Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
should avoid signing in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/security/advisories/GHSA-xx32-r9wr-whff - https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/issues/3
CVE ID: CVE-2025-27417 State: PUBLISHED Published: 2025-03-03T16:01:25.506Z Last Updated: 2025-03-04T16:45:25.833Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the adicionar_status_atendido.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the status parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed
tically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-j3p8-xww6-wvqh - https://github.com/LabRedesCefetRJ/WeGIA/commit/0f2644bca2afbdfff21662c51a64679dfba8c2bd
CVE ID: CVE-2025-27418 State: PUBLISHED Published: 2025-03-03T16:03:24.070Z Last Updated: 2025-03-04T16:48:19.561Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the adicionar_tipo_atendido.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the tipo parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in
lly whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-ffcg-qr75-98mg - https://github.com/LabRedesCefetRJ/WeGIA/commit/e2f258cc8fed8b7e5850114ce6e74bd9ba4f397f
CVE ID: CVE-2025-27419 State: PUBLISHED Published: 2025-03-03T16:07:00.445Z Last Updated: 2025-03-04T16:09:29.039Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-770 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This vulnerability allows any unauthenticated user to cause the server to become unresponsive by performing aggressive spidering. The vulnerability is caused by recursive crawling of dynamically generated URLs and insufficient handling of large volumes of requests. This vulnerability is fixed in 3.2.16. Additional Analyst Notes: - CISA ADP Vulnrichment:
of large volumes of requests. This vulnerability is fixed in 3.2.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9rp6-4mqp-g4p8 - https://github.com/LabRedesCefetRJ/WeGIA/commit/624ddfadb3fd8f8b30ad4f601b032a9bacc86a39
CVE ID: CVE-2025-27420 State: PUBLISHED Published: 2025-03-03T16:05:16.087Z Last Updated: 2025-03-04T16:44:43.661Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the atendido_parentesco_adicionar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the descricao parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability f
automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability fix in 3.2.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x3wr-75qx-55cw - https://github.com/LabRedesCefetRJ/WeGIA/commit/add78bb177cbb29477ff2121b533651a9d673918
CVE ID: CVE-2025-27421 State: PUBLISHED Published: 2025-03-03T16:19:23.914Z Last Updated: 2025-03-03T16:41:28.153Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: JasonLovesDoggo Products: abacus Problem Types: CWE-400, CWE-772 Description: Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events (SSE) implementation. The issue occurs when clients disconnect from the /stream endpoint, as the server fails to properly clean up resources and terminate associated goroutines. This leads to resource exhaustion where the server continues running but eventually stops a
inate associated goroutines. This leads to resource exhaustion where the server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The vulnerability specifically involves improper channel cleanup in the event handling mechanism, causing goroutines to remain blocked indefinitely. This vulnerability is fixed in 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JasonLovesDoggo/abacus/security/advisories/GHSA-vh64-54px-qgf8 - https://github.com/JasonLovesDoggo/abacus/commit/898ff1204e11317cc161240b660e63eed5a72b33
CVE ID: CVE-2025-27422 State: PUBLISHED Published: 2025-03-03T16:25:48.918Z Last Updated: 2025-03-03T18:53:10.870Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: factionsecurity Products: faction Problem Types: CWE-287 Description: FACTION is a PenTesting Report Generation and Collaboration Framework. Authentication is bypassed when an attacker registers a new user with admin privileges. This is possible at any time without any authorization. The request must follow the validation rules (no missing information, secure password, etc) but there are no other controls stopping them. This vulnerability is fixed in 1.4.3. Additional Analyst Notes: - CISA ADP Vulnri
e are no other controls stopping them. This vulnerability is fixed in 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/factionsecurity/faction/security/advisories/GHSA-97cv-f342-v2jc - https://github.com/factionsecurity/faction/commit/0a6848d388d6dba1c81918cce2772b1e805cd3d6
CVE ID: CVE-2025-27423 State: PUBLISHED Published: 2025-03-03T16:30:19.752Z Last Updated: 2025-05-02T23:03:02.425Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: vim Products: vim Problem Types: CWE-77 Description: Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really
rally from the tar archive. This allows to execute shell commands via special crafted tar archives. Whether this really happens, depends on the shell being used ('shell' option, which is set using $SHELL). The issue has been fixed as of Vim patch v9.1.1164 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3 - https://github.com/vim/vim/commit/129a8446d23cd9cb4445fcfea259cba5e0487d29 - https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399
CVE ID: CVE-2025-27424 State: PUBLISHED Published: 2025-03-04T13:31:28.256Z Last Updated: 2025-03-04T15:30:08.306Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme Description: Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page This vulnerability affects Firefox for iOS < 136. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1945392 - https://www.mozilla.org/security/advisories/mfsa2025-13/
CVE ID: CVE-2025-27425 State: PUBLISHED Published: 2025-03-04T13:31:28.658Z Last Updated: 2025-03-04T15:26:15.286Z Vendors: Mozilla Products: Firefox for iOS Problem Types: QR code user confirmation bypass with invalid protocol Description: Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first This vulnerability affects Firefox for iOS < 136. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1941525 - https://www.mozilla.org/security/advisories/mfsa2025-13/
CVE ID: CVE-2025-27426 State: PUBLISHED Published: 2025-03-04T13:31:27.827Z Last Updated: 2025-03-04T15:32:13.097Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error page Description: Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL This vulnerability affects Firefox for iOS < 136. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1933079 - https://www.mozilla.org/security/advisories/mfsa2025-13/
CVE ID: CVE-2025-27427 State: PUBLISHED Published: 2025-04-01T07:26:59.994Z Last Updated: 2025-04-02T22:03:20.210Z Vendors: Apache Software Foundation Products: Apache ActiveMQ Artemis Problem Types: CWE-863 Description: A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually
er could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0. Users are recommended to upgrade to version 2.40.0 which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/8dzlm2vkqphyrnkrby8r8kzndsm5o6x8
CVE ID: CVE-2025-27428 State: PUBLISHED Published: 2025-04-08T07:13:27.056Z Last Updated: 2025-04-08T14:50:32.851Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver and ABAP Platform (Service Data Collection) Problem Types: CWE-862 Description: Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon successful exploitation, they could read files from any managed system connected to SAP Solution Manager, leading to high impact on confidentiality. There is no impact on integrity or availability. Additional Analyst Notes: - CISA ADP Vuln
gh impact on confidentiality. There is no impact on integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3581811 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27429 State: PUBLISHED Published: 2025-04-08T07:13:37.548Z Last Updated: 2025-04-14T16:35:21.311Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP S/4HANA (Private Cloud) Problem Types: CWE-94 Description: SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system. Additional A
risk of full system compromise, undermining the confidentiality, integrity and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3581961 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27430 State: PUBLISHED Published: 2025-03-11T00:37:24.590Z Last Updated: 2025-03-11T02:06:54.297Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP CRM and SAP S/4HANA (Interaction Center) Problem Types: CWE-918 Description: Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application's confidentiality. There is no impact on integrity or availability Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
onfidentiality. There is no impact on integrity or availability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3561861 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27431 State: PUBLISHED Published: 2025-03-11T00:37:35.111Z Last Updated: 2025-03-11T02:06:21.293Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server Java Problem Types: CWE-79 Description: User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS). This could enable an attacker to inject malicious payload that gets stored and executed when a user accesses the functionality, hence leading to information disclosure or unauthorized data modifications within the scope of victim�s browser. There is no impact on availability. Additional An
unauthorized data modifications within the scope of victim�s browser. There is no impact on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3567246 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27432 State: PUBLISHED Published: 2025-03-11T00:38:36.886Z Last Updated: 2025-03-11T02:05:41.312Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Electronic Invoicing for Brazil (eDocument Cockpit) Problem Types: CWE-862 Description: The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized access to each transaction. By executing the specific ABAP method within the ABAP system, an unauthorized attacker could call each transaction and view the inbound delivery details. This vulnerability has a low impact on the confidentiality wi
ll each transaction and view the inbound delivery details. This vulnerability has a low impact on the confidentiality with no effect on the integrity and the availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3568865 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27433 State: PUBLISHED Published: 2025-03-11T00:38:50.716Z Last Updated: 2025-03-11T02:04:54.876Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP S/4HANA (Manage Bank Statements) Problem Types: CWE-639 Description: The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's integrity, with no effect on confidentiality and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3
lability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3565835 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27434 State: PUBLISHED Published: 2025-03-11T00:39:01.831Z Last Updated: 2025-03-12T04:00:31.592Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Commerce (Swagger UI) Problem Types: CWE-79 Description: Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.co
availability of data in SAP Commerce. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3569602 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27435 State: PUBLISHED Published: 2025-04-08T07:13:49.402Z Last Updated: 2025-04-08T13:28:27.656Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Commerce Cloud Problem Types: CWE-862 Description: Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing a low impact on confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3539465 - https:
application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3539465 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27436 State: PUBLISHED Published: 2025-03-11T00:39:14.372Z Last Updated: 2025-03-11T02:03:20.832Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP S/4HANA (Manage Bank Statements) Problem Types: CWE-639 Description: The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact with a resource is legitimate, allowing the attacker to delete the attachment of a posted bank statement. This leads to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application. Additional Analyst
integrity, with no impact on the confidentiality of the data or the availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3565835 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27437 State: PUBLISHED Published: 2025-04-08T07:13:58.049Z Last Updated: 2025-04-08T13:27:53.111Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP (Virus Scan Interface) Problem Types: CWE-862 Description: A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-administrative user can initiate a transaction, allowing them to access but not modify non-sensitive data without further authorization and with no effect on availability. Additional Analyst Notes: - CISA ADP Vuln
nsitive data without further authorization and with no effect on availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3568778 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-27438 State: PUBLISHED Published: 2025-03-11T09:48:31.489Z Last Updated: 2025-03-11T13:26:49.545Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Teamcenter Visualization V14.3, Teamcenter Visualization V2312, Teamcenter Visualization V2406, Teamcenter Visualization V2412, Tecnomatix Plant Simulation V2302, Tecnomatix Plant Simulation V2404 Problem Types: CWE-125 Description: A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All
CVE ID: CVE-2025-27439 State: PUBLISHED Published: 2025-03-11T17:10:28.524Z Last Updated: 2025-03-11T18:58:55.987Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-124 Description: Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25011/
CVE ID: CVE-2025-27440 State: PUBLISHED Published: 2025-03-11T17:11:16.928Z Last Updated: 2025-03-11T17:40:56.534Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-124 Description: Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25011/
CVE ID: CVE-2025-27441 State: PUBLISHED Published: 2025-04-08T16:14:40.782Z Last Updated: 2025-04-08T20:34:37.035Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-352 Description: Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25013
CVE ID: CVE-2025-27442 State: PUBLISHED Published: 2025-04-08T16:14:53.396Z Last Updated: 2025-04-08T20:33:25.242Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-352 Description: Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25013
CVE ID: CVE-2025-27443 State: PUBLISHED Published: 2025-04-08T16:16:38.148Z Last Updated: 2025-04-08T20:32:12.324Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps for Windows Problem Types: CWE-1188 Description: Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25014