Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
erver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-532 Description: Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62208
CVE ID: CVE-2025-62209 State: PUBLISHED Published: 2025-11-11T17:59:45.904Z Last Updated: 2025-11-21T19:07:08.199Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607
erver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-532 Description: Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62209
CVE ID: CVE-2025-62210 State: PUBLISHED Published: 2025-11-11T17:59:28.905Z Last Updated: 2025-11-21T19:06:50.248Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Dynamics 365 Field Service (online) Problem Types: CWE-79 Description: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62210
CVE ID: CVE-2025-62211 State: PUBLISHED Published: 2025-11-11T17:59:46.977Z Last Updated: 2025-11-21T19:07:09.297Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Dynamics 365 Field Service (online) Problem Types: CWE-79 Description: Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62211
CVE ID: CVE-2025-62213 State: PUBLISHED Published: 2025-11-11T17:59:48.693Z Last Updated: 2025-11-21T19:07:10.906Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Cor
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416 Description: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ock allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62213
CVE ID: CVE-2025-62214 State: PUBLISHED Published: 2025-11-11T17:59:47.547Z Last Updated: 2025-11-21T19:07:09.852Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio 2022 version 17.14 Problem Types: CWE-77 Description: Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62214
CVE ID: CVE-2025-62215 State: PUBLISHED Published: 2025-11-11T17:59:48.205Z Last Updated: 2025-11-21T19:07:10.328Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-415 Description: Concurrent execution using shared
dows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-415 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215
CVE ID: CVE-2025-62216 State: PUBLISHED Published: 2025-11-11T17:59:29.420Z Last Updated: 2025-11-21T19:06:50.792Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024 Problem Types: CWE-416 Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62216
CVE ID: CVE-2025-62217 State: PUBLISHED Published: 2025-11-11T17:59:31.180Z Last Updated: 2025-11-21T19:06:52.552Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Cor
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevat
chronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62217
CVE ID: CVE-2025-62218 State: PUBLISHED Published: 2025-11-11T17:59:31.687Z Last Updated: 2025-11-21T19:06:53.160Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 10 Version 1607 Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnri
isioning System allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62218
CVE ID: CVE-2025-62219 State: PUBLISHED Published: 2025-11-11T17:59:32.270Z Last Updated: 2025-11-21T19:06:53.745Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 10 Version 1607 Problem Types: CWE-415, CWE-362 Description: Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerabi
ally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62219
CVE ID: CVE-2025-62220 State: PUBLISHED Published: 2025-11-11T17:59:32.750Z Last Updated: 2025-11-21T19:06:54.367Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Subsystem for Linux GUI Problem Types: CWE-122 Description: Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62220
CVE ID: CVE-2025-62222 State: PUBLISHED Published: 2025-11-11T17:59:49.273Z Last Updated: 2025-11-21T19:07:11.453Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio Code CoPilot Chat Extension Problem Types: CWE-77, CWE-20 Description: Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62222
CVE ID: CVE-2025-62225 State: PUBLISHED Published: 2025-11-05T06:19:44.575Z Last Updated: 2025-11-05T16:42:44.405Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Sony Corporation Products: Optical Disc Archive Software (for Windows) Problem Types: CWE-428 Description: Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sony.jp/oda/application/?srsltid=AfmBOoo8t7k-alQo7ZnV2MAhq8qfIJtFOJN41U2Tu-B1yr
Vulnrichment: References: - https://www.sony.jp/oda/application/?srsltid=AfmBOoo8t7k-alQo7ZnV2MAhq8qfIJtFOJN41U2Tu-B1yrpx3Y_KHurk - https://jvn.jp/en/jp/JVN81917433/
CVE ID: CVE-2025-62228 State: PUBLISHED Published: 2025-10-09T13:15:49.761Z Last Updated: 2025-11-04T21:14:15.721Z Vendors: Apache Software Foundation Products: Apache Flink CDC Problem Types: CWE-89 Description: Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/3dn0hc1wbc5sj0jbgdg33gtnwlw7qrl3
CVE ID: CVE-2025-62229 State: PUBLISHED Published: 2025-10-30T05:28:48.131Z Last Updated: 2025-11-25T10:23:05.687Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise L
Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http
ause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:19432 - https://access.redhat.com/errata/RHSA-2025:19433 - https://access.redhat.com/errata/RHSA-2025:19434 - https://access.redhat.com/errata/RHSA-2025:19435 - https://access.redhat.com/errata/RHSA-2025:19489 - https://access.redhat.com/errata/RHSA-2025:19623 - https://access.redhat.com/errata/RHSA-2025:19909 - https://access.redhat.com/errata/RHSA-2025:20958 - https://access.redhat.com/errata/RHSA-2025:20960 - https://access.redhat.com/errata/RHSA-2025:20961 - https://access.redhat.com/errata/RHSA-2025:21035 - https://access.redhat.c
://access.redhat.com/errata/RHSA-2025:20961 - https://access.redhat.com/errata/RHSA-2025:21035 - https://access.redhat.com/errata/RHSA-2025:22040 - https://access.redhat.com/errata/RHSA-2025:22041 - https://access.redhat.com/errata/RHSA-2025:22051 - https://access.redhat.com/errata/RHSA-2025:22055 - https://access.redhat.com/errata/RHSA-2025:22056 - https://access.redhat.com/security/cve/CVE-2025-62229 - https://bugzilla.redhat.com/show_bug.cgi?id=2402649
CVE ID: CVE-2025-62230 State: PUBLISHED Published: 2025-10-30T05:19:40.445Z Last Updated: 2025-11-25T10:23:09.039Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise L
Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:1943
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:19432 - https://access.redhat.com/errata/RHSA-2025:19433 - https://access.redhat.com/errata/RHSA-2025:19434 - https://access.redhat.com/errata/RHSA-2025:19435 - https://access.redhat.com/errata/RHSA-2025:19489 - https://access.redhat.com/errata/RHSA-2025:19623 - https://access.redhat.com/errata/RHSA-2025:19909 - https://access.redhat.com/errata/RHSA-2025:20958 - https://access.redhat.com/errata/RHSA-2025:20960 - https://access.redhat.com/errata/RHSA-2025:20961 - https://access.redhat.com/errata/RHSA-2025:21035 - https://access.redhat.com/errata/RHSA-2025:22040 - https://access.
- https://access.redhat.com/errata/RHSA-2025:21035 - https://access.redhat.com/errata/RHSA-2025:22040 - https://access.redhat.com/errata/RHSA-2025:22041 - https://access.redhat.com/errata/RHSA-2025:22051 - https://access.redhat.com/errata/RHSA-2025:22055 - https://access.redhat.com/errata/RHSA-2025:22056 - https://access.redhat.com/security/cve/CVE-2025-62230 - https://bugzilla.redhat.com/show_bug.cgi?id=2402653
CVE ID: CVE-2025-62231 State: PUBLISHED Published: 2025-10-30T05:08:32.155Z Last Updated: 2025-11-25T10:23:12.411Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise L
Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-190 Description: A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:19432 - https://ac
A ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:19432 - https://access.redhat.com/errata/RHSA-2025:19433 - https://access.redhat.com/errata/RHSA-2025:19434 - https://access.redhat.com/errata/RHSA-2025:19435 - https://access.redhat.com/errata/RHSA-2025:19489 - https://access.redhat.com/errata/RHSA-2025:19623 - https://access.redhat.com/errata/RHSA-2025:19909 - https://access.redhat.com/errata/RHSA-2025:20958 - https://access.redhat.com/errata/RHSA-2025:20960 - https://access.redhat.com/errata/RHSA-2025:20961 - https://access.redhat.com/errata/RHSA-2025:21035 - https://access.redhat.com/errata/RHSA-2025:22040 - https://access.redhat.com/err
ess.redhat.com/errata/RHSA-2025:21035 - https://access.redhat.com/errata/RHSA-2025:22040 - https://access.redhat.com/errata/RHSA-2025:22041 - https://access.redhat.com/errata/RHSA-2025:22051 - https://access.redhat.com/errata/RHSA-2025:22055 - https://access.redhat.com/errata/RHSA-2025:22056 - https://access.redhat.com/security/cve/CVE-2025-62231 - https://bugzilla.redhat.com/show_bug.cgi?id=2402660
CVE ID: CVE-2025-62232 State: PUBLISHED Published: 2025-10-31T08:48:23.592Z Last Updated: 2025-10-31T13:58:14.534Z Vendors: Apache Software Foundation Products: Apache APISIX Problem Types: CWE-532 Description: Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
ion 3.14, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/32hdgh570btfhg02hfc7p7ckf9v83259
CVE ID: CVE-2025-62236 State: PUBLISHED Published: 2025-10-23T19:31:15.979Z Last Updated: 2025-10-27T13:45:00.638Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Frontier Airlines Products: flyfrontier.com Problem Types: CWE-204 Description: The Frontier Airlines website has a publicly available endpoint that validates if an email addresses is associated with an account. An unauthenticated, remote attacker could determine valid email addresses, possibly aiding in further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2025-62236 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files
s: - https://www.cve.org/CVERecord?id=CVE-2025-62236 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-296-01.json
CVE ID: CVE-2025-62237 State: PUBLISHED Published: 2025-10-10T12:51:14.276Z Last Updated: 2025-10-10T13:25:17.194Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/co
CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62237
CVE ID: CVE-2025-62238 State: PUBLISHED Published: 2025-10-10T12:33:36.684Z Last Updated: 2025-10-10T13:29:10.623Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into a Account's “Name“ text field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabiliti
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62238