Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-62422 State: PUBLISHED Published: 2025-10-17T17:11:06.756Z Last Updated: 2025-10-17T18:12:21.706Z Vendors: dataease Products: dataease Problem Types: CWE-89 Description: DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in version 2.10.14. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-54m5-xrw4-mv36 - https://github.com/dataease/
eferences: - https://github.com/dataease/dataease/security/advisories/GHSA-54m5-xrw4-mv36 - https://github.com/dataease/dataease/commit/3c52cc26c4cca1000294346cf99a84b25d38bfb2
CVE ID: CVE-2025-62423 State: PUBLISHED Published: 2025-10-16T18:40:44.069Z Last Updated: 2025-10-17T14:30:22.271Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: MacWarrior Products: clipbucket-v5 Problem Types: CWE-89 Description: ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “/admin_area/login_as_user.php” file. Exploiting this vulnerability requires access privileges to the Admin Area. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3wpr-jprj-52fc - https://gi
richment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3wpr-jprj-52fc - https://github.com/MacWarrior/clipbucket-v5/commit/b3bf27e367f318c2afe9bd11368be9d00e272148
CVE ID: CVE-2025-62424 State: PUBLISHED Published: 2025-10-17T17:23:27.596Z Last Updated: 2025-10-17T17:35:28.377Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: MacWarrior Products: clipbucket-v5 Problem Types: CWE-22 Description: ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - #146 and earlier, the /admin_area/template_editor.php endpoint is vulnerable to path traversal. The validation of the file-loading path is inadequate, allowing authenticated administrators to read and write arbitrary files outside the intended template directory by inserting path traversal sequences into the folder parameter. An attacker with administ
e intended template directory by inserting path traversal sequences into the folder parameter. An attacker with administrator privileges can exploit this vulnerability to read sensitive files such as /etc/passwd and modify writable files on the system, potentially leading to sensitive information disclosure and compromise of the application or server. This issue is fixed in version 5.5.2 - #147. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3v2p-rfwx-52qj - https://github.com/MacWarrior/clipbucket-v5/commit/c06d0f2e69c9acb008cebbd34fd5f29da3191a28
CVE ID: CVE-2025-62425 State: PUBLISHED Published: 2025-10-16T18:44:02.616Z Last Updated: 2025-10-16T19:34:11.777Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: element-hq Products: matrix-authentication-service Problem Types: CWE-620 Description: MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to an authenticated MAS session to perform sensitive operations without entering the current password. These include changing the current password, adding or removing an e-mail
ations without entering the current password. These include changing the current password, adding or removing an e-mail address and deactivating the account. The vulnerability only affects instances which have the local password database feature enabled (passwords section in the config). Patched in matrix-authentication-service 1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/matrix-authentication-service/security/advisories/GHSA-6wfp-jq3r-j9xh - https://github.com/element-hq/matrix-authentication-service/commit/bce99edb6177be11f8f38c1d01f5606ce7b4b2e5
CVE ID: CVE-2025-62426 State: PUBLISHED Published: 2025-11-21T01:21:29.546Z Last Updated: 2025-11-24T18:12:23.183Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-770 Description: vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints allow a chat_template_kwargs request parameter that is used in the code before it is properly validated against the chat template. With the right chat_template_kwargs parameters, it is possible to block processing of the API server for long periods of time, delaying all other re
_kwargs parameters, it is possible to block processing of the API server for long periods of time, delaying all other requests. This issue has been patched in version 0.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-69j4-grxj-j64p - https://github.com/vllm-project/vllm/pull/27205 - https://github.com/vllm-project/vllm/commit/3ada34f9cb4d1af763fdfa3b481862a93eb6bd2b - https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/chat_utils.py#L1602-L1610 - https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/openai/serving_e
0 - https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/openai/serving_engine.py#L809-L814
CVE ID: CVE-2025-62427 State: PUBLISHED Published: 2025-10-16T18:50:11.598Z Last Updated: 2025-10-17T13:24:15.389Z Vendors: angular Products: angular-cli Problem Types: CWE-918 Description: The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr) before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestUrl uses the native URL constructor. When an incoming request path (e.g., originalUrl or url) begins with a double forward slash (//) or backslash (\\), the URL constructor treats it as a schema-relative URL. T
rl) begins with a double forward slash (//) or backslash (\\), the URL constructor treats it as a schema-relative URL. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via DOCUMENT or PlatformLocation tokens) to this attacker-controlled domain. Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will
Any subsequent relative HTTP requests made during the SSR process (e.g., using HttpClient.get('assets/data.json')) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint. This vulnerability is fixed in 19.2.18, 20.3.6, and 21.0.0-next.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr - https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb
CVE ID: CVE-2025-62428 State: PUBLISHED Published: 2025-10-16T18:57:14.114Z Last Updated: 2025-10-17T14:28:00.593Z Vendors: Drawing-Captcha Products: Drawing-Captcha-APP Problem Types: CWE-601 Description: Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /confirm-email endpoints. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation links. These links can redirect users to attacker-controlled domains. This vulnerability affects all users relying on email confirmation for account registration or verification. This vulnerability is
rability affects all users relying on email confirmation for account registration or verification. This vulnerability is fixed in 1.2.5-alpha-patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Drawing-Captcha/Drawing-Captcha-APP/security/advisories/GHSA-5pj8-fc6g-vv7m - https://github.com/Drawing-Captcha/Drawing-Captcha-APP/issues/30
CVE ID: CVE-2025-62429 State: PUBLISHED Published: 2025-10-20T16:08:02.621Z Last Updated: 2025-10-20T18:39:41.953Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MacWarrior Products: clipbucket-v5 Problem Types: CWE-94 Description: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP tags and executed. Proper sanitization is not performed, and by injecting malicious code an attacker can execute arbitrary PHP code. This allows an attacker to achieve RCE. This
nd by injecting malicious code an attacker can execute arbitrary PHP code. This allows an attacker to achieve RCE. This issue has been resolved in version 5.5.2 #147. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3x4g-x3gv-rjmq - https://github.com/MacWarrior/clipbucket-v5/commit/e81bac602c871bb1ad971884003a3a496a2ab50b - https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23147
CVE ID: CVE-2025-62430 State: PUBLISHED Published: 2025-10-17T17:50:23.507Z Last Updated: 2025-10-17T18:06:43.096Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: MacWarrior Products: clipbucket-v5 Problem Types: CWE-79 Description: ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and photo metadata fields. For videos the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos accept user supplied values without adequate sanitization. For photos the Photo Title and Photo Tags fields accept user supplied values wit
d values without adequate sanitization. For photos the Photo Title and Photo Tags fields accept user supplied values without adequate sanitization. A regular user who can edit a video or photo can inject script (for example by supplying a value such as a closing delimiter followed by a script element). The injected script executes when any user, including an unauthenticated visitor or an administrator, views the affected video or photo page. Although cookies are set with the HttpOnly attribute and cannot be read directly, the injected script can issue fetch requests to endpoints such as admin_area pages and exfiltrate their contents or trigger unintended actions. Version 5.5.2 build #146 and
oints such as admin_area pages and exfiltrate their contents or trigger unintended actions. Version 5.5.2 build #146 and later contain a fix. Update to build 5.5.2 #146 or later. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-qrqq-hpf3-9mc9 - https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc
CVE ID: CVE-2025-62440 State: REJECTED Published: N/A Last Updated: 2025-10-15T02:55:08.891Z Description: No description available.
CVE ID: CVE-2025-62441 State: REJECTED Published: N/A Last Updated: 2025-10-15T02:55:08.299Z Description: No description available.
CVE ID: CVE-2025-62442 State: REJECTED Published: N/A Last Updated: 2025-10-15T02:55:07.696Z Description: No description available.
CVE ID: CVE-2025-62443 State: REJECTED Published: N/A Last Updated: 2025-10-15T02:55:07.236Z Description: No description available.
CVE ID: CVE-2025-62444 State: REJECTED Published: N/A Last Updated: 2025-10-15T02:55:06.761Z Description: No description available.
CVE ID: CVE-2025-62445 State: REJECTED Published: N/A Last Updated: 2025-10-15T02:55:06.292Z Description: No description available.
CVE ID: CVE-2025-62446 State: REJECTED Published: N/A Last Updated: 2025-10-15T02:55:05.640Z Description: No description available.
CVE ID: CVE-2025-62447 State: REJECTED Published: N/A Last Updated: 2025-10-15T02:55:05.174Z Description: No description available.
CVE ID: CVE-2025-62448 State: REJECTED Published: N/A Last Updated: 2025-10-15T02:55:04.638Z Description: No description available.
CVE ID: CVE-2025-62449 State: PUBLISHED Published: 2025-11-11T17:59:49.768Z Last Updated: 2025-11-21T19:07:12.055Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Visual Studio Code CoPilot Chat Extension Problem Types: CWE-22 Description: Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension allows an authorized attacker to bypass a security feature locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62449
CVE ID: CVE-2025-62452 State: PUBLISHED Published: 2025-11-11T17:59:33.306Z Last Updated: 2025-11-21T19:06:54.882Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Cor
ess Service (RRAS) allows an authorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62452
CVE ID: CVE-2025-62453 State: PUBLISHED Published: 2025-11-11T17:59:50.831Z Last Updated: 2025-11-21T19:07:13.055Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Visual Studio Code Problem Types: CWE-1426, CWE-693 Description: Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62453
CVE ID: CVE-2025-62459 State: PUBLISHED Published: 2025-11-20T22:18:57.900Z Last Updated: 2025-11-22T04:55:21.310Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft 365 Defender Portal Problem Types: CWE-79 Description: Microsoft Defender Portal Spoofing Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62459
CVE ID: CVE-2025-62475 State: PUBLISHED Published: 2025-10-21T20:03:16.833Z Last Updated: 2025-10-22T14:40:31.636Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: Oracle ZFS Storage Appliance Kit Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core
iance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/
U/C:N/I:N/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62476 State: PUBLISHED Published: 2025-10-21T20:03:17.181Z Last Updated: 2025-10-22T14:30:52.191Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: Oracle ZFS Storage Appliance Kit Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remo
iance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/se
L/PR:H/UI:N/S:U/C:N/I:N/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62477 State: PUBLISHED Published: 2025-10-21T20:03:17.583Z Last Updated: 2025-10-22T14:40:25.620Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: Oracle ZFS Storage Appliance Kit Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remo
CVE ID: CVE-2025-62478 State: PUBLISHED Published: 2025-10-21T20:03:17.928Z Last Updated: 2025-10-22T14:26:31.344Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: Oracle ZFS Storage Appliance Kit Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Obje
iance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security
/UI:N/S:U/C:N/I:N/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62479 State: PUBLISHED Published: 2025-10-21T20:03:18.267Z Last Updated: 2025-10-21T20:44:03.015Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Oracle Corporation Products: Oracle ZFS Storage Appliance Kit Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle ZFS Storage Appliance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). Th
cription: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62480 State: PUBLISHED Published: 2025-10-21T20:03:18.599Z Last Updated: 2025-10-21T20:34:13.523Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Oracle Corporation Products: Oracle ZFS Storage Appliance Kit Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle ZFS Storage Appliance Kit. Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem).
cription: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.ht
). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html