Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-7371 State: PUBLISHED Published: 2025-07-22T15:49:06.579Z Last Updated: 2025-07-22T19:21:01.131Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Okta Products: Okta On-Premises Provisioning Agent Problem Types: CWE-532 Description: Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versio
ou are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.okta.com/oie/en-us/content/topics/settings/version_histories/ver_history_opp_agent.htm
CVE ID: CVE-2025-7374 State: PUBLISHED Published: 2025-10-10T11:17:08.050Z Last Updated: 2025-10-10T12:01:46.739Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: n/a Products: WP JobHunt Problem Types: CWE-863 Description: The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending. Additional Analyst Notes: - CISA ADP Vulnr
nd above, to log in to the site even if their account is inactive or pending. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12643dd9-3b5e-45ea-9a64-a5b00c9202c8?source=cve - https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636
CVE ID: CVE-2025-7376 State: PUBLISHED Published: 2025-08-06T06:28:41.185Z Last Updated: 2025-08-07T14:11:44.397Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: Mitsubishi Electric Corporation, Mitsubishi Electric Iconics Digital Solutions Products: GENESIS64, MC Works64, GENESIS Problem Types: CWE-64 Description: Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric Iconics Digital Solutions GENESIS64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS version 11.00, Mitsubishi Electric GENESIS64 all versions, Mitsubishi Electric MC Works64 all versions, and Mitsubishi Electric GENESIS version 11.00 al
ic GENESIS64 all versions, Mitsubishi Electric MC Works64 all versions, and Mitsubishi Electric GENESIS version 11.00 allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the processes of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/vu/JVNVU96364629 - https://www.mitsubishielectric.com/psirt/vulnera
CISA ADP Vulnrichment: References: - https://jvn.jp/vu/JVNVU96364629 - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-009_en.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-01
CVE ID: CVE-2025-7378 State: PUBLISHED Published: 2025-07-09T07:06:08.150Z Last Updated: 2025-07-09T13:54:52.248Z Vendors: ASUSTOR Products: ADM Problem Types: CWE-20 Description: An improper Input Validation vulnerability allows injecting arbitrary values of the NAS configuration file in ASUSTOR ADM. This could potentially lead to system misconfiguration and break the format of the configuation file, causing the NAS to exhibit unexpected behavior. This issue affects ADM: from 4.1 before 4.3.1.R5A1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asustor.com/security/security_advisory_detail?id=41
CVE ID: CVE-2025-7379 State: PUBLISHED Published: 2025-07-09T08:31:02.925Z Last Updated: 2025-07-09T13:41:06.585Z Vendors: ASUSTOR Products: ADM Problem Types: CWE-352 Description: A security bypass vulnerability allows exploitation via Reverse Tabnabbing, a type of phishing attack where attackers can manipulate the content of the original tab, leading to credential theft and other security risks. This issue affects DataSync Center: from 1.1.0 before 1.1.0.r207, and from 1.2.0 before 1.2.0.r206. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asustor.com/security/security_advisory_detail?id=42
CVE ID: CVE-2025-7380 State: PUBLISHED Published: 2025-07-14T05:39:07.731Z Last Updated: 2025-07-14T13:17:13.127Z Vendors: ASUSTOR Products: ADM Problem Types: CWE-79 Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to inject malicious scripts into the folder name field while creating a new shared folder. These scripts are not properly sanitized and will be executed when the folder name is subsequently displayed in the user interface. This allows attackers to execute arbitrary JavaScript in the context of another user's session, potentially accessing session cookies or other sensitive data. Affected products and
context of another user's session, potentially accessing session cookies or other sensitive data. Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.asustor.com/security/security_advisory_detail?id=44
CVE ID: CVE-2025-7381 State: PUBLISHED Published: 2025-07-09T15:16:37.305Z Last Updated: 2025-07-10T07:43:06.651Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mautic Products: Docker Mautic Problem Types: CWE-497 Description: ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses. WorkaroundsThe mitigation requires changing the expose_php variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini. Additional Analyst Notes: - CISA ADP Vulnric
iable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/docker-mautic/security/advisories/GHSA-89jm-p7jf-x8jx
CVE ID: CVE-2025-7382 State: PUBLISHED Published: 2025-07-21T13:28:38.437Z Last Updated: 2025-07-21T15:03:51.889Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: CWE-78 Description: A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High Availability (HA) auxiliary devices, if OTP authentication for the admin user is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce
CVE ID: CVE-2025-7383 State: PUBLISHED Published: 2025-08-29T09:19:01.638Z Last Updated: 2025-08-29T13:46:14.471Z Vendors: Oberon microsystems AG Products: Oberon PSA Crypto Problem Types: CWE-208, CWE-327 Description: Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 1.5.1 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oberon.ch/security-advisories/cve-2025-7383/
CVE ID: CVE-2025-7384 State: PUBLISHED Published: 2025-08-13T04:22:56.944Z Last Updated: 2025-08-13T13:50:48.521Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: crmperks Products: Database for Contact Form 7, WPforms, Elementor forms Problem Types: CWE-502 Description: The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likel
ed attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/129f810d-ff83-4428-9f98-6a6aa8817783?source=cve - https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.1/includes/data.php#L525 - https://plugins.trac.wordpress.org/changeset/3338764/#file9
CVE ID: CVE-2025-7385 State: PUBLISHED Published: 2025-09-04T12:05:55.357Z Last Updated: 2025-09-04T13:24:35.160Z Vendors: Concept Intermedia Products: GOV CMS Problem Types: CWE-89 Description: Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability, which might be exploited by an unauthenticated remote attacker. Versions 4.0 and above are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/09/CVE-2025-7385 - https://sam3.pl/strona-305-za_co_nas_cenia_redaktorzy.html
CVE ID: CVE-2025-7387 State: PUBLISHED Published: 2025-07-10T05:24:12.316Z Last Updated: 2025-07-10T13:10:45.344Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: lanacodes Products: Lana Downloads Manager Problem Types: CWE-79 Description: The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user acc
administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be0db9ff-dc95-4c92-8dc4-472c5df9c0dd?source=cve - https://plugins.trac.wordpress.org/browser/lana-downloads-manager/tags/1.10.0/lana-downloads-manager.php#L763 - https://plugins.trac.wordpress.org/changeset/3324923/lana-downloads-manager
CVE ID: CVE-2025-7388 State: PUBLISHED Published: 2025-09-04T13:01:13.624Z Last Updated: 2025-09-05T03:55:48.601Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Progress Software Corporation Products: OpenEdge Problem Types: CWE-77 Description: It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority of the AdminServer process. An RMI interface permitted manipulation of a configuration property with inadequate input validation leading to OS command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
h inadequate input validation leading to OS command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Important-RCE-Security-Update-for-OpenEdge-AdminServer
CVE ID: CVE-2025-7390 State: PUBLISHED Published: 2025-08-21T06:08:00.210Z Last Updated: 2025-08-21T13:53:15.381Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Softing Industrial Automation GmbH Products: OPC UA C++ SDK, edgeConnector, edgeAggregator Problem Types: CWE-295 Description: A malicious client can bypass the client certificate trust check of an opc.https server when the server endpoint is configured to allow only secure communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.html - https://industrial.softing.com/fileadmin/psirt/downloads/2025/CV
com/fileadmin/psirt/downloads/2025/CVE-2025-7390.html - https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.json
CVE ID: CVE-2025-7392 State: PUBLISHED Published: 2025-07-21T16:36:04.813Z Last Updated: 2025-07-22T14:06:04.006Z Vendors: Drupal Products: Cookies Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-087
CVE ID: CVE-2025-7393 State: PUBLISHED Published: 2025-07-21T16:35:45.527Z Last Updated: 2025-07-22T14:07:11.356Z Vendors: Drupal Products: Mail Login Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-088
CVE ID: CVE-2025-7394 State: PUBLISHED Published: 2025-07-18T22:34:23.849Z Last Updated: 2025-07-21T15:00:21.780Z Vendors: wolfSSL Products: wolfSSL Problem Types: CWE-200 Description: In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values returned from RAND_bytes() after fork() is called. This can lead to weak or predictable random numbers generated in applications that are both using RAND_bytes() and doing fork() operations. This only affects applications explicitly calling RAND_bytes() after fork() and does not affect any internal TLS operations. Although RAND_bytes() documentation in Ope
ng RAND_bytes() after fork() and does not affect any internal TLS operations. Although RAND_bytes() documentation in OpenSSL calls out not being safe for use with fork() without first calling RAND_poll(), an additional code change was also made in wolfSSL to make RAND_bytes() behave similar to OpenSSL after a fork() call without calling RAND_poll(). Now the Hash-DRBG used gets reseeded after detecting running in a new process. If making use of RAND_bytes() and calling fork() we recommend updating to the latest version of wolfSSL. Thanks to Per Allansson from Appgate for the report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssl/blob/master
report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-july-17-2025
CVE ID: CVE-2025-7395 State: PUBLISHED Published: 2025-07-18T22:15:59.460Z Last Updated: 2025-07-21T14:56:52.762Z Vendors: wolfSSL Products: wolfSSL Problem Types: CWE-295 Description: A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL client failing to properly verify the server certificate's domain name, allowing any certificate issued by a trusted CA to be accepted regardless of the hostname. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://github.com/wolfssl/wolfssl.git
CVE ID: CVE-2025-7396 State: PUBLISHED Published: 2025-07-18T22:51:18.950Z Last Updated: 2025-07-21T15:05:59.222Z Vendors: wolfSSL Products: wolfSSL Description: In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C implementation of Curve25519. It is not needed, or available with; ARM assembly builds, Intel assembly builds, and the small Curve25519 feature. While the side-channel attack on extracting a private key would be very difficult to execute in practice, enabling blinding provides an additional layer of protection for devices that may be more susceptible to physical access or side-ch
inding provides an additional layer of protection for devices that may be more susceptible to physical access or side-channel observation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-july-17-2025
CVE ID: CVE-2025-7397 State: PUBLISHED Published: 2025-07-17T21:53:39.786Z Last Updated: 2025-07-18T14:10:37.202Z Vendors: Broadcom Products: Brocade ASCG Problem Types: CWE-312 Description: A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the command history. A local authenticated user that can access sensitive information like passwords within the CLI history leading to unauthorized access and potential data breaches. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35949
CVE ID: CVE-2025-7398 State: PUBLISHED Published: 2025-07-17T21:28:57.410Z Last Updated: 2025-07-18T14:57:57.810Z Vendors: Broadcom Products: Brocade ASCG Problem Types: CWE-326 Description: Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35950
CVE ID: CVE-2025-7399 State: PUBLISHED Published: 2025-08-06T03:41:00.660Z Last Updated: 2025-08-06T19:28:54.193Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: MuffinGroup Products: Betheme Problem Types: CWE-79 Description: The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - C
rbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb8756b-7c0f-4bc9-9e24-07598efa9eee?source=cve - https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048#item-description__changelog
CVE ID: CVE-2025-7400 State: PUBLISHED Published: 2025-10-07T07:22:39.716Z Last Updated: 2025-10-07T18:14:40.045Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: marceljm Products: Featured Image from URL (FIFU) Problem Types: CWE-79 Description: The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4eeaf05-ec86-4d99-bc00-81f7f99e88ce?source=cve - https://plugins.trac.wordpress.org/changeset/3362830/featured-image-from-url
CVE ID: CVE-2025-7401 State: PUBLISHED Published: 2025-07-11T04:22:01.400Z Last Updated: 2025-07-11T13:23:38.795Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aa-team Products: Premium Age Verification / Restriction for WordPress Problem Types: CWE-798 Description: The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remote_tunnel.php in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to read from or write to arbitrary files on the affected site's server
s makes it possible for unauthenticated attackers to read from or write to arbitrary files on the affected site's server which may make the exposure of sensitive information or remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0906a45-6d9b-48a0-98ae-df7b591a8848?source=cve - https://codecanyon.net/item/premium-age-verification-restriction-for-wordpress/11300327
CVE ID: CVE-2025-7402 State: PUBLISHED Published: 2025-11-24T04:36:40.730Z Last Updated: 2025-11-24T17:23:21.691Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: scripteo Products: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Problem Types: CWE-89 Description: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in all versions up to, and including, 4.95 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additio
sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5548b97d-14f0-4f50-b213-a19c02c240be?source=cve - https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010
CVE ID: CVE-2025-7403 State: PUBLISHED Published: 2025-09-19T05:19:18.675Z Last Updated: 2025-09-19T13:09:05.011Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-123 Description: Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9r46-cqqw-6j2j
CVE ID: CVE-2025-7404 State: PUBLISHED Published: 2025-07-24T20:45:04.168Z Last Updated: 2025-07-25T19:07:25.482Z Vendors: Calibre Web, Autocaliweb Products: Calibre Web, Autocaliweb Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/kino - https://github.com/janeczku/calibre-web - https://github.com/gelbphoenix/autocaliweb