Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s, including via WebGL or WebGPU, to access outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r18p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r28p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p3, from r50p0 through r54p0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.arm.com/documentation/110466/latest/
CVE ID: CVE-2025-1247 State: PUBLISHED Published: 2025-02-13T13:26:26.992Z Last Updated: 2025-11-11T15:32:38.960Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Red Hat Products: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15, Red Hat build of Quarkus 3.15.3.SP1, Red Hat build of Quarkus 3.8.6.SP3 Problem Types: CWE-488 Description: A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
est data, impersonate users, or access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:1884 - https://access.redhat.com/errata/RHSA-2025:1885 - https://access.redhat.com/errata/RHSA-2025:2067 - https://access.redhat.com/security/cve/CVE-2025-1247 - https://bugzilla.redhat.com/show_bug.cgi?id=2345172
CVE ID: CVE-2025-1249 State: PUBLISHED Published: 2025-02-26T14:32:10.186Z Last Updated: 2025-02-26T14:45:34.811Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Pixelite Products: Events Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in Pixelite Events Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through 6.6.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-6-6-4-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-1250 State: PUBLISHED Published: 2025-09-12T06:06:14.804Z Last Updated: 2025-09-12T17:20:05.685Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messages, merge request descriptions, or notes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-relea
s: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/519335 - https://hackerone.com/reports/2903896
CVE ID: CVE-2025-1252 State: PUBLISHED Published: 2025-05-08T08:31:14.144Z Last Updated: 2025-09-23T17:50:27.307Z Vendors: RTI Products: Connext Professional Problem Types: CWE-122 Description: Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0 before 6.1.2.23, from 6.0.0 before 6.0.1.42, from 5.3.0 before 5.3.*, from 4.4d before 5.2.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2025-1252
CVE ID: CVE-2025-1253 State: PUBLISHED Published: 2025-05-08T08:32:35.311Z Last Updated: 2025-09-23T17:50:37.371Z Vendors: RTI Products: Connext Professional Problem Types: CWE-120, CWE-121 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0 before 6.1.2.23, from 6.0.0 before 6.0.1.42, from 5.3.0 before 5.3.*, from 4.5c before 5.2.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve
before 5.2.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2025-1253
CVE ID: CVE-2025-1254 State: PUBLISHED Published: 2025-05-08T08:32:43.287Z Last Updated: 2025-09-23T17:50:46.174Z Vendors: RTI Products: Connext Professional Problem Types: CWE-125, CWE-787 Description: Out-of-bounds Read, Out-of-bounds Write vulnerability in RTI Connext Professional (Recording Service) allows Overflow Buffers, Overread Buffers.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0 before 6.1.2.23, from 6.0.0 before 6.0.1.42. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2025-1254
CVE ID: CVE-2025-1255 State: PUBLISHED Published: 2025-09-23T17:50:51.857Z Last Updated: 2025-09-23T18:37:09.324Z Vendors: RTI Products: Connext Professional Problem Types: CWE-822 Description: Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.This issue affects Connext Professional: from 7.4.0 before 7.6.0, from 7.2.0 before 7.3.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rti.com/vulnerabilities/#cve-2025-1255
CVE ID: CVE-2025-1256 State: REJECTED Published: N/A Last Updated: 2025-11-14T22:19:22.922Z Description: No description available.
CVE ID: CVE-2025-1257 State: PUBLISHED Published: 2025-03-13T06:00:36.063Z Last Updated: 2025-03-14T13:44:11.141Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipulating specific API inputs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/519348 - https://hackerone.com/reports/2984218
CVE ID: CVE-2025-1258 State: REJECTED Published: N/A Last Updated: 2025-02-20T17:19:25.827Z Description: No description available.
CVE ID: CVE-2025-1259 State: PUBLISHED Published: 2025-03-04T19:44:34.221Z Last Updated: 2025-03-04T20:12:25.230Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Arista Networks Products: EOS Problem Types: CWE-284 Description: On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in users retrieving data that should not have been available Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/21098-security-advisory-0111
CVE ID: CVE-2025-1260 State: PUBLISHED Published: 2025-03-04T19:49:00.278Z Last Updated: 2025-03-04T20:41:46.732Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Arista Networks Products: EOS Problem Types: CWE-284 Description: On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/21098-security-advisory-0111
CVE ID: CVE-2025-1261 State: PUBLISHED Published: 2025-03-08T01:44:27.321Z Last Updated: 2025-03-10T16:06:36.504Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-79 Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scri
his makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability exists due to an incomplete fix for CVE-2024-3307. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e553135d-88e0-4840-99ad-9514c2243b7d?source=cve - https://plugins.trac.wordpress.org/changeset/3249106/ht-mega-for-elementor/tags/2.8.3/assets/js/htmega-widgets-active.js
CVE ID: CVE-2025-1262 State: PUBLISHED Published: 2025-02-25T12:41:27.476Z Last Updated: 2025-02-25T14:37:05.499Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: webfactory Products: Advanced Google reCAPTCHA Problem Types: CWE-804 Description: The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d553aab2-d441-46d6-9c01-5dcfdc48674f?source=cve - https://plugins.trac.
ww.wordfence.com/threat-intel/vulnerabilities/id/d553aab2-d441-46d6-9c01-5dcfdc48674f?source=cve - https://plugins.trac.wordpress.org/changeset/3244677/advanced-google-recaptcha
CVE ID: CVE-2025-1264 State: PUBLISHED Published: 2025-04-06T04:21:20.875Z Last Updated: 2025-04-07T14:53:32.676Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: aioseo Products: Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links Problem Types: CWE-89 Description: The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to SQL Injection via the 'orderBy' parameter in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated att
ied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce2d582e-4f50-4b55-9f3b-3c46d96c0927?source=cve - https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Api/Api.php#L42 - https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Api/LinkStatusTable.php#L31 - https://plugins.trac.wor
gins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Api/LinkStatusTable.php#L31 - https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Core/Database.php#L1357 - https://plugins.trac.wordpress.org/browser/broken-link-checker-seo/trunk/app/Core/Database.php#L552 - https://wordpress.org/plugins/broken-link-checker-seo - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3263416%40broken-link-checker-seo&new=3263416%40broken-link-checker-seo&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1265 State: PUBLISHED Published: 2025-02-20T19:11:14.562Z Last Updated: 2025-02-20T20:52:00.934Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Elseta Products: Vinci Protocol Analyzer Problem Types: CWE-78 Description: An OS command injection vulnerability exists in Vinci Protocol Analyzer that could allow an attacker to escalate privileges and perform code execution on affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-06 - https://elseta.com/support/
CVE ID: CVE-2025-1266 State: REJECTED Published: N/A Last Updated: 2025-03-13T21:36:20.534Z Description: No description available.
CVE ID: CVE-2025-1267 State: PUBLISHED Published: 2025-04-01T06:52:05.370Z Last Updated: 2025-04-01T14:36:44.139Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: trainingbusinesspros Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-79 Description: The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute
for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/763a9aff-9bc0-4c79-9383-778a9034b436?source=cve - https://plugins.trac.wordpress.org/browser/groundhogg/trunk/assets/js/admin/forms/form-builder-v2.js#L859 - https://plugins.trac.wordpress.org/browser/groundhogg/trunk/assets/js/admin/forms/form-builder-v2.js - https://github.com/groundhoggwp/groundhogg/commit/
g/browser/groundhogg/trunk/assets/js/admin/forms/form-builder-v2.js - https://github.com/groundhoggwp/groundhogg/commit/5206bf2482e2fe210ccca6e7dcfe62ffe85b3061 - https://plugins.trac.wordpress.org/changeset/3264477/
CVE ID: CVE-2025-1268 State: PUBLISHED Published: 2025-03-31T00:52:18.516Z Last Updated: 2025-06-16T08:21:21.728Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Canon Inc. Products: Generic Plus PCL6 Printer Driver, Generic Plus UFR II Printer Driver, Generic Plus LIPS4 Printer Driver, Generic Plus LIPSLX Printer Driver, Generic Plus PS Printer Driver, Generic FAX Printer Driver, UFRII LT Printer Driver, CARPS2 Printer Driver, PDF Driver Problem Types: CWE-787 Description: Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX P
lus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / Generic FAX Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / PDF Driver Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2025-003/ - https://canon.jp/support/support-info/250328vulnerability-response - https://www.usa.canon.com/about-us/to-our-customers/service-notice-vulnerability-remediation-for-certain-printer-drivers-for-production-printers-office-small-office-multifunction-printers-and-laser-printers - https://www.canon-europe.com/support/produc
ion-printers-office-small-office-multifunction-printers-and-laser-printers - https://www.canon-europe.com/support/product-security/
CVE ID: CVE-2025-1269 State: PUBLISHED Published: 2025-02-18T13:48:29.384Z Last Updated: 2025-02-20T11:20:46.686Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L) Vendors: HAVELSAN Products: Liman MYS Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing.This issue affects Liman MYS: before 2.1.1 - 1010. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/limanmys/core/releases/tag/release.master.1010 - https://www.usom.gov.tr/bildirim/tr-25-0038
CVE ID: CVE-2025-1270 State: PUBLISHED Published: 2025-02-13T12:48:15.216Z Last Updated: 2025-02-13T14:22:21.210Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: Anapi Group Products: H6Web Problem Types: CWE-639 Description: Insecure direct object reference (IDOR) vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/ha_datos_hermano.php” endpoint to refer to another user. In addition, the first request could also allow the attacker to impersonate other users. As a result, all requests made after exploitation of the IDOR vuln
d also allow the attacker to impersonate other users. As a result, all requests made after exploitation of the IDOR vulnerability will be executed with the privileges of the impersonated user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-anapi-group-h6web
CVE ID: CVE-2025-1271 State: PUBLISHED Published: 2025-02-13T12:49:40.807Z Last Updated: 2025-02-13T14:22:02.811Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Anapi Group Products: H6Web Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) in Anapi Group's h6web. This security flaw could allow an attacker to inject malicious JavaScript code into a URL. When a user accesses that URL, the injected code is executed in their browser, which can result in the theft of sensitive information, identity theft or the execution of unauthorised actions on behalf of the affected user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
unauthorised actions on behalf of the affected user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-anapi-group-h6web
CVE ID: CVE-2025-1273 State: PUBLISHED Published: 2025-04-15T20:56:04.970Z Last Updated: 2025-09-25T18:45:07.442Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-122 Description: A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Addit
nerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0003
CVE ID: CVE-2025-1274 State: PUBLISHED Published: 2025-04-15T20:58:04.157Z Last Updated: 2025-09-25T18:34:11.551Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-787 Description: A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst
ause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0007
CVE ID: CVE-2025-1275 State: PUBLISHED Published: 2025-04-15T20:54:30.139Z Last Updated: 2025-08-19T12:47:53.443Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel, AutoCAD MAP 3D, AutoCAD LT, DWG TrueView Problem Types: CWE-122 Description: A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the
can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/products/dwg-trueview/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0006
CVE ID: CVE-2025-1276 State: PUBLISHED Published: 2025-04-15T20:55:04.255Z Last Updated: 2025-10-07T20:54:16.150Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Advance Steel, AutoCAD LT, RealDWG, DWG TrueView Problem Types: CWE-787 Description: A maliciously crafted DWG file, when parsed through certain Autodesk applications, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current proces
is vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/products/dwg-trueview/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0004
CVE ID: CVE-2025-1277 State: PUBLISHED Published: 2025-04-15T20:57:04.021Z Last Updated: 2025-09-25T18:46:17.984Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-120 Description: A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0003
CVE ID: CVE-2025-1278 State: PUBLISHED Published: 2025-05-09T16:13:14.048Z Last Updated: 2025-05-09T20:03:19.786Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-1220 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/519580 - https://hackerone.com/reports/2977149