: 2025-06-11T14:20:28.855Z Last Updated: 2025-08-24T11:55:49.924Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Verify Access, Security Verify Access Docker Problem Types: CWE-204 Description: IBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames due to an observable response discrepancy of disabled accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7236314
CVE ID: CVE-2025-0164 State: PUBLISHED Published: 2025-09-14T12:57:32.490Z Last Updated: 2025-09-15T15:59:20.829Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-732 Description: IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files due to improper permission assignment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244784
CVE ID: CVE-2025-0165 State: PUBLISHED Published: 2025-08-30T12:47:56.304Z Last Updated: 2025-09-02T20:47:44.200Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: IBM Products: watsonx Orchestrate Cartridge for IBM Cloud Pak for Data Problem Types: CWE-89 Description: IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7
-end database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7243596
CVE ID: CVE-2025-0167 State: PUBLISHED Published: 2025-02-05T09:15:06.891Z Last Updated: 2025-03-07T00:10:48.290Z Vendors: curl Products: curl Problem Types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Description: When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://curl.se/docs/CVE-2025-0167.json - https://cur
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://curl.se/docs/CVE-2025-0167.json - https://curl.se/docs/CVE-2025-0167.html - https://hackerone.com/reports/2917232
CVE ID: CVE-2025-0168 State: PUBLISHED Published: 2025-01-01T13:31:05.466Z Last Updated: 2025-01-02T17:12:53.970Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse/_feedback_system.php. The manipulation of the argument person leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289917 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289917 - https://vuldb.com/?ctiid.289917 - https://vuldb.com/?submit.473107 - https://github.com/UnrealdDei/cve/blob/main/sql11.md - https://code-projects.org/
CVE ID: CVE-2025-0169 State: PUBLISHED Published: 2025-02-08T22:21:30.776Z Last Updated: 2025-02-12T20:51:42.769Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: scriptsbundle Products: DWT - Directory & Listing WordPress Theme Problem Types: CWE-79 Description: The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a use