Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
users with access to the settings section. The issue is patched in versions 15.2.3 and 14.3.3. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585x - https://github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba23321cd - https://github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bf77eb9c
CVE ID: CVE-2025-27602 State: PUBLISHED Published: 2025-03-11T15:32:11.210Z Last Updated: 2025-03-11T18:52:56.698Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-285, CWE-863 Description: Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. The issue is patched in versions 10.8.9 and 13.7.1. No known workarounds are available. Addi
or does not have access to. The issue is patched in versions 10.8.9 and 13.7.1. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wx5h-wqfq-v698 - https://github.com/umbraco/Umbraco-CMS/commit/5b54bed406682ceff57903bf7d3c57814eef31a7 - https://github.com/umbraco/Umbraco-CMS/commit/7888b9a4ce5ae7f9bda7ff3bb705b8fcd2f1675d
CVE ID: CVE-2025-27603 State: PUBLISHED Published: 2025-03-07T16:06:39.963Z Last Updated: 2025-03-07T17:57:36.804Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: xwikisas Products: application-confluence-migrator-pro Problem Types: CWE-95 Description: XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/application-confluenc
.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-6qvp-39mm-95v8 - https://github.com/xwikisas/application-confluence-migrator-pro/commit/36cef2271bd429773698ca3a21e47b6d51d6377d
CVE ID: CVE-2025-27604 State: PUBLISHED Published: 2025-03-07T16:11:32.475Z Last Updated: 2025-03-07T17:56:42.640Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xwikisas Products: application-confluence-migrator-pro Problem Types: CWE-200 Description: XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/application-confluence-migrator-pro/security/adviso
: - CISA ADP Vulnrichment: References: - https://github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-3w9f-2pph-j5vc - https://github.com/xwikisas/application-confluence-migrator-pro/commit/6ced42b1f341fd0ce6734fc58c7d694da5f365fb
CVE ID: CVE-2025-27606 State: PUBLISHED Published: 2025-03-14T16:56:23.217Z Last Updated: 2025-03-14T18:11:03.936Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: element-hq Products: element-android Problem Types: CWE-488 Description: Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ele
Version 1.6.34 solves the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/element-android/security/advisories/GHSA-632v-9pm3-m8ch - https://github.com/element-hq/element-android/commit/53bd78b05de375c6e6b0b5aa794a56b4ba95984c - https://github.com/element-hq/element-android/commit/87d7fcdc8036a4db4da8c403f87c73a64a546304
CVE ID: CVE-2025-27607 State: PUBLISHED Published: 2025-03-07T16:18:13.789Z Last Updated: 2025-03-07T17:50:28.395Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: nhairs Products: python-json-logger Problem Types: CWE-829 Description: Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing dependency. This occurred because msgspec-python313-pre was deleted by the owner leaving the name open to being claimed by a third party. If the package was claimed, it would allow them RCE on any Python JSON Logger user who installed the development dependencies on Python
was claimed, it would allow them RCE on any Python JSON Logger user who installed the development dependencies on Python 3.13 (e.g. pip install python-json-logger[dev]). This issue has been resolved with 3.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nhairs/python-json-logger/security/advisories/GHSA-wmxh-pxcx-9w24 - https://github.com/nhairs/python-json-logger/commit/2548e3a2e3cedf6bef3ee7c60c55b7c02d1af11a - https://github.com/nhairs/python-json-logger/commit/e7761e56edb980cfab0165e32469d5fd017a5d72
CVE ID: CVE-2025-27608 State: PUBLISHED Published: 2025-04-02T21:09:16.943Z Last Updated: 2025-04-03T14:01:53.189Z Vendors: arduino Products: arduino-ide Problem Types: CWE-79 Description: Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vulnerability has been identified within the Arduino-IDE prior to version v2.3.5. The vulnerability occurs in the Additional Board Manager URLs field, which can be found in the Preferences -> Settings section of the Arduino IDE interface. In the vulnerable versions, any values entered in this field are directly displayed to the user through a notification tooltip object, without a proper ou
lues entered in this field are directly displayed to the user through a notification tooltip object, without a proper output encoding routine, due to the underlying ElectronJS engine interpretation. This vulnerability exposes the input parameter to Self-XSS attacks, which may lead to security risks depending on where the malicious payload is injected. This vulnerability is fixed in 2.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/arduino/arduino-ide/security/advisories/GHSA-252h-4j5q-88pc - https://github.com/arduino/arduino-ide/commit/d298b3ffc94008e89066cd999d891e84190da18f
CVE ID: CVE-2025-27609 State: PUBLISHED Published: 2025-03-26T16:10:19.223Z Last Updated: 2025-03-26T18:05:36.741Z Vendors: Icinga Products: icingaweb2 Problem Types: CWE-79 Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a request that, once transmitted to a victim's Icinga Web, allows to embed arbitrary Javascript into it and to act on behalf of that user. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings. Any
As a workaround, those who have Icinga Web 2.12.2 may enable a content security policy in the application settings. Any modern browser with a working CORS implementation also sufficiently guards against the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Icinga/icingaweb2/security/advisories/GHSA-5cjw-fwjc-8j38 - https://github.com/Icinga/icingaweb2/releases/tag/v2.11.5 - https://github.com/Icinga/icingaweb2/releases/tag/v2.12.3
CVE ID: CVE-2025-27610 State: PUBLISHED Published: 2025-03-10T22:19:25.982Z Last Updated: 2025-11-03T21:13:28.086Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: rack Products: rack Problem Types: CWE-23 Description: Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not corr
properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of `Rack::Static`, or ensuring that `root:` points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also miti
contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v - https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583
CVE ID: CVE-2025-27611 State: PUBLISHED Published: 2025-04-30T19:36:57.356Z Last Updated: 2025-05-01T18:49:22.814Z Vendors: cryptocoinjs Products: base-x Problem Types: CWE-1007 Description: base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cryptocoinjs/base-x/security/advisories/GHSA-xq7p-g2vc-g82p - https://github.com/cryptocoinjs/base-x/pull
s://github.com/cryptocoinjs/base-x/security/advisories/GHSA-xq7p-g2vc-g82p - https://github.com/cryptocoinjs/base-x/pull/86
CVE ID: CVE-2025-27612 State: PUBLISHED Published: 2025-03-21T14:24:28.756Z Last Updated: 2025-03-21T15:20:00.538Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: youki-dev Products: youki Problem Types: CWE-276 Description: libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for
mply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/youki-dev/youki/security/advisories/GHSA-5w4j-f78p-4wh9 - https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 - https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1 - https://github.com/youki-dev/youki/blob/9e63fa4da1672a
youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1 - https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408
CVE ID: CVE-2025-27613 State: PUBLISHED Published: 2025-07-10T14:58:16.752Z Last Updated: 2025-11-04T21:09:52.727Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: j6t Products: gitk Problem Types: CWE-78 Description: Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of w
ption is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/j6t/gitk/security/advisories/GHSA-f3cw-xrj3-wr2v - https://github.com/j6t/gitk/compare/465f03869ae11acd04abfa1b83c67879c867410c..026c397d911cde55924d7eb1311d0fd6e2e105d5 - https://github.com/j6t/gitk/compare/7dd272eca153058da2e8d5b9960bbbf0b4f0cbaa..67a128b91e25978a15f9f7e194d81b441d603652
CVE ID: CVE-2025-27614 State: PUBLISHED Published: 2025-07-10T15:02:25.947Z Last Updated: 2025-11-04T21:09:54.028Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: j6t Products: gitk Problem Types: CWE-78 Description: Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44
s a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/j6t/gitk/security/advisories/GHSA-g4v5-fjv9-mhhc - https://github.com/j6t/gitk/commit/8e3070aa5e331be45d4d03e3be41f84494fce129
CVE ID: CVE-2025-27615 State: PUBLISHED Published: 2025-03-10T18:47:59.819Z Last Updated: 2025-03-10T19:05:29.676Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: umati Products: umatiGateway Problem Types: CWE-200 Description: umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit 5d81a3412bc0051754a3095d89a06d6d743f2b16 uses `127.0.0.1:8080:8080` to limit access to the local network. For those who are unable to use this prop
06d6d743f2b16 uses `127.0.0.1:8080:8080` to limit access to the local network. For those who are unable to use this proposed patch, a firewall on Port 8080 may block remote access, but the workaround may not be perfect because Docker may also bypass a firewall by its iptable based rules for port forwarding. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umati/umatiGateway/security/advisories/GHSA-qf9w-x9qx-2mq7 - https://github.com/umati/umatiGateway/pull/101 - https://github.com/umati/umatiGateway/commit/5d81a3412bc0051754a3095d89a06d6d743f2b16 - https://github.com/umati/umatiGateway/blob/abe73096a17307327f0d6dc0ed4db1fb93464521/README.md?plain=1#L34-L35
CVE ID: CVE-2025-27616 State: PUBLISHED Published: 2025-03-10T18:56:14.537Z Last Updated: 2025-03-11T18:56:11.199Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: go-vela Products: server Problem Types: CWE-290, CWE-345 Description: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with a
itory. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x - https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5 - https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b - https://github.c
85894e239668584f5 - https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b - https://github.com/go-vela/server/releases/tag/v0.25.3 - https://github.com/go-vela/server/releases/tag/v0.26.3
CVE ID: CVE-2025-27617 State: PUBLISHED Published: 2025-03-11T15:35:51.895Z Last Updated: 2025-03-12T15:29:48.550Z Vendors: pimcore Products: pimcore Problem Types: CWE-89 Description: Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-qjpx-5m2p-5pgh - https://github.com/pimcore/pimcore/commit/19a8520895484e68fd254773e32476565d91deea - https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models
484e68fd254773e32476565d91deea - https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47 - https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347
CVE ID: CVE-2025-27622 State: PUBLISHED Published: 2025-03-05T22:33:34.766Z Last Updated: 2025-03-06T16:19:56.244Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3495
CVE ID: CVE-2025-27623 State: PUBLISHED Published: 2025-03-05T22:33:35.469Z Last Updated: 2025-03-06T16:18:41.555Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3496
CVE ID: CVE-2025-27624 State: PUBLISHED Published: 2025-03-05T22:33:36.141Z Last Updated: 2025-03-06T16:15:59.954Z Vendors: Jenkins Project Products: Jenkins Description: A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3498
CVE ID: CVE-2025-27625 State: PUBLISHED Published: 2025-03-05T22:33:36.808Z Last Updated: 2025-03-06T16:14:45.773Z Vendors: Jenkins Project Products: Jenkins Description: In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-03-05/#SECURITY-3501
CVE ID: CVE-2025-27631 State: PUBLISHED Published: 2025-03-25T12:46:08.184Z Last Updated: 2025-03-25T13:07:52.198Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Hitachi Energy Products: TRMTracker Problem Types: CWE-90 Description: The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-27632 State: PUBLISHED Published: 2025-03-25T12:37:30.114Z Last Updated: 2025-10-24T12:10:40.967Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Hitachi Energy Products: TRMTracker Problem Types: CWE-644 Description: A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-27633 State: PUBLISHED Published: 2025-03-25T12:40:37.667Z Last Updated: 2025-03-25T13:09:15.804Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Hitachi Energy Products: TRMTracker Problem Types: CWE-79 Description: The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to compromise the confidentiality and integrity of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-27636 State: PUBLISHED Published: 2025-03-09T12:09:58.619Z Last Updated: 2025-10-22T03:55:17.671Z Vendors: Apache Software Foundation Products: Apache Camel Problem Types: Bypass/Injection Description: Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel com