Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48891 State: PUBLISHED Published: 2025-07-10T23:17:45.815Z Last Updated: 2025-07-11T13:42:37.695Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Advantech Products: iView Problem Types: CWE-89 Description: A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function. This vulnerability can be exploited by an authenticated attacker with at least user-level privileges, potentially leading to information disclosure or a denial-of-service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183
CVE ID: CVE-2025-48902 State: PUBLISHED Published: 2025-06-06T06:33:12.711Z Last Updated: 2025-06-09T13:26:27.060Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-118 Description: Vulnerability of uncontrolled system resource applications in the setting module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/6/
CVE ID: CVE-2025-48903 State: PUBLISHED Published: 2025-06-06T06:34:14.173Z Last Updated: 2025-06-09T13:28:07.613Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-264 Description: Permission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/6/
CVE ID: CVE-2025-48904 State: PUBLISHED Published: 2025-06-06T06:36:17.624Z Last Updated: 2025-06-09T13:27:53.508Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-288 Description: Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/6/
CVE ID: CVE-2025-48905 State: PUBLISHED Published: 2025-06-06T06:38:54.430Z Last Updated: 2025-06-09T13:27:26.470Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-1068 Description: Wasm exception capture vulnerability in the arkweb v8 module Impact: Successful exploitation of this vulnerability may cause the failure to capture specific Wasm exception types. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/6/
CVE ID: CVE-2025-48906 State: PUBLISHED Published: 2025-06-06T06:40:06.196Z Last Updated: 2025-06-09T13:27:11.116Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-290 Description: Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/6/
CVE ID: CVE-2025-48907 State: PUBLISHED Published: 2025-06-06T06:41:03.604Z Last Updated: 2025-06-09T13:26:13.593Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-248 Description: Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/6/
CVE ID: CVE-2025-48908 State: PUBLISHED Published: 2025-06-06T06:51:13.791Z Last Updated: 2025-06-09T13:17:32.218Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-567 Description: Ability Auto Startup service vulnerability in the foundation process Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletinlaptops/2025/6/
CVE ID: CVE-2025-48909 State: PUBLISHED Published: 2025-06-06T06:45:43.472Z Last Updated: 2025-06-09T13:25:57.689Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-287 Description: Bypass vulnerability in the device management channel Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/6/
CVE ID: CVE-2025-48910 State: PUBLISHED Published: 2025-06-06T06:47:46.170Z Last Updated: 2025-06-09T13:25:40.741Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-122 Description: Buffer overflow vulnerability in the DFile module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/6/
CVE ID: CVE-2025-48911 State: PUBLISHED Published: 2025-06-06T06:50:02.942Z Last Updated: 2025-06-09T13:25:23.888Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-266 Description: Vulnerability of improper permission assignment in the note sharing module Impact: Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/6/
CVE ID: CVE-2025-48912 State: PUBLISHED Published: 2025-05-30T08:26:15.500Z Last Updated: 2025-05-31T00:11:45.502Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-89 Description: An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
4.1.2, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/ms2t2oq218hb7l628trsogo4fj7h1135
CVE ID: CVE-2025-48913 State: PUBLISHED Published: 2025-08-08T09:21:22.208Z Last Updated: 2025-11-04T21:11:08.194Z Vendors: Apache Software Foundation Products: Apache CXF Problem Types: CWE-20 Description: If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83
CVE ID: CVE-2025-48914 State: PUBLISHED Published: 2025-06-13T15:41:05.524Z Last Updated: 2025-06-13T18:14:31.763Z Vendors: Drupal Products: COOKiES Consent Management Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-075
CVE ID: CVE-2025-48915 State: PUBLISHED Published: 2025-06-13T15:41:32.448Z Last Updated: 2025-06-13T18:16:37.093Z Vendors: Drupal Products: COOKiES Consent Management Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-076
CVE ID: CVE-2025-48916 State: PUBLISHED Published: 2025-06-13T15:35:36.748Z Last Updated: 2025-06-13T17:55:55.225Z Vendors: Drupal Products: Bookable Calendar Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-070
CVE ID: CVE-2025-48917 State: PUBLISHED Published: 2025-06-13T15:38:49.022Z Last Updated: 2025-06-13T16:39:43.931Z Vendors: Drupal Products: EU Cookie Compliance (GDPR Compliance) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before 1.26.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-072
CVE ID: CVE-2025-48918 State: PUBLISHED Published: 2025-06-13T15:38:11.641Z Last Updated: 2025-06-13T18:00:38.247Z Vendors: Drupal Products: Simple Klaro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-071
CVE ID: CVE-2025-48919 State: PUBLISHED Published: 2025-06-13T15:39:23.246Z Last Updated: 2025-06-13T16:37:55.768Z Vendors: Drupal Products: Simple Klaro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-073
CVE ID: CVE-2025-48920 State: PUBLISHED Published: 2025-06-13T15:40:19.030Z Last Updated: 2025-06-13T18:12:04.691Z Vendors: Drupal Products: etracker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-074
CVE ID: CVE-2025-48921 State: PUBLISHED Published: 2025-06-26T13:32:44.948Z Last Updated: 2025-06-26T17:46:14.613Z Vendors: Drupal Products: Open Social Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-079
CVE ID: CVE-2025-48922 State: PUBLISHED Published: 2025-06-26T13:32:13.904Z Last Updated: 2025-06-26T17:47:11.163Z Vendors: Drupal Products: GLightbox Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightbox: from 0.0.0 before 1.0.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-078
CVE ID: CVE-2025-48923 State: PUBLISHED Published: 2025-06-26T13:31:56.839Z Last Updated: 2025-06-26T17:47:59.937Z Vendors: Drupal Products: Toc.js Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-077
CVE ID: CVE-2025-48924 State: PUBLISHED Published: 2025-07-11T14:56:58.049Z Last Updated: 2025-11-04T22:06:40.023Z Vendors: Apache Software Foundation Products: Apache Commons Lang Problem Types: CWE-674 Description: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, w
ibraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1
CVE ID: CVE-2025-48925 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-07-01T19:48:30.412Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: TeleMessage Products: service Problem Types: CWE-836 Description: The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/
CVE ID: CVE-2025-48926 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-07-01T19:47:59.387Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: TeleMessage Products: service Problem Types: CWE-288 Description: The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/
CVE ID: CVE-2025-48927 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-10-21T22:55:14.419Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TeleMessage Products: service Problem Types: CWE-1188 Description: The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/
CVE ID: CVE-2025-48928 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-10-21T22:55:14.199Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TeleMessage Products: service Problem Types: CWE-528 Description: The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/
CVE ID: CVE-2025-48929 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-07-01T19:47:22.186Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: TeleMessage Products: service Problem Types: CWE-922 Description: The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovered by an adversary. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/
CVE ID: CVE-2025-48930 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-07-01T19:46:40.527Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: TeleMessage Products: service Problem Types: CWE-316 Description: The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to an adversary through various avenues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/
CVE ID: CVE-2025-48931 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-05-29T18:57:13.305Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: TeleMessage Products: service Problem Types: CWE-328 Description: The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainbow tables) with low computational effort. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/
CVE ID: CVE-2025-48934 State: PUBLISHED Published: 2025-06-04T19:21:17.701Z Last Updated: 2025-06-04T19:32:14.582Z Vendors: denoland Products: deno Problem Types: CWE-201 Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any variables listed in the `--deny-env` option of the `deno run` command. When looking at the documentation of the `--deny-env` option this might lead to a false impression that variables listed in the option are impossible to read. Software relying on the combination of both flags to allow access to most environment variables except a few sensitive ones will be vulnerable to m
bination of both flags to allow access to most environment variables except a few sensitive ones will be vulnerable to malicious code trying to steal secrets using the `Deno.env.toObject()` method. Versions 2.1.13 and 2.2.13 contains a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/denoland/deno/security/advisories/GHSA-7w8p-chxq-2789 - https://github.com/denoland/deno/pull/29079 - https://github.com/denoland/deno/commit/2959e083912420988066a001c2b2d6732a1b562f - https://github.com/denoland/deno/commit/946ccda1aa19a00c478a5e6826b75053b050d753 - https://docs.deno.com/api/deno/~/Deno.Env.toObject - https://docs.deno.com/runtime/fundamentals/security/
5053b050d753 - https://docs.deno.com/api/deno/~/Deno.Env.toObject - https://docs.deno.com/runtime/fundamentals/security/#environment-variables
CVE ID: CVE-2025-48935 State: PUBLISHED Published: 2025-06-04T19:31:26.840Z Last Updated: 2025-06-04T20:41:22.848Z Vendors: denoland Products: deno Problem Types: CWE-863 Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using `ATTACH DATABASE` statement. Version 2.2.5 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596 - https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860
CVE ID: CVE-2025-48936 State: PUBLISHED Published: 2025-05-30T06:30:57.792Z Last Updated: 2025-05-30T13:06:54.297Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-601 Description: Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a potential vulnerability exists in the password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host hea
, containing a secret code, is then emailed to the user. If an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account. This specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled. This issue has been patched in versions 2.70.12, 2.71.10, and 3.
ntication (MFA) or Passwordless authentication enabled. This issue has been patched in versions 2.70.12, 2.71.10, and 3.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-93m4-mfpg-c3xf - https://github.com/zitadel/zitadel/commit/c097887bc5f680e12c998580fb56d98a15758f53
CVE ID: CVE-2025-48937 State: PUBLISHED Published: 2025-06-10T15:32:00.822Z Last Updated: 2025-06-10T15:46:22.358Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: matrix-org Products: matrix-rust-sdk Problem Types: CWE-290 Description: matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0. Additional Analyst
he recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w - https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55 - https://github.com/matrix-org/matrix-rust-sdk/commit/56980745b4f27f7dc72ac296e6aa003e5d92a75b - https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2
CVE ID: CVE-2025-48938 State: PUBLISHED Published: 2025-05-30T18:45:59.753Z Last Updated: 2025-05-30T20:38:51.984Z Vendors: cli Products: go-gh Problem Types: CWE-501 Description: go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly im