Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-53834 State: PUBLISHED Published: 2025-07-14T22:49:18.813Z Last Updated: 2025-07-15T19:49:38.248Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: caido Products: caido Problem Types: CWE-79 Description: Caido is a web security auditing toolkit. A reflected cross-site scripting (XSS) vulnerability was discovered in Caido’s toast UI component in versions prior to 0.49.0. Toast messages may reflect unsanitized user input in certain tools such as Match&Replace and Scope. This could allow an attacker to craft input that results in arbitrary script execution. Version 0.49.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
in arbitrary script execution. Version 0.49.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/caido/caido/security/advisories/GHSA-h8jr-c6qq-h7m7 - https://github.com/caido/caido/releases/tag/v0.49.0
CVE ID: CVE-2025-53835 State: PUBLISHED Published: 2025-07-14T23:00:35.577Z Last Updated: 2025-07-15T19:49:26.336Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-rendering Problem Types: CWE-79, CWE-80 Description: XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a
at permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-w3wh-g4m9-783p - https://g
Vulnrichment: References: - https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-w3wh-g4m9-783p - https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7 - https://jira.xwiki.org/browse/XRENDERING-660
CVE ID: CVE-2025-53836 State: PUBLISHED Published: 2025-07-14T23:08:34.071Z Last Updated: 2025-07-15T19:49:20.208Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-rendering Problem Types: CWE-863, CWE-94 Description: XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricted attribute of the transformation context when executing nested macros. This allows executing macros that are normally forbid
ribute of the transformation context when executing nested macros. This allows executing macros that are normally forbidden in restricted mode, in particular script macros. The cache and chart macros that are bundled in XWiki use the vulnerable feature. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. To avoid the exploitation of this bug, comments can be disabled for untrusted users until an upgrade to a patched version has been performed. Note that users with edit rights will still be able to add comments via the object editor even if comments have been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-rendering/security/adv
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-32mf-57h2-64x9 - https://github.com/xwiki/xwiki-rendering/commit/c73fa3ccd4ac59057e48e5d4325f659e78e8f86d - https://jira.xwiki.org/browse/XRENDERING-689 - https://jira.xwiki.org/browse/XWIKI-20375
CVE ID: CVE-2025-53838 State: PUBLISHED Published: 2025-09-08T19:18:17.242Z Last Updated: 2025-09-08T19:44:04.467Z Vendors: Kovah Products: LinkAce Problem Types: CWE-79 Description: LinkAce is a self-hosted archive to collect website links. A stored cross-site scripting (XSS) vulnerability was discovered in versions prior to 2.1.9 that allows an attacker to inject arbitrary JavaScript, which is then executed in the context of a user's browser when the malicious link is clicked. This is a one-click XSS, meaning the victim only needs to click a crafted link — no further interaction is required. The application contains a stored XSS vulnerability due to insufficient filtering and escaping of u
raction is required. The application contains a stored XSS vulnerability due to insufficient filtering and escaping of user-supplied data inserted into link attributes. Malicious JavaScript code can be saved in the database along with the link and executed in the user’s browser when clicking the link, leading to arbitrary script execution within the context of the site. Version 2.1.9 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Kovah/LinkAce/security/advisories/GHSA-vwmx-v9qf-q656 - https://github.com/Kovah/LinkAce/commit/4da467a4b0fbb1650670e603f4449b8a47695631
CVE ID: CVE-2025-53839 State: PUBLISHED Published: 2025-07-14T23:12:09.992Z Last Updated: 2025-07-15T19:49:12.926Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: dracoon Products: security-advisories Problem Types: CWE-79 Description: DRACOON is a file sharing service, and the DRACOON Branding Service allows customers to customize their DRACOON interface with their brand. Versions of the DRACOON Branding Service prior to 2.10.0 are vulnerable to cross-site scripting. Improper neutralization of input from administrative users could inject HTML code into the workflow for newly onboarded users. A fix was made available in version 2.10.0 and rolled out to the DRA
L code into the workflow for newly onboarded users. A fix was made available in version 2.10.0 and rolled out to the DRACOON service. DRACOON customers do not need to take action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dracoon/security-advisories/security/advisories/GHSA-jv2h-8mw7-mc97
CVE ID: CVE-2025-53840 State: PUBLISHED Published: 2025-07-16T13:34:37.477Z Last Updated: 2025-07-18T14:56:03.369Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Icinga Products: icingadb-web Problem Types: CWE-200 Description: Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not be revealed nor does this grant access to a host's or service's detail view. Please note that this only affects the restrictions `filter/hosts`
s grant access to a host's or service's detail view. Please note that this only affects the restrictions `filter/hosts` and `filter/services`. `filter/objects` is not affected by this and restricts objects as it is supposed to. Version 1.2.2 applies these restrictions properly. As a workaround, one may downgrade to version 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Icinga/icingadb-web/security/advisories/GHSA-q2w7-mrx8-5473 - https://github.com/Icinga/icingadb-web/releases/tag/v1.2.2
CVE ID: CVE-2025-53842 State: PUBLISHED Published: 2025-07-16T04:30:36.624Z Last Updated: 2025-07-18T14:47:09.380Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ZEXELON CO., LTD. Products: ZWX-2000CSW2-HN, ZWX-2000CS2-HN Problem Types: CWE-798 Description: Use of hard-coded credentials issue exists in ZWX-2000CSW2-HN prior to 0.3.19 and ZWX-2000CS2-HN firmware all versions. If this vulnerability is exploited, an attacker may tamper with the settings of the device by obtaining the credentials. This vulnerability is caused by an insufficient fix for CVE-2024-39838. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zexelon.co.jp/pdf/jvn
t fix for CVE-2024-39838. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zexelon.co.jp/pdf/jvn44419726.pdf - https://jvn.jp/en/jp/JVN44419726/ - https://www.cve.org/CVERecord?id=CVE-2024-39838
CVE ID: CVE-2025-53843 State: PUBLISHED Published: 2025-11-18T17:01:28.239Z Last Updated: 2025-11-21T08:30:44.314Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-358
CVE ID: CVE-2025-53845 State: PUBLISHED Published: 2025-10-14T15:23:42.992Z Last Updated: 2025-10-14T17:34:53.565Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiAnalyzer Problem Types: CWE-287 Description: An improper authentication vulnerability [CWE-287] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenticated attacker to obtain information pertaining to the device's health and status, or cause a denial of service via crafted OFTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-378
CVE ID: CVE-2025-53848 State: REJECTED Published: N/A Last Updated: 2025-07-11T02:55:07.044Z Description: No description available.
CVE ID: CVE-2025-53849 State: REJECTED Published: N/A Last Updated: 2025-07-11T02:55:06.524Z Description: No description available.
CVE ID: CVE-2025-53850 State: REJECTED Published: N/A Last Updated: 2025-07-11T02:55:06.042Z Description: No description available.
CVE ID: CVE-2025-53851 State: REJECTED Published: N/A Last Updated: 2025-07-11T02:55:05.550Z Description: No description available.
CVE ID: CVE-2025-53852 State: REJECTED Published: N/A Last Updated: 2025-07-11T02:55:05.037Z Description: No description available.
CVE ID: CVE-2025-53853 State: PUBLISHED Published: 2025-08-25T13:53:49.891Z Last Updated: 2025-11-03T18:13:16.851Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted ISHNE ECG annotations file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.
ty. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2232
CVE ID: CVE-2025-53855 State: PUBLISHED Published: 2025-10-28T13:45:40.355Z Last Updated: 2025-11-03T17:45:01.203Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GCC Productions Inc. Products: Fade In Problem Types: CWE-787 Description: An out-of-bounds write vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .fadein file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2250
CVE ID: CVE-2025-53856 State: PUBLISHED Published: 2025-10-15T13:55:49.991Z Last Updated: 2025-10-16T03:56:57.742Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-705 Description: When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 . Note: Software versions which have reach
12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156707
CVE ID: CVE-2025-53857 State: PUBLISHED Published: 2025-08-11T18:57:02.377Z Last Updated: 2025-08-11T19:37:14.499Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-862 Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-53858 State: PUBLISHED Published: 2025-10-16T08:54:46.989Z Last Updated: 2025-10-16T15:36:24.416Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: NEOJAPAN Inc. Products: ChatLuck Problem Types: CWE-79 Description: ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.chatluck.com/support/package/mainte/pchatluck-%e8%a3%bd%e5%93%81%e3%81%ab%e3%81%8a%e3%81%91%e3%82%8b%e3%80%81%e8%a4%87%e6%95%b0%e3%81%ae%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%8
5%93%81%e3%81%ab%e3%81%8a%e3%81%91%e3%82%8b%e3%80%81%e8%a4%87%e6%95%b0%e3%81%ae%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3%e4%b8%8a%e3%81%ae%e5%95%8f%e9%a1%8c%e3%81%ab/ - https://jvn.jp/en/jp/JVN13030751/
CVE ID: CVE-2025-53859 State: PUBLISHED Published: 2025-08-13T14:46:55.471Z Last Updated: 2025-11-04T21:12:39.856Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: F5 Products: NGINX Plus, NGINX Open Source Problem Types: CWE-125 Description: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to ext
ng the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000152786
CVE ID: CVE-2025-53860 State: PUBLISHED Published: 2025-10-15T15:15:23.032Z Last Updated: 2025-10-16T19:59:33.670Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: F5 Products: F5OS - Appliance Problem Types: CWE-214 Description: A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module (HSM) information on F5 rSeries systems. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000148625
CVE ID: CVE-2025-53861 State: PUBLISHED Published: 2025-07-11T12:44:17.837Z Last Updated: 2025-11-21T07:36:54.466Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2 Problem Types: CWE-319 Description: A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting (XSS) attacks allowing attackers to read transmitted data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-53861 - https://bugzilla.redhat.com/show_bug.cgi?id=2379360
CVE ID: CVE-2025-53862 State: PUBLISHED Published: 2025-07-11T12:34:24.020Z Last Updated: 2025-11-21T07:36:54.612Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2 Problem Types: CWE-497 Description: A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data that may contain important information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-53862 - https://bugzilla.redhat.com/show_bug.cgi?id=2379359
CVE ID: CVE-2025-53864 State: PUBLISHED Published: 2025-07-11T00:00:00.000Z Last Updated: 2025-09-23T18:38:15.547Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Connect2id Products: Nimbus JOSE+JWT Problem Types: CWE-674 Description: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson. Additional Analy
ld have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested - https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0 - https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b - https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c - https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch
CVE ID: CVE-2025-53865 State: PUBLISHED Published: 2025-07-13T00:00:00.000Z Last Updated: 2025-07-14T16:22:49.374Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: roundup-tracker Products: Roundup Problem Types: CWE-79 Description: In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.roundup-tracker.org/docs/security.html - https://www.roundup-tracker.org/docs/upgrading.html#cve-2025-53865
CVE ID: CVE-2025-53867 State: PUBLISHED Published: 2025-07-17T00:00:00.000Z Last Updated: 2025-07-24T20:21:37.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.webbatch.com - https://www.winbatch.com/winbatchversions.html#WB2025C - https://forum.winbatch.com/index.php?topic=3253.0#new
CVE ID: CVE-2025-53868 State: PUBLISHED Published: 2025-10-15T13:55:51.551Z Last Updated: 2025-10-16T03:56:22.081Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-78 Description: When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000151902
CVE ID: CVE-2025-53871 State: REJECTED Published: N/A Last Updated: 2025-07-12T02:55:09.295Z Description: No description available.
CVE ID: CVE-2025-53872 State: REJECTED Published: N/A Last Updated: 2025-07-12T02:55:08.811Z Description: No description available.
CVE ID: CVE-2025-53873 State: REJECTED Published: N/A Last Updated: 2025-07-12T02:55:08.337Z Description: No description available.
CVE ID: CVE-2025-53874 State: REJECTED Published: N/A Last Updated: 2025-07-12T02:55:07.881Z Description: No description available.
CVE ID: CVE-2025-53875 State: REJECTED Published: N/A Last Updated: 2025-07-12T02:55:07.395Z Description: No description available.
CVE ID: CVE-2025-53876 State: REJECTED Published: N/A Last Updated: 2025-07-12T02:55:06.948Z Description: No description available.
CVE ID: CVE-2025-53877 State: REJECTED Published: N/A Last Updated: 2025-07-12T02:55:06.506Z Description: No description available.
CVE ID: CVE-2025-53878 State: REJECTED Published: N/A Last Updated: 2025-07-12T02:55:06.063Z Description: No description available.
CVE ID: CVE-2025-53879 State: REJECTED Published: N/A Last Updated: 2025-07-12T02:55:05.572Z Description: No description available.
CVE ID: CVE-2025-53880 State: PUBLISHED Published: 2025-10-30T10:31:15.866Z Last Updated: 2025-10-31T03:55:25.371Z Vendors: SUSE Products: Container suse/manager/4.3/proxy-httpd:latest, Container suse/manager/5.0/x86_64/proxy-httpd:latest, Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:latest, SUSE Manager Proxy LTS 4.3 Problem Types: CWE-35 Description: A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses. Additional
wrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53880
CVE ID: CVE-2025-53881 State: PUBLISHED Published: 2025-10-02T13:51:56.848Z Last Updated: 2025-10-02T17:38:57.426Z Vendors: openSUSE Products: Tumbleweed Problem Types: CWE-61 Description: A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53881