Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54429 State: PUBLISHED Published: 2025-07-28T20:34:56.710Z Last Updated: 2025-07-28T20:46:59.149Z Vendors: polkadot-evm Products: frontier Problem Types: CWE-704 Description: Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for safety. For precompiles to be callable by smart contracts they must be explicitly configured as CallableByContract. If this configuration is absent, then the precompile should be unreachable via smart contract accou
CallableByContract. If this configuration is absent, then the precompile should be unreachable via smart contract accounts. In commits prior to 0822030, the underlying implementation of CallableByContract which returned the AddressType was incorrect. It considered the contract address running under CREATE or CREATE2 to be AddressType::EOA rather than correctly as AddressType::Contract. The issue only affects users who use custom precompile implementations that utilize AddressType::EOA and AddressType::Contract. It's not directly exploitable in any of the predefined precompiles in Frontier. This is fixed in version 0822030. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
iles in Frontier. This is fixed in version 0822030. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/polkadot-evm/frontier/security/advisories/GHSA-fr62-ppwc-mc2h - https://github.com/polkadot-evm/frontier/pull/1655 - https://dotpal.io/assets/files/frontier-srlabs-2505-718c3bfa5df9fed1862fed05de506859.pdf
CVE ID: CVE-2025-54430 State: PUBLISHED Published: 2025-07-30T13:41:59.975Z Last Updated: 2025-07-30T13:54:21.105Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: dedupeio Products: dedupe Problem Types: CWE-78 Description: dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issue_comment can be triggered using the @benchmark body. This workflow is susceptible to exploitation as it checkout the ${{ github.event.issue.number }
ing the @benchmark body. This workflow is susceptible to exploitation as it checkout the ${{ github.event.issue.number }}, which correspond to the branch of the PR manipulated by potentially malicious actors, and where untrusted code may be executed. Running untrusted code may lead to the exfiltration of GITHUB_TOKEN, which in this workflow has write permissions on most of the scopes - in particular the contents one - and could lead to potential repository takeover. This is fixed by commit 3f61e79. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dedupeio/dedupe/security/advisories/GHSA-wrg3-xqw8-m85p - https://github.com/dedupeio/dedupe/commit/3f61e7910291
hub.com/dedupeio/dedupe/security/advisories/GHSA-wrg3-xqw8-m85p - https://github.com/dedupeio/dedupe/commit/3f61e79102910bd355e920a2df7e44c14c9cb247
CVE ID: CVE-2025-54432 State: REJECTED Published: N/A Last Updated: 2025-07-29T16:45:48.205Z Description: No description available.
CVE ID: CVE-2025-54433 State: PUBLISHED Published: 2025-07-30T14:29:03.510Z Last Updated: 2025-07-30T14:46:51.691Z Vendors: bugsink Products: bugsink Problem Types: CWE-22 Description: Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the
s. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bugsink/bugsink/security/advisories/GHSA-q78p-g86f-jg6q - https://github.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33 - https://github.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21 - https://github.com/bugsink/bugsink/commit/2c41fbe3881bde
gsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21 - https://github.com/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f - https://github.com/bugsink/bugsink/commit/53cf1a17a3e96f7c83c7451fd56f980a09d0c9b0 - https://github.com/bugsink/bugsink/commit/55a155003d0b416ea008c5e7dcde85130ad21d9b - https://github.com/bugsink/bugsink/commit/b94aa8a5c96ce8cdd9711b6beb4e518264993ac2 - https://github.com/bugsink/bugsink/commit/c341687bd655543730c812db35c29199f788be6b - https://github.com/bugsink/bugsink/commit/c87217bd565122ba70af90436e3ab2cd9bee658f
CVE ID: CVE-2025-54438 State: PUBLISHED Published: 2025-07-23T05:36:04.749Z Last Updated: 2025-07-30T03:56:05.530Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54439 State: PUBLISHED Published: 2025-07-23T05:36:29.975Z Last Updated: 2025-07-30T03:56:06.299Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54440 State: PUBLISHED Published: 2025-07-23T05:33:16.593Z Last Updated: 2025-07-30T03:56:00.472Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54441 State: PUBLISHED Published: 2025-07-23T05:33:40.398Z Last Updated: 2025-07-30T03:56:01.313Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54442 State: PUBLISHED Published: 2025-07-23T05:34:05.603Z Last Updated: 2025-07-30T03:56:02.694Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54443 State: PUBLISHED Published: 2025-07-23T05:34:30.265Z Last Updated: 2025-07-30T03:56:03.718Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54444 State: PUBLISHED Published: 2025-07-23T05:35:43.456Z Last Updated: 2025-07-30T03:56:04.642Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54445 State: PUBLISHED Published: 2025-07-23T05:31:35.364Z Last Updated: 2025-07-23T14:43:02.427Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-611 Description: Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request Forgery.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54446 State: PUBLISHED Published: 2025-07-23T05:32:00.428Z Last Updated: 2025-07-30T03:55:58.749Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54447 State: PUBLISHED Published: 2025-07-23T05:32:57.073Z Last Updated: 2025-07-30T03:55:59.572Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54448 State: PUBLISHED Published: 2025-07-23T05:31:03.535Z Last Updated: 2025-07-30T03:55:57.934Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54449 State: PUBLISHED Published: 2025-07-23T05:27:49.191Z Last Updated: 2025-07-30T03:55:47.944Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54450 State: PUBLISHED Published: 2025-07-23T05:28:25.686Z Last Updated: 2025-07-30T03:55:48.834Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54451 State: PUBLISHED Published: 2025-07-23T05:29:06.803Z Last Updated: 2025-07-30T03:55:51.265Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54452 State: PUBLISHED Published: 2025-07-23T05:29:34.600Z Last Updated: 2025-07-23T14:52:49.381Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-287 Description: Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54453 State: PUBLISHED Published: 2025-07-23T05:30:35.796Z Last Updated: 2025-07-30T03:55:53.821Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54454 State: PUBLISHED Published: 2025-07-23T05:26:17.961Z Last Updated: 2025-07-30T03:55:46.225Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-798 Description: Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54455 State: PUBLISHED Published: 2025-07-23T05:27:10.678Z Last Updated: 2025-07-30T03:55:47.039Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Samsung Electronics Products: MagicINFO 9 Server Problem Types: CWE-798 Description: Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.samsungtv.com/securityUpdates
CVE ID: CVE-2025-54458 State: PUBLISHED Published: 2025-08-11T18:57:04.545Z Last Updated: 2025-08-11T19:38:22.132Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-862 Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a Confluence space the user does not have access to via the create subscription endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-54459 State: PUBLISHED Published: 2025-10-29T21:51:34.082Z Last Updated: 2025-10-30T20:31:36.976Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Vertikal Systems Products: Hospital Manager Backend Services Problem Types: CWE-497 Description: Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
rs, server variables, and internal file paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01
CVE ID: CVE-2025-54460 State: PUBLISHED Published: 2025-08-21T20:00:11.036Z Last Updated: 2025-08-21T20:13:06.036Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: AVEVA Products: PI Integrator Problem Types: CWE-434 Description: The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) to upload and persist files that could potentially be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf - https://www.cisa.gov/news-events/ic
aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04
CVE ID: CVE-2025-54461 State: PUBLISHED Published: 2025-10-16T08:55:03.769Z Last Updated: 2025-10-16T15:35:43.756Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: NEOJAPAN Inc. Products: ChatLuck Problem Types: CWE-1220 Description: ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users. If exploited, an uninvited guest user may register itself as a guest user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.chatluck.com/support/package/mainte/pchatluck-%e8%a3%bd%e5%93%81%e3%81%ab%e3%81%8a%e3%81%91%e3%82%8b%e3%80%81%e8%a4%87%e6%95%b0%e3%81%ae%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%
bd%e5%93%81%e3%81%ab%e3%81%8a%e3%81%91%e3%82%8b%e3%80%81%e8%a4%87%e6%95%b0%e3%81%ae%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3%e4%b8%8a%e3%81%ae%e5%95%8f%e9%a1%8c%e3%81%ab/ - https://jvn.jp/en/jp/JVN13030751/
CVE ID: CVE-2025-54462 State: PUBLISHED Published: 2025-08-25T13:53:35.974Z Last Updated: 2025-11-03T18:13:20.657Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted .nex file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_r
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2239
CVE ID: CVE-2025-54463 State: PUBLISHED Published: 2025-08-11T18:57:05.342Z Last Updated: 2025-08-11T19:39:08.495Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-754 Description: Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-54464 State: PUBLISHED Published: 2025-08-13T11:12:16.853Z Last Updated: 2025-08-13T13:10:37.654Z Vendors: ZKTeco Co Products: WL20 Biometric Attendance System Problem Types: CWE-312 Description: This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-017
CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0172 - https://www.zkteco.com/en/Security_Bulletinsibs/20
CVE ID: CVE-2025-54465 State: PUBLISHED Published: 2025-08-13T11:17:41.081Z Last Updated: 2025-08-13T13:09:41.836Z Vendors: ZKTeco Co Products: WL20 Biometric Attendance System Problem Types: CWE-798 Description: This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve the hard-coded MQTT credentials and endpoints from the targeted device. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the MQTT broker and manipulate the commu
n of this vulnerability could allow the attacker to gain unauthorized access to the MQTT broker and manipulate the communications of the targeted device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0172 - https://www.zkteco.com/en/Security_Bulletinsibs/20
CVE ID: CVE-2025-54466 State: PUBLISHED Published: 2025-08-15T14:13:52.584Z Last Updated: 2025-11-04T21:12:47.762Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ofbiz.apache.org/download.html - https:/
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ofbiz.apache.org/download.html - https://ofbiz.apache.org/security.html - https://ofbiz.apache.org/release-notes-24.09.02.html - https://issues.apache.org/jira/browse/OFBIZ-13276 - https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915
CVE ID: CVE-2025-54467 State: PUBLISHED Published: 2025-09-17T12:29:36.480Z Last Updated: 2025-09-17T13:19:59.410Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SUSE Products: neuvector Problem Types: CWE-522 Description: When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54467 - https://github.com/neuvector/neuvector/security/advisories/GHSA-w54x-xfxg-4gxq