Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-34323 State: PUBLISHED Published: 2025-11-17T17:48:28.973Z Last Updated: 2025-11-24T20:10:07.298Z Vendors: Nagios Products: Log Server Problem Types: CWE-732 Description: Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The 'www-data' user is a member of the 'nagios' group, which has write access to '/usr/local/nagioslogserver/scripts', while several scripts in this directory are owned by root and may be executed via sudo without a password. A local attacker running as 'www-data' can move one of these root-owned scripts to a backup name and cre
out a password. A local attacker running as 'www-data' can move one of these root-owned scripts to a backup name and create a replacement script with attacker-controlled content at the original path, then invoke it with sudo. This allows arbitrary commands to be executed with root privileges, providing full compromise of the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#log-server - https://www.nagios.com/changelog/nagios-log-server/nagios-log-server-2026r1-0-1/ - https://www.vulncheck.com/advisories/nagios-log-server-local-privilege-escalation-via-writable-scripts-and-sudo-rules
CVE ID: CVE-2025-34324 State: PUBLISHED Published: 2025-11-18T16:33:05.469Z Last Updated: 2025-11-18T18:24:11.777Z Vendors: Tinexta InfoCert S.p.A. Products: GoSign Desktop Problem Types: CWE-347 Description: GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates. The manifest contains package URLs and SHA-256 hashes but is not digitally signed, so its authenticity relies solely on the underlying TLS channel. In affected versions, TLS certificate validation can be disabled when a proxy is configured, allowing an attacker who can intercept network traffic to supply a malicious update manifest and corresponding package with a matching has
er who can intercept network traffic to supply a malicious update manifest and corresponding package with a matching hash. This can cause the client to download and install a tampered update, resulting in arbitrary code execution with the privileges of the GoSign Desktop user on Windows and macOS, or with elevated privileges on some Linux deployments. A local attacker who can modify proxy settings may also abuse this behavior to escalate privileges by forcing installation of a crafted update. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ush.it/2025/11/14/multiple-vulnerabilities-gosign-desktop-remote-code-execution/ - https://infocert.digital/consumer/gosign-s
t/2025/11/14/multiple-vulnerabilities-gosign-desktop-remote-code-execution/ - https://infocert.digital/consumer/gosign-suite/ - https://www.vulncheck.com/advisories/gosign-desktop-insecure-update-mechanism-rce - https://www.ush.it/2025/11/14/vulnerabilita-multiple-gosign-desktop-esecuzione-remota-codice-arbitrario/
CVE ID: CVE-2025-34328 State: PUBLISHED Published: 2025-11-19T16:22:22.648Z Last Updated: 2025-11-20T15:21:16.416Z Vendors: AudioCodes Limited Products: AudioCodes Fax/IVR Appliance Problem Types: CWE-434 Description: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplied data directly to a server-side file path under the privileges of the web service account, which runs as NT AUTHORITY\\SYSTEM on Windows deployments. A remote, unauthenticated attac
s of the web service account, which runs as NT AUTHORITY\\SYSTEM on Windows deployments. A remote, unauthenticated attacker can write arbitrary files into the product’s web-accessible directory structure and subsequently execute them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf - https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-unauthenticated-file-upload-rce-via-ajaxscript
CVE ID: CVE-2025-34329 State: PUBLISHED Published: 2025-11-19T16:23:09.072Z Last Updated: 2025-11-20T15:21:16.647Z Vendors: AudioCodes Limited Products: AudioCodes Fax/IVR Appliance Problem Types: CWE-434 Description: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates the directory if it does not exist, and then moves an uploaded file to that location using the attacker-controlled filename, without any authentication, authorization, or file-type vali
le to that location using the attacker-controlled filename, without any authentication, authorization, or file-type validation. On default Windows deployments where the backup directory resolves to the system drive, a remote attacker can upload web server or interpreter configuration files that cause a log file or other server-controlled resource to be treated as executable code. This allows subsequent HTTP requests to trigger arbitrary command execution under the web server account, which runs as NT AUTHORITY\\SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr
rences: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf - https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-unauthenticated-backup-upload-rce-via-ajaxbackupuploadfile
CVE ID: CVE-2025-34330 State: PUBLISHED Published: 2025-11-19T16:22:02.448Z Last Updated: 2025-11-20T15:21:16.834Z Vendors: AudioCodes Limited Products: AudioCodes Fax/IVR Appliance Problem Types: CWE-434 Description: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated prompt upload endpoint at AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file and writes it into the C:\\F2MAdmin\\tmp directory using a filename derived from application constants, without any authentication, authorization, or file-type validation. A remote, una
me derived from application constants, without any authentication, authorization, or file-type validation. A remote, unauthenticated attacker can upload or overwrite prompt- or music-on-hold–related files in this directory, potentially leading to tampering with IVR audio content or preparing files for use in further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf - https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com
-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-unauthenticated-prompt-file-upload-via-ajaxpromptuploadfile
CVE ID: CVE-2025-34331 State: PUBLISHED Published: 2025-11-19T16:22:50.648Z Last Updated: 2025-11-20T15:21:17.005Z Vendors: AudioCodes Limited Products: AudioCodes Fax/IVR Appliance Problem Types: CWE-306 Description: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint exposes a file download mechanism that lacks access control, allowing remote, unauthenticated users to request files stored on the appliance based solely on attacker-supplied path and filename parameters. While limited to specific file extensions permitted by the application logic, sensitive back
th and filename parameters. While limited to specific file extensions permitted by the application logic, sensitive backup archives can be retrieved, exposing internal databases and credential hashes. Successful exploitation may lead to disclosure of administrative password hashes and other sensitive configuration data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf - https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com/advi
lnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-unauthenticated-file-read-via-download
CVE ID: CVE-2025-34332 State: PUBLISHED Published: 2025-11-19T16:23:27.747Z Last Updated: 2025-11-20T15:21:17.176Z Vendors: AudioCodes Limited Products: AudioCodes Fax/IVR Appliance Problem Types: CWE-276 Description: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are requested through ajaxPost.php, these scripts are invoked by PHP using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authentic
P using system() under the NT AUTHORITY\\SYSTEM account. The batch files in this directory are writable by any authenticated local user due to overly permissive ACLs, allowing them to replace script contents with arbitrary commands. On the next service start/stop operation, the modified script is executed as SYSTEM, enabling elevation of local privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf - https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.
g/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-insecure-service-control-scripts-lpe
CVE ID: CVE-2025-34333 State: PUBLISHED Published: 2025-11-19T16:21:42.943Z Last Updated: 2025-11-20T15:21:17.350Z Vendors: AudioCodes Limited Products: AudioCodes Fax/IVR Appliance Problem Types: CWE-276 Description: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runs as NT AUTHORITY\\SYSTEM. As a result, any local user can create or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to e
ate or alter server-side scripts within the webroot and then trigger them via HTTP requests, causing arbitrary code to execute with SYSTEM privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf - https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-world-writable-webroot-lpe
CVE ID: CVE-2025-34334 State: PUBLISHED Published: 2025-11-19T16:23:47.140Z Last Updated: 2025-11-20T15:21:17.531Z Vendors: AudioCodes Limited Products: AudioCodes Fax/IVR Appliance Problem Types: CWE-78 Description: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax "send" test is requested, the application builds a faxsender command line using attacker-supplied parameters and passes it to GlobalUtils::RunBatchFile without proper validation or shell-argument sanitization. The resulting batch file is written into a
Utils::RunBatchFile without proper validation or shell-argument sanitization. The resulting batch file is written into a temporary run directory and then executed via a backend service that runs as NT AUTHORITY\\SYSTEM. An authenticated attacker with access to the fax test interface can craft parameter values that inject additional shell commands into the generated batch file, leading to arbitrary command execution with SYSTEM privileges. In addition, because the generated batch files reside in a location with overly permissive file system permissions, a local low-privilege user on the server can modify pending batch files to achieve the same elevation. Additional Analyst Notes: - CISA ADP V
user on the server can modify pending batch files to achieve the same elevation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf - https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-authenticated-command-injection-via-testfax-and-lpe
CVE ID: CVE-2025-34335 State: PUBLISHED Published: 2025-11-19T16:24:06.313Z Last Updated: 2025-11-21T00:47:51.692Z Vendors: AudioCodes Limited Products: AudioCodes Fax/IVR Appliance Problem Types: CWE-78 Description: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. When a license file is uploaded, the application derives a new filename by combining a generated base name with the attacker-controlled extension portion of the original upload name, then constructs a command line for fax_server_lic_cmdline.exe that i
lled extension portion of the original upload name, then constructs a command line for fax_server_lic_cmdline.exe that includes this path. The extension value is incorporated into the command string without input validation, escaping, or proper argument quotation before being passed to exec(). An authenticated user with access to the license upload interface can supply a specially crafted filename whose extension injects additional shell metacharacters, causing arbitrary commands to be executed as NT AUTHORITY\\SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr
rences: - https://www.audiocodes.com/media/g1in2u2o/0548-product-notice-end-of-service-for-audiocodes-auto-attendant-ivr-solution.pdf - https://pierrekim.github.io/blog/2025-11-20-audiocodes-fax-ivr-8-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-audiocodes-fax-ivr.txt - https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-authenticated-command-injection-via-activatelicense
CVE ID: CVE-2025-34336 State: PUBLISHED Published: 2025-11-19T16:20:26.996Z Last Updated: 2025-11-19T16:48:16.629Z Vendors: eGovFramework/egovframe-common-components Products: eGovFramework/egovframe-common-components Problem Types: CWE-434 Description: eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do image upload endpoints. These controllers accept multipart requests without authentication, pass the uploaded content to a shared upload helper, and store the file on the server under a framework-controlled path. The framework then returns a download URL
ad helper, and store the file on the server under a framework-controlled path. The framework then returns a download URL that can be used to retrieve the uploaded content, including an attacker-controlled Content-Type within the limits of the image upload functionality. While a filename extension whitelist is enforced, the attacker fully controls the file contents. The response MIME type used is also attacker-controlled when the file is served up to version < 4.1.2. Since version 4.1.2, it is possible to download any image uploaded with any whitelisted content type. But any file uploaded other than an image will be served with the `application/octet-stream` content type (the content type is
file uploaded other than an image will be served with the `application/octet-stream` content type (the content type is no longer controlled by the attacker since version 4.1.2). This enables an unauthenticated attacker to use any affected application as a persistent file hosting service for arbitrary content under the application's origin. KISA/KrCERT has identified this unpatched vulnerability as "KVE-2023-5280." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.egovframe.go.kr/eng/sub.do?menuNo=2 - https://github.com/eGovFramework/egovframe-common-components - https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html - https://pierrekim.github
mon-components - https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-egovframe.txt - https://www.vulncheck.com/advisories/egovframework-unauthenticated-file-upload-via-web-editor-image-upload-endpoints
CVE ID: CVE-2025-34337 State: PUBLISHED Published: 2025-11-19T16:20:03.260Z Last Updated: 2025-11-19T16:48:21.903Z Vendors: eGovFramework/egovframe-common-components Products: eGovFramework/egovframe-common-components Problem Types: CWE-345 Description: eGovFramework/egovframe-common-components versions up to and including 4.3.1 includes Web Editor image upload and related file delivery functionality that uses symmetric encryption to protect URL parameters, but exposes an encryption oracle that allows attackers to generate valid ciphertext for chosen values. The image upload endpoints /utl/wed/insertImage.do and /utl/wed/insertImageCk.do encrypt server-side paths, filenames, and MIME types a
d endpoints /utl/wed/insertImage.do and /utl/wed/insertImageCk.do encrypt server-side paths, filenames, and MIME types and embed them directly into a download URL that is returned to the client. Because these same encrypted parameters are trusted by other endpoints, such as /utl/web/imageSrc.do and /cmm/fms/getImage.do, an unauthenticated attacker can abuse the upload functionality to obtain encrypted representations of attacker-chosen identifiers and then replay those ciphertext values to file-serving APIs. This design failure allows an attacker to bypass access controls that rely solely on the secrecy of encrypted parameters and retrieve arbitrary stored files that are otherwise expected t
hat rely solely on the secrecy of encrypted parameters and retrieve arbitrary stored files that are otherwise expected to require an existing session or specific authorization context. KISA/KrCERT has identified this unpatched vulnerability as "KVE-2023-5281." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.egovframe.go.kr/eng/sub.do?menuNo=2 - https://github.com/eGovFramework/egovframe-common-components - https://pierrekim.github.io/blog/2025-11-20-egovframe-2-vulnerabilities.html - https://pierrekim.github.io/advisories/2025-egovframe.txt - https://www.vulncheck.com/advisories/egovframework-unauthenticated-encryption-oracle-via-web-editor-image-upload-endpoints
CVE ID: CVE-2025-34489 State: PUBLISHED Published: 2025-04-28T18:50:26.043Z Last Updated: 2025-11-19T01:26:23.590Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GFI Products: MailEssentials Problem Types: CWE-502 Description: GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html - https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/d
/04/28/mailessentials.html - https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases - https://www.vulncheck.com/advisories/gfi-mailessentials-local-privilege-escalation
CVE ID: CVE-2025-34490 State: PUBLISHED Published: 2025-04-28T19:02:03.532Z Last Updated: 2025-11-19T01:26:14.676Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GFI Products: MailEssentials Problem Types: CWE-611 Description: GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html - https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/produc
ls.html - https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases - https://www.vulncheck.com/advisories/gfi-mailessentials-xxe-arbitrary-file-read
CVE ID: CVE-2025-34491 State: PUBLISHED Published: 2025-04-28T19:20:02.027Z Last Updated: 2025-11-19T01:25:57.239Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GFI Products: MailEssentials Problem Types: CWE-502 Description: GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET when joining to a Multi-Server setup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html - https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/re
free/2025/04/28/mailessentials.html - https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases - https://www.vulncheck.com/advisories/gfi-mailessentials-multinode-insecure-deserialization
CVE ID: CVE-2025-34500 State: PUBLISHED Published: 2025-10-24T23:02:29.851Z Last Updated: 2025-10-27T15:21:02.916Z Vendors: Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Products: Deck Mate 2 Problem Types: CWE-321, CWE-327, CWE-347 Description: Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and uses a truncated HMAC for integrity validation. Attackers with access to the update interface - typically via the unit's USB update port - can craft or modify firmware packages to execute arbitrary code as root, allowing persistent compromise of the de