Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujul2025.html
CVE ID: CVE-2025-50101 State: PUBLISHED Published: 2025-07-15T19:27:49.745Z Last Updated: 2025-07-17T14:21:57.559Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: MySQL Server Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.4
CVE ID: CVE-2025-50102 State: PUBLISHED Published: 2025-07-15T19:27:50.322Z Last Updated: 2025-07-17T14:21:52.621Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: MySQL Server Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.4
CVE ID: CVE-2025-50103 State: PUBLISHED Published: 2025-07-15T19:27:50.717Z Last Updated: 2025-07-17T14:21:47.425Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: MySQL Server Problem Types: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are
MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujul2025.html
CVE ID: CVE-2025-50104 State: PUBLISHED Published: 2025-07-15T19:27:51.097Z Last Updated: 2025-07-16T14:06:04.776Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Oracle Corporation Products: MySQL Server Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9
oduct of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujul2025.html
CVE ID: CVE-2025-50105 State: PUBLISHED Published: 2025-07-15T19:27:51.467Z Last Updated: 2025-07-17T03:55:39.083Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Oracle Corporation Products: Oracle Universal Work Queue Problem Types: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Universal Work Queue accessible data as well as unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data.
as well as unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. Description: Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Universal Work Queue accessible data as well as unauthorized access to critical data or complete access to
or all Oracle Universal Work Queue accessible data as well as unauthorized access to critical data or complete access to all Oracle Universal Work Queue accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujul2025.html
CVE ID: CVE-2025-50106 State: PUBLISHED Published: 2025-07-15T19:27:51.820Z Last Updated: 2025-11-03T20:05:33.909Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Oracle Corporation Products: Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition Problem Types: Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Description: Vulnerability in the Oracle Java
aalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:
sandbox for security. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujul2025.html
CVE ID: CVE-2025-50107 State: PUBLISHED Published: 2025-07-15T19:27:52.191Z Last Updated: 2025-07-16T14:03:35.181Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Oracle Corporation Products: Oracle Universal Work Queue Problem Types: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Universal Work Queue, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, ins
pact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Universal Work Queue accessible data as well as unauthorized read access to a subset of Oracle Universal Work Queue accessible data. Description: Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Request handling). Supported versions that are affected are 12.2.5-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks require human interaction from a person other than the attacker and
mise Oracle Universal Work Queue. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Universal Work Queue, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Universal Work Queue accessible data as well as unauthorized read access to a subset of Oracle Universal Work Queue accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://w
VSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujul2025.html
CVE ID: CVE-2025-50108 State: PUBLISHED Published: 2025-07-15T19:27:52.577Z Last Updated: 2025-07-16T03:56:12.137Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Oracle Corporation Products: Oracle Hyperion Financial Reporting Problem Types: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in u
ks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. Description: Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Workspace). The supported version that is affected is 11.2.20.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction fr
twork access via HTTP to compromise Oracle Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Additional
re 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujul2025.html
CVE ID: CVE-2025-50109 State: PUBLISHED Published: 2025-07-10T23:39:11.220Z Last Updated: 2025-07-11T13:54:53.276Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Emerson Products: ValveLink SOLO, ValveLink DTM, ValveLink PRM, ValveLink SNAP-ON Problem Types: CWE-316 Description: Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-189-01 - https://www.emerson.com/en-us/support/security-notifications - https://www.emerson.com/en-us/support/software-downloads
https://www.emerson.com/en-us/support/security-notifications - https://www.emerson.com/en-us/support/software-downloads-drivers
CVE ID: CVE-2025-50110 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T15:06:04.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal server URLs, account IDs, passwords, and device tokens - as plaintext query parameters over HTTPS Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shinyColumn/CVE-2025-50110
CVE ID: CVE-2025-50121 State: PUBLISHED Published: 2025-07-11T09:14:55.415Z Last Updated: 2025-11-03T20:05:35.286Z Vendors: Schneider Electric Products: EcoStruxure™ IT Data Center Expert Problem Types: CWE-78 Description: A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled. HTTP is disabled by default. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety
: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf
CVE ID: CVE-2025-50122 State: PUBLISHED Published: 2025-07-11T09:17:19.014Z Last Updated: 2025-11-03T20:05:36.663Z Vendors: Schneider Electric Products: EcoStruxure™ IT Data Center Expert Problem Types: CWE-331 Description: A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf
CVE ID: CVE-2025-50123 State: PUBLISHED Published: 2025-07-11T10:08:36.560Z Last Updated: 2025-11-04T22:06:41.379Z Vendors: Schneider Electric Products: EcoStruxure™ IT Data Center Expert Problem Types: CWE-94 Description: A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a privileged account when the server is accessed via a console and through exploitation of the hostname input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.p
ider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf
CVE ID: CVE-2025-50124 State: PUBLISHED Published: 2025-07-11T10:49:05.761Z Last Updated: 2025-11-03T20:05:39.428Z Vendors: Schneider Electric Products: EcoStruxure™ IT Data Center Expert Problem Types: CWE-269 Description: A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf
CVE ID: CVE-2025-50125 State: PUBLISHED Published: 2025-07-11T10:45:49.286Z Last Updated: 2025-11-03T20:05:40.847Z Vendors: Schneider Electric Products: EcoStruxure™ IT Data Center Expert Problem Types: CWE-918 Description: A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation of host request header. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf
CVE ID: CVE-2025-50126 State: PUBLISHED Published: 2025-07-18T09:51:40.624Z Last Updated: 2025-07-23T11:15:47.083Z Vendors: rsjoomla.com Products: RSBlog! component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web script or HTML via the jform[tags_text] parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rsjoomla.com/
CVE ID: CVE-2025-50127 State: PUBLISHED Published: 2025-07-23T11:14:17.617Z Last Updated: 2025-07-24T04:41:07.051Z Vendors: dj-extensions.com Products: DJ-Flyer component for Joomla Problem Types: CWE-89 Description: A SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dj-extensions.com/
CVE ID: CVE-2025-50128 State: PUBLISHED Published: 2025-07-24T15:11:03.304Z Last Updated: 2025-11-03T20:05:42.224Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-79 Description: A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerabili
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2207
CVE ID: CVE-2025-50129 State: PUBLISHED Published: 2025-08-25T14:17:38.509Z Last Updated: 2025-11-03T18:13:02.487Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAIL Image Decoding Library Products: SAIL Image Decoding Library Problem Types: CWE-122 Description: A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decoding the image data from a specially crafted .tga file, a heap-based buffer overflow can occur which allows for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnri
l need to convince the library to read a file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2220
CVE ID: CVE-2025-50130 State: PUBLISHED Published: 2025-07-08T12:59:44.115Z Last Updated: 2025-07-08T13:33:54.007Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. Products: V-SFT-6, TELLUS Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD. Opening V9 files or X1 files specially crafted by an attacker on the affected product may lead to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU94011267/ - https://monitouch.fujielectric.c
yst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU94011267/ - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/Search.php
CVE ID: CVE-2025-50142 State: REJECTED Published: N/A Last Updated: 2025-06-14T02:55:09.668Z Description: No description available.
CVE ID: CVE-2025-50143 State: REJECTED Published: N/A Last Updated: 2025-06-14T02:55:09.209Z Description: No description available.
CVE ID: CVE-2025-50144 State: REJECTED Published: N/A Last Updated: 2025-06-14T02:55:08.756Z Description: No description available.
CVE ID: CVE-2025-50145 State: REJECTED Published: N/A Last Updated: 2025-06-14T02:55:08.170Z Description: No description available.
CVE ID: CVE-2025-50146 State: REJECTED Published: N/A Last Updated: 2025-06-14T02:55:07.543Z Description: No description available.
CVE ID: CVE-2025-50147 State: REJECTED Published: N/A Last Updated: 2025-06-14T02:55:07.066Z Description: No description available.
CVE ID: CVE-2025-50148 State: REJECTED Published: N/A Last Updated: 2025-06-14T02:55:06.570Z Description: No description available.
CVE ID: CVE-2025-50149 State: REJECTED Published: N/A Last Updated: 2025-06-14T02:55:05.771Z Description: No description available.
CVE ID: CVE-2025-50150 State: REJECTED Published: N/A Last Updated: 2025-06-14T02:55:05.207Z Description: No description available.
CVE ID: CVE-2025-50151 State: PUBLISHED Published: 2025-07-21T09:32:30.334Z Last Updated: 2025-11-04T21:11:34.502Z Vendors: Apache Software Foundation Products: Apache Jena Problem Types: CWE-20 Description: File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which does not allow arbitrary configuration upload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/12gks5z40gh9bszn1xk8mz34gz586xss
CVE ID: CVE-2025-50152 State: PUBLISHED Published: 2025-10-14T17:00:55.475Z Last Updated: 2025-11-22T04:09:02.220Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind