Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-35941 State: PUBLISHED Published: 2025-06-11T13:15:50.588Z Last Updated: 2025-06-11T13:53:40.299Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: mySCADA Products: myPRO Description: A password is exposed locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2025-18
CVE ID: CVE-2025-35963 State: PUBLISHED Published: 2025-11-11T16:51:13.753Z Last Updated: 2025-11-14T15:28:21.655Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi Software for Windows Problem Types: Denial of Service, CWE-691 Description: Insufficient control flow management for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requiremen
lexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01398.html
CVE ID: CVE-2025-35965 State: PUBLISHED Published: 2025-04-24T06:49:22.669Z Last Updated: 2025-04-24T13:06:59.413Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-770 Description: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
the server and leading to a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-35966 State: PUBLISHED Published: 2025-07-22T15:26:28.550Z Last Updated: 2025-11-03T19:54:01.471Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Bloomberg Products: Comdb2 Problem Types: CWE-476 Description: A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message handling of Bloomberg Comdb2 8.1. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.
ty. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2201
CVE ID: CVE-2025-35967 State: PUBLISHED Published: 2025-11-11T16:51:15.745Z Last Updated: 2025-11-14T15:28:16.249Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi Software for Windows Problem Types: Denial of Service, CWE-125 Description: Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are present wit
enable denial of service. This result may potentially occur via adjacent access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01398.html
CVE ID: CVE-2025-35968 State: PUBLISHED Published: 2025-11-11T16:51:17.351Z Last Updated: 2025-11-14T15:28:10.339Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Slim Bootloader Problem Types: Escalation of Privilege, CWE-693 Description: Protection mechanism failure in the UEFI firmware for the Slim Bootloader within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction
ia local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01395.html
CVE ID: CVE-2025-35970 State: PUBLISHED Published: 2025-08-07T05:22:09.768Z Last Updated: 2025-08-07T13:35:47.701Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SEIKO EPSON, FUJIFILM Corporation Products: Multiple EPSON product, FRONTIER DX400W Problem Types: CWE-1391 Description: On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If the administrator password is not changed from the initial one, a remote attacker with SNMP access can log in to the product with the administrator privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
in to the product with the administrator privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.epson.jp/support/misc_t/250807_oshirase.htm - https://global.fujifilm.com/en/news/hq/697e - https://jvn.jp/en/vu/JVNVU91363496/
CVE ID: CVE-2025-35971 State: PUBLISHED Published: 2025-11-11T16:51:20.477Z Last Updated: 2025-11-14T15:28:04.260Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi Software for Windows Problem Types: Denial of Service, CWE-787 Description: Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not presen
CVE ID: CVE-2025-35972 State: PUBLISHED Published: 2025-11-11T16:51:22.857Z Last Updated: 2025-11-13T04:55:16.983Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel MPI Library Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for the Intel MPI Library before version 2021.16 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requ
may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01386.html
CVE ID: CVE-2025-35975 State: PUBLISHED Published: 2025-05-01T18:25:27.593Z Last Updated: 2025-05-01T18:48:03.948Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MicroDicom Products: DICOM Viewer Problem Types: CWE-787 Description: MicroDicom DICOM Viewer is vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code. The user must open a malicious DCM file for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-121-01
CVE ID: CVE-2025-35978 State: PUBLISHED Published: 2025-06-12T06:05:00.260Z Last Updated: 2025-06-12T13:04:50.949Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Fujitsu Client Computing Limited Products: UpdateNavi, UpdateNaviInstallService Problem Types: CWE-923 Description: Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azby.fmworld
or arbitrary code may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azby.fmworld.net/support/security/information/updatenavi202506/ - https://jvn.jp/en/jp/JVN17860456/
CVE ID: CVE-2025-35980 State: REJECTED Published: N/A Last Updated: 2025-10-29T17:55:21.990Z Description: No description available.
CVE ID: CVE-2025-35981 State: PUBLISHED Published: 2025-10-23T03:37:36.498Z Last Updated: 2025-10-23T14:35:14.250Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Gallagher Products: Command Centre Server Problem Types: CWE-359 Description: Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-
3), 9.10.3194 (MR6). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-35981
CVE ID: CVE-2025-35983 State: PUBLISHED Published: 2025-07-10T03:09:11.847Z Last Updated: 2025-07-10T13:11:39.286Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: Gallagher Products: Controller 7000 Problem Types: CWE-295 Description: Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are connected. This issue affects Controller 7000: 9.30 prior to vCR9.30.250624a (distributed in 9.30.1871 (MR1)). Additional Analyst Notes:
issue affects Controller 7000: 9.30 prior to vCR9.30.250624a (distributed in 9.30.1871 (MR1)). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-35983
CVE ID: CVE-2025-35984 State: PUBLISHED Published: 2025-08-25T14:17:43.878Z Last Updated: 2025-11-03T18:09:24.987Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAIL Image Decoding Library Products: SAIL Image Decoding Library Problem Types: CWE-122 Description: A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decoding the image data from a specially crafted .pcx file, a heap-based buffer overflow can occur which allows for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnri
l need to convince the library to read a file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2217
CVE ID: CVE-2025-35995 State: PUBLISHED Published: 2025-05-07T22:04:10.575Z Last Updated: 2025-05-08T13:04:34.901Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-125 Description: When a BIG-IP PEM system is licensed with URL categorization, and the URL categorization policy or an iRule with the urlcat command is enabled on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K0001
not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000149952
CVE ID: CVE-2025-35996 State: PUBLISHED Published: 2025-05-01T18:42:50.035Z Last Updated: 2025-05-02T13:01:19.096Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: KUNBUS GmbH Products: Revolution Pi PiCtory Problem Types: CWE-97 Description: KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due to a missing escape or sanitization, the filename could be executed as HTML script tag resulting in a cross-site-scripting attack. Additional Analyst Notes: - CISA A
name could be executed as HTML script tag resulting in a cross-site-scripting attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01 - http://packages.revolutionpi.de/pool/main/p/pictory/
CVE ID: CVE-2025-36000 State: PUBLISHED Published: 2025-08-12T19:39:17.331Z Last Updated: 2025-08-12T19:46:11.373Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: WebSphere Application Server Liberty Problem Types: CWE-79 Description: IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages
in a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242026
CVE ID: CVE-2025-36002 State: PUBLISHED Published: 2025-10-16T14:54:53.914Z Last Updated: 2025-10-25T02:02:53.477Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Sterling B2B Integrator, Sterling File Gateway Problem Types: CWE-260 Description: IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5, and 6.2.1.0 stores user credentials in configuration files which can be read by a local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7248129
CVE ID: CVE-2025-36003 State: PUBLISHED Published: 2025-08-28T02:07:51.600Z Last Updated: 2025-08-28T14:18:52.198Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Governance Identity Manager Problem Types: CWE-209 Description: IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7243303
CVE ID: CVE-2025-36004 State: PUBLISHED Published: 2025-06-25T02:32:40.332Z Last Updated: 2025-08-24T11:41:24.587Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: i Problem Types: CWE-427 Description: IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237732
CVE ID: CVE-2025-36005 State: PUBLISHED Published: 2025-07-24T14:52:53.238Z Last Updated: 2025-08-17T01:24:38.369Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: MQ Operator Problem Types: CWE-295 Description: IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
ame and port due to improper certificate validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240431
CVE ID: CVE-2025-36006 State: PUBLISHED Published: 2025-11-07T19:04:05.595Z Last Updated: 2025-11-07T19:15:29.778Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 Problem Types: CWE-404 Description: IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources after use. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250479
CVE ID: CVE-2025-36007 State: PUBLISHED Published: 2025-10-27T18:40:16.046Z Last Updated: 2025-10-28T03:56:06.382Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-266 Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update script. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249277
CVE ID: CVE-2025-36008 State: PUBLISHED Published: 2025-11-07T18:57:09.615Z Last Updated: 2025-11-07T19:10:03.557Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 Problem Types: CWE-770 Description: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250482
CVE ID: CVE-2025-36010 State: PUBLISHED Published: 2025-07-29T18:13:20.677Z Last Updated: 2025-07-29T18:29:45.192Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 Problem Types: CWE-833 Description: IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240951
CVE ID: CVE-2025-36011 State: PUBLISHED Published: 2025-09-09T19:32:16.786Z Last Updated: 2025-09-10T13:59:38.169Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: IBM Products: Jazz for Service Management Problem Types: CWE-614 Description: IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. Additional Analyst Notes: - CISA A
ecure link and the attacker can then obtain the cookie value by snooping the traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244357
CVE ID: CVE-2025-36014 State: PUBLISHED Published: 2025-07-07T16:15:53.537Z Last Updated: 2025-08-24T11:31:56.048Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Integration Bus Problem Types: CWE-94 Description: IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vulnerable to code injection by a privileged user with access to the IIB install directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239003
CVE ID: CVE-2025-36016 State: PUBLISHED Published: 2025-06-21T12:38:18.175Z Last Updated: 2025-08-24T11:43:03.984Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: IBM Products: Process Mining Problem Types: CWE-601 Description: IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further att
would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237502
CVE ID: CVE-2025-36020 State: PUBLISHED Published: 2025-08-06T14:28:45.780Z Last Updated: 2025-10-22T18:48:49.556Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Guardium Data Protection Problem Types: CWE-319 Description: IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7241547
CVE ID: CVE-2025-36023 State: PUBLISHED Published: 2025-08-08T14:51:12.631Z Last Updated: 2025-08-08T15:07:16.477Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cloud Pak for Business Automation Problem Types: CWE-639 Description: IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7241570