Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22388 State: PUBLISHED Published: 2025-01-04T00:00:00 Last Updated: 2025-01-06T15:11:11.504Z Vendors: n/a Products: n/a Problem Types: CWE-79 Description: An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or executing unauthorized actions. The issue exists in multiple areas, including content editing, link management, and file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/
file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/33182047260557-Content-Management-System-CMS-Security-Advisory-CMS-2025-01
CVE ID: CVE-2025-22389 State: PUBLISHED Published: 2025-01-04T00:00:00.000Z Last Updated: 2025-02-11T21:15:13.071Z Vendors: n/a Products: n/a Problem Types: CWE-434 Description: An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by application users, these files can be used to execute malicious actions or compromise users' systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/33182404079629-Co
Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/33182404079629-Content-Management-System-CMS-Security-Advisory-CMS-2025-03
CVE ID: CVE-2025-22390 State: PUBLISHED Published: 2025-01-04T00:00:00 Last Updated: 2025-01-06T16:59:45.286Z Vendors: n/a Products: n/a Problem Types: CWE-521 Description: An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length of 6 characters, lacking adequate complexity to resist modern attack techniques such as password spraying or offline password cracking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/33182255281293-C
Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/33182255281293-Content-Management-System-CMS-Security-Advisory-CMS-2025-02
CVE ID: CVE-2025-22391 State: PUBLISHED Published: 2025-11-11T16:49:38.822Z Last Updated: 2025-11-12T20:02:07.248Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: SigTest Problem Types: Escalation of Privilege, CWE-284 Description: Improper access control for some SigTest before version 6.1.10 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user inte
r via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01327.html
CVE ID: CVE-2025-22392 State: PUBLISHED Published: 2025-08-12T16:58:31.331Z Last Updated: 2025-08-12T20:51:19.701Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) AMT and Intel(R) Standard Manageability Problem Types: Information Disclosure, CWE-125 Description: Out-of-bounds read in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclosure via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01280.html
CVE ID: CVE-2025-22394 State: PUBLISHED Published: 2025-01-15T04:41:21.868Z Last Updated: 2025-01-15T15:06:01.782Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Display Manager Problem Types: CWE-367 Description: Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to code execution and possibly privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000267927/dsa-2025-033
CVE ID: CVE-2025-22395 State: PUBLISHED Published: 2025-01-07T02:52:54.624Z Last Updated: 2025-01-07T15:42:03.579Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Dell Products: Dell Update Package (DUP) Framework Problem Types: CWE-280 Description: Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server. Exploitation may lead to a denial of service by an attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbd
ervice by an attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000269079/dsa-2025-034-security-update-for-dell-update-package-dup-framework-vulnerability
CVE ID: CVE-2025-22397 State: PUBLISHED Published: 2025-11-06T18:46:04.736Z Last Updated: 2025-11-06T19:30:39.315Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H) Vendors: Dell Products: Integrated Dell Remote Access Controller 9 14G Versions, Integrated Dell Remote Access Controller 9 15G and 16G versions, Integrated Dell Remote Access Controller 10 17G version Problem Types: CWE-22 Description: Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Re
Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000384516/dsa-2025-376-security-update-for-dell-idrac9-and-idrac10-vulnerabilities
CVE ID: CVE-2025-22398 State: PUBLISHED Published: 2025-03-28T01:41:00.767Z Last Updated: 2025-03-29T03:55:39.895Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution as root. Exploitation may lead to a system take over by an attacker. This vulnerability is considered critical as it can be leveraged to completely comprom
system take over by an attacker. This vulnerability is considered critical as it can be leveraged to completely compromise the operating system. Dell recommends customers to upgrade at the earliest opportunity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2025-22399 State: PUBLISHED Published: 2025-02-11T16:24:14.370Z Last Updated: 2025-02-12T20:51:44.884Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L) Vendors: Dell Products: UCC Edge Problem Types: CWE-918 Description: Dell UCC Edge, version 2.3.0, contains a Blind SSRF on Add Customer SFTP Server vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Server-side request forgery Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000279299/dsa-2025-043-security-update-for-dell-ucc-edge-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2025-22402 State: PUBLISHED Published: 2025-02-07T02:08:13.226Z Last Updated: 2025-02-07T15:58:21.702Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Dell Products: Update Manager Plugin Problem Types: CWE-80 Description: Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000281885/dsa-2025-047-security-updat
s: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000281885/dsa-2025-047-security-update-for-dell-update-manager-plugin-vulnerability
CVE ID: CVE-2025-22403 State: PUBLISHED Published: 2025-08-26T22:48:47.884Z Last Updated: 2025-08-27T14:02:45.076Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/37bcf769c1aa8dfa8e5524858d47f6a80b765fa4 - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22404 State: PUBLISHED Published: 2025-08-26T22:48:48.900Z Last Updated: 2025-08-27T14:03:32.350Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22405 State: PUBLISHED Published: 2025-08-26T22:48:49.898Z Last Updated: 2025-08-27T14:04:14.835Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22406 State: PUBLISHED Published: 2025-08-26T22:48:50.898Z Last Updated: 2025-08-27T14:04:40.863Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22407 State: PUBLISHED Published: 2025-08-26T22:48:51.907Z Last Updated: 2025-08-27T14:05:40.268Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22408 State: PUBLISHED Published: 2025-08-26T22:48:52.916Z Last Updated: 2025-08-27T14:06:11.523Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22409 State: PUBLISHED Published: 2025-08-26T22:48:53.937Z Last Updated: 2025-08-28T03:55:15.949Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22410 State: PUBLISHED Published: 2025-08-26T22:48:54.927Z Last Updated: 2025-08-27T14:07:44.512Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22411 State: PUBLISHED Published: 2025-08-26T22:48:55.939Z Last Updated: 2025-08-28T03:55:17.571Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2
m/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22412 State: PUBLISHED Published: 2025-08-26T22:48:56.963Z Last Updated: 2025-08-28T03:55:18.731Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22413 State: PUBLISHED Published: 2025-08-26T22:48:57.984Z Last Updated: 2025-08-27T14:12:23.366Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/kernel/common/+/1a3366f0d3d9b94a8c025d9863edc3b427435c4c - https://android.googlesource.com/kernel/common/+/add3d68602a0c48ed2d5659f0cf26d869776a
3d9b94a8c025d9863edc3b427435c4c - https://android.googlesource.com/kernel/common/+/add3d68602a0c48ed2d5659f0cf26d869776ab35 - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-22414 State: PUBLISHED Published: 2025-09-04T19:23:53.589Z Last Updated: 2025-09-09T03:55:15.695Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/wear/2025-03-01
CVE ID: CVE-2025-22415 State: PUBLISHED Published: 2025-09-04T19:23:54.678Z Last Updated: 2025-09-09T03:55:16.522Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In android_app of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/wear/2025-03-01
CVE ID: CVE-2025-22416 State: PUBLISHED Published: 2025-09-02T22:11:08.649Z Last Updated: 2025-09-04T03:55:41.713Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/82aa8527b7da3dbbc2f19c869b4ded106e140452 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22417 State: PUBLISHED Published: 2025-09-02T22:11:09.648Z Last Updated: 2025-09-04T03:55:39.352Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/89e32320207c1f332dd84024a13b001320d8c63d - https://source.android.com/security/bulletin/2025-0
latform/frameworks/base/+/89e32320207c1f332dd84024a13b001320d8c63d - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22418 State: PUBLISHED Published: 2025-09-02T22:11:10.628Z Last Updated: 2025-09-04T03:55:29.562Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/ad9fb985df470bed5f77da4701f2aebe45af5ff3 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22419 State: PUBLISHED Published: 2025-09-02T22:11:11.657Z Last Updated: 2025-09-04T03:55:27.424Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/services/Telephony/+/92f47baf4505e474376c0550e8b8cd25d19e74e2 - https://source.android.com/security/b
/platform/packages/services/Telephony/+/92f47baf4505e474376c0550e8b8cd25d19e74e2 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22421 State: PUBLISHED Published: 2025-09-02T22:11:12.659Z Last Updated: 2025-09-03T15:52:01.349Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/3b0704fd381a1ea32591aba99be3a9e4e6830be2 - https://source.a
https://android.googlesource.com/platform/frameworks/base/+/3b0704fd381a1ea32591aba99be3a9e4e6830be2 - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-22422 State: PUBLISHED Published: 2025-09-02T22:11:13.645Z Last Updated: 2025-09-04T03:55:40.611Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/6894ba3da6da99eb0ef63d95bf1b19080d302e
chment: References: - https://android.googlesource.com/platform/frameworks/base/+/6894ba3da6da99eb0ef63d95bf1b19080d302eda - https://android.googlesource.com/platform/packages/apps/Settings/+/1c0ab9c696d736da0176aa00f7effa31c905430e - https://source.android.com/security/bulletin/2025-04-01