Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
php’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto
CVE ID: CVE-2025-1108 State: PUBLISHED Published: 2025-02-07T13:40:09.270Z Last Updated: 2025-02-12T20:51:40.433Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Impronta Products: Janto Problem Types: CWE-345 Description: Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request by injecting malicious content into the ‘Xml’ parameter on the ‘/public/cgi/Gateway.php’ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.e
/public/cgi/Gateway.php’ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto
CVE ID: CVE-2025-1110 State: PUBLISHED Published: 2025-05-22T14:02:31.385Z Last Updated: 2025-05-22T14:17:44.379Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-1220 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/517693 - https://hackerone.com/reports/2972576
CVE ID: CVE-2025-1112 State: PUBLISHED Published: 2025-07-09T14:33:12.453Z Last Updated: 2025-08-24T11:20:03.235Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-282 Description: IBM OpenPages with Watson 8.3 and 9.0 could allow an authenticated user to obtain sensitive information that should only be available to privileged users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239151
CVE ID: CVE-2025-1113 State: PUBLISHED Published: 2025-02-07T21:31:09.189Z Last Updated: 2025-02-07T22:48:37.546Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: taisan Products: tarzan-cms Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of the component Add Theme Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295019 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295019 - https://vuldb.com/?ctiid.295019 - https://gitee.com/taisan/tarzan-cms/issues/IBHZ0J
CVE ID: CVE-2025-1114 State: PUBLISHED Published: 2025-02-07T22:31:04.425Z Last Updated: 2025-02-10T17:16:22.122Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: newbee-mall Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component Add Category Page. The manipulation of the argument categoryName leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version d
public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295020 - https://vuldb.com/?ctiid.295020 - https://vuldb.com/?submit.489744 - https://github.com/newbee-ltd/newbee-mall/issues/94 - https://github.com/newbee-ltd/newbee-mall/issues/94#issue-2811680280
CVE ID: CVE-2025-1115 State: PUBLISHED Published: 2025-02-08T10:00:11.339Z Last Updated: 2025-02-16T08:42:23.595Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: RT-Thread Problem Types: CWE-200, CWE-284 Description: A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_control/sys_device_find/sys_device_init/sys_device_open/sys_device_read/sys_device_register/sys_device_write/sys_event_delete/sys_event_recv/sys_event_send/sys_mb_delete/sys_mb_recv/sys_mb_send/sys_mb_send_wait/sys_mq_recv/sys_mq_send/sys_mq_urgent/sys_mutex_delete/sys_mutex_release/s
lete/sys_mb_recv/sys_mb_send/sys_mb_send_wait/sys_mq_recv/sys_mq_send/sys_mq_urgent/sys_mutex_delete/sys_mutex_release/sys_mutex_take/sys_rt_timer_control/sys_rt_timer_delete/sys_rt_timer_start/sys_rt_timer_stop/sys_sem_delete/sys_sem_release/sys_sem_take/sys_shmat/sys_shmdt/sys_thread_create/sys_thread_delete/sys_thread_startup/sys_timer_delete/sys_timer_gettime/sys_timer_settime of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument arg[0] leads to information disclosure. An attack has to be approached locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295021 - https://vuldb.com/?ctiid.295021 - https://vuldb.com/?su
A ADP Vulnrichment: References: - https://vuldb.com/?id.295021 - https://vuldb.com/?ctiid.295021 - https://vuldb.com/?submit.489903 - https://github.com/RT-Thread/rt-thread/issues/9877
CVE ID: CVE-2025-1116 State: PUBLISHED Published: 2025-02-08T12:00:15.033Z Last Updated: 2025-02-12T20:51:42.931Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Dreamvention Products: Live AJAX Search Free Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/live_search/module/live_search.searchresults. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Addition
l injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295022 - https://vuldb.com/?ctiid.295022 - https://vuldb.com/?submit.492051 - https://gist.github.com/mcdruid/d6a41cfebd9e10e63a8c698d3a8ad771
CVE ID: CVE-2025-1117 State: PUBLISHED Published: 2025-02-08T12:31:05.625Z Last Updated: 2025-02-12T20:51:42.254Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: CoinRemitter Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the argument coin leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.3 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vul
ble to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295023 - https://vuldb.com/?ctiid.295023 - https://vuldb.com/?submit.492685 - https://gist.github.com/mcdruid/d4bdd8ffb8988bce9408c6bac40a15c5 - https://github.com/CoinRemitter/opencart/releases/tag/0.0.3
CVE ID: CVE-2025-1118 State: PUBLISHED Published: 2025-02-19T17:54:27.651Z Last Updated: 2025-11-20T20:00:35.188Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-501 Description: A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory. Additional Analyst Notes: - C
is in order to extract signatures, salts, and other sensitive information from the memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:16154 - https://access.redhat.com/security/cve/CVE-2025-1118 - https://bugzilla.redhat.com/show_bug.cgi?id=2346137
CVE ID: CVE-2025-1119 State: PUBLISHED Published: 2025-03-13T06:56:56.733Z Last Updated: 2025-03-13T20:40:46.893Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: croixhaug Products: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Problem Types: CWE-94 Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attack
n that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1be557db-daa8-4d86-819a-462f29da884b?source=cve - https://plugins.trac.wordpress.org/changeset/3250719/simply-schedule-appointments/trunk/booking-app-new/page-appointment-edit.php
CVE ID: CVE-2025-1121 State: PUBLISHED Published: 2025-03-06T23:49:03.219Z Last Updated: 2025-05-08T19:15:05.506Z Vendors: Google Products: ChromeOS Problem Types: Code execution and Privilege Escalation Description: Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain root code execution and potentially unenroll enterprise-managed devices via a specially crafted recovery image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/issues/336153054 - https://issues.chromium.org/issues/b/336153054
CVE ID: CVE-2025-1122 State: PUBLISHED Published: 2025-04-15T19:51:23.127Z Last Updated: 2025-05-08T19:15:05.948Z Vendors: Google Products: ChromeOS Problem Types: Out-of-bounds Write Description: Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and Bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/issues/324336238 - https://issues.chromium.org/issues/b/324336238
CVE ID: CVE-2025-1123 State: PUBLISHED Published: 2025-05-23T12:22:55.492Z Last Updated: 2025-05-23T12:56:15.670Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: solidwp Products: Solid Mail – SMTP email and logging made by SolidWP Problem Types: CWE-79 Description: The Solid Mail – SMTP email and logging made by SolidWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email Name, Subject, and Body in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an i
e for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f99a918d-53c1-46bd-8e55-9ba77a92efe8?source=cve - https://plugins.trac.wordpress.org/changeset/3283671/wp-smtp
CVE ID: CVE-2025-1125 State: PUBLISHED Published: 2025-03-03T14:16:13.252Z Last Updated: 2025-11-20T20:00:40.103Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-787 Description: When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size c
it misses to properly check for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculation to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result the hfsplus_open_compressed_real() function will write past of the internal buffer length. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution by-passing secure boot protections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-1125 - https://bugzilla.redhat.com/show_bug.cgi?id=2346138 - https://lists.gnu.org/archive/html/grub-devel/202
/CVE-2025-1125 - https://bugzilla.redhat.com/show_bug.cgi?id=2346138 - https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html
CVE ID: CVE-2025-1126 State: PUBLISHED Published: 2025-02-11T16:50:34.270Z Last Updated: 2025-02-12T20:51:45.122Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Lexmark Products: Lexmark Print Management Client Problem Types: CWE-807 Description: A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2025-1127 State: PUBLISHED Published: 2025-02-13T18:49:43.500Z Last Updated: 2025-02-13T19:14:43.391Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Lexmark Products: CX, XC, CS, MS, MX, XM, et. al. Problem Types: CWE-22, CWE-362 Description: The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2025-1128 State: PUBLISHED Published: 2025-02-25T06:58:31.380Z Last Updated: 2025-02-25T14:37:43.136Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpeverest Products: Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress Problem Types: CWE-434 Description: The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible fo
mat' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8c04d8c9-acad-4832-aa8a-8372c58a0387?source=cve - https://github.com/wpeverest/everest-forms/commit/7d37858d2c614aa107b0f495fe50819a3867e7f5 - https://plugins.trac.wordpress.org/changeset/3237831/everest-forms/trunk/includes/abstracts/class-evf-form-fiel
67e7f5 - https://plugins.trac.wordpress.org/changeset/3237831/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#file0 - https://plugins.trac.wordpress.org/changeset/3243663/everest-forms#file7 - https://github.com/wpeverest/everest-forms/pull/1406/files
CVE ID: CVE-2025-1131 State: PUBLISHED Published: 2025-09-23T04:31:02.784Z Last Updated: 2025-11-03T17:31:42.189Z Vendors: Asterisk Products: Asterisk Problem Types: CWE-427 Description: A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privilege
loit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp
CVE ID: CVE-2025-1132 State: PUBLISHED Published: 2025-02-19T08:47:13.370Z Last Updated: 2025-02-19T15:05:57.942Z Vendors: ChurchCRM Products: ChurchCRM Problem Types: CWE-89 Description: A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. The parameter is directly inserted into an SQL query without proper sanitization, allowing attackers to inject malicious SQL commands. Please note that the vulnerability requires Administrator permissions. This flaw can potentially allow attackers to delay the response, indicating the presence of an SQL injection vulnerability. While it is a time-based blind injection,
delay the response, indicating the presence of an SQL injection vulnerability. While it is a time-based blind injection, it can be exploited to gain insights into the underlying database, and with further exploitation, sensitive data could be retrieved. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/7251
CVE ID: CVE-2025-1133 State: PUBLISHED Published: 2025-02-19T08:52:43.000Z Last Updated: 2025-02-19T15:03:53.926Z Vendors: ChurchCRM Products: ChurchCRM Problem Types: CWE-89 Description: A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection vulnerability in the EditEventAttendees functionality. The EID parameter is directly concatenated into an SQL query without proper sanitization, making it susceptible to SQL injection attacks. An attacker can manipulate the query, potentially leading to data exfiltration, modification, or deletion. Please note that this vulnerability requires Adminis
otentially leading to data exfiltration, modification, or deletion. Please note that this vulnerability requires Administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/7252
CVE ID: CVE-2025-1134 State: PUBLISHED Published: 2025-02-19T08:58:08.847Z Last Updated: 2025-02-19T15:02:45.629Z Vendors: ChurchCRM Products: ChurchCRM Problem Types: CWE-89 Description: A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the DonatedItemEditor functionality. The CurrentFundraiser parameter is directly concatenated into an SQL query without sufficient sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note that this
execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note that this vulnerability requires Administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/7253
CVE ID: CVE-2025-1135 State: PUBLISHED Published: 2025-02-19T09:01:59.048Z Last Updated: 2025-02-19T14:55:42.227Z Vendors: ChurchCRM Products: ChurchCRM Problem Types: CWE-89 Description: A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the BatchWinnerEntry functionality. The CurrentFundraiser parameter is directly concatenated into an SQL query without sufficient sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note the vulner
execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note the vulnerability requires Administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/7254
CVE ID: CVE-2025-1137 State: PUBLISHED Published: 2025-05-10T01:56:23.135Z Last Updated: 2025-09-29T15:33:16.069Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Storage Scale Problem Types: CWE-250 Description: IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutralization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7233085
CVE ID: CVE-2025-1138 State: PUBLISHED Published: 2025-05-15T20:11:03.814Z Last Updated: 2025-08-28T14:12:02.006Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-548 Description: IBM InfoSphere Information Server 11.7 could disclose sensitive information to an authenticated user that could aid in further attacks against the system through a directory listing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7230295
CVE ID: CVE-2025-1139 State: PUBLISHED Published: 2025-08-20T14:42:59.408Z Last Updated: 2025-08-20T15:09:14.732Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: IBM Products: Edge Application Manager Problem Types: CWE-732 Description: IBM Edge Application Manager 4.5 could allow a local user to read or modify resources that they should not have authorization to access due to incorrect permission assignment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242632
CVE ID: CVE-2025-1142 State: PUBLISHED Published: 2025-08-20T14:44:07.750Z Last Updated: 2025-08-20T15:08:38.947Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Edge Application Manager Problem Types: CWE-918 Description: IBM Edge Application Manager 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242632