Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2745 State: PUBLISHED Published: 2025-06-12T19:42:27.001Z Last Updated: 2025-06-12T20:09:34.976Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: AVEVA Products: PI Web API Problem Types: CWE-79 Description: A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that will be executed by users who were socially engineered to disable content security policy protections while rendering annotation attachments from within a web browser. Additional Ana
ble content security policy protections while rendering annotation attachments from within a web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-08 - https://www.aveva.com/en/support-and-success/cyber-security-updates/
CVE ID: CVE-2025-2746 State: PUBLISHED Published: 2025-03-24T18:16:04.022Z Last Updated: 2025-11-19T18:34:14.812Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kentico Products: Xperience Problem Types: CWE-288 Description: An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/bypassing-authentication-like-its-the-9
Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ - https://devnet.kentico.com/download/hotfixes - https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 - https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass
CVE ID: CVE-2025-2747 State: PUBLISHED Published: 2025-03-24T18:17:06.079Z Last Updated: 2025-11-19T18:33:57.838Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kentico Products: Xperience Problem Types: CWE-288 Description: An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre
t Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ - https://devnet.kentico.com/download/hotfixes - https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 - https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-none-password-type-authentication-bypass
CVE ID: CVE-2025-2748 State: PUBLISHED Published: 2025-03-24T18:22:30.734Z Last Updated: 2025-11-19T18:33:46.768Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Kentico Products: Xperience Problem Types: CWE-79, CWE-434 Description: The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devnet.kentico.com/download/hotfixes
CVE ID: CVE-2025-2749 State: PUBLISHED Published: 2025-03-24T18:18:07.228Z Last Updated: 2025-11-19T18:33:33.900Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Kentico Products: Xperience Problem Types: CWE-22, CWE-434 Description: An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue affects Kentico Xperience through 13.0.178. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs
ffects Kentico Xperience through 13.0.178. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ - https://devnet.kentico.com/download/hotfixes - https://www.vulncheck.com/advisories/kentico-xperience-staging-media-file-upload-authenticated-rce
CVE ID: CVE-2025-2750 State: PUBLISHED Published: 2025-03-25T07:31:03.681Z Last Updated: 2025-03-31T17:38:57.671Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-787, CWE-119 Description: A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA AD
e the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300855 - https://vuldb.com/?ctiid.300855 - https://vuldb.com/?submit.517783 - https://github.com/assimp/assimp/issues/6011 - https://github.com/assimp/assimp/issues/6011#issue-2877369004
CVE ID: CVE-2025-2751 State: PUBLISHED Published: 2025-03-25T07:31:05.393Z Last Updated: 2025-03-31T17:34:52.202Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-125, CWE-119 Description: A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Anal
ead. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300856 - https://vuldb.com/?ctiid.300856 - https://vuldb.com/?submit.517785 - https://github.com/assimp/assimp/issues/6012 - https://github.com/assimp/assimp/issues/6012#issue-2877369817
CVE ID: CVE-2025-2752 State: PUBLISHED Published: 2025-03-25T08:00:11.272Z Last Updated: 2025-03-31T17:27:11.090Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-125, CWE-119 Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300857 - https://vuldb.com/?ctiid.300857 - https://vuldb.com/?submit.517786 - https://github.com/assimp/assimp/issues/6013 - https://github.com/assimp/assimp/issues/6013#issue-2877371176
CVE ID: CVE-2025-2753 State: PUBLISHED Published: 2025-03-25T08:31:04.517Z Last Updated: 2025-03-25T13:14:56.061Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-125, CWE-119 Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp of the component LWS File Handler. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichme
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300858 - https://vuldb.com/?ctiid.300858 - https://vuldb.com/?submit.517787 - https://github.com/assimp/assimp/issues/6014 - https://github.com/assimp/assimp/issues/6014#issue-2877372462
CVE ID: CVE-2025-2754 State: PUBLISHED Published: 2025-03-25T08:31:07.954Z Last Updated: 2025-03-25T13:13:20.540Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-122, CWE-119 Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument it leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be
eap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300859 - https://vuldb.com/?ctiid.300859 - https://vuldb.com/?submit.517788 - https://github.com/assimp/assimp/issues/6015 - https://github.com/assimp/assimp/issues/6015#issue-2877373501
CVE ID: CVE-2025-2755 State: PUBLISHED Published: 2025-03-25T09:00:10.018Z Last Updated: 2025-03-31T16:30:11.979Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-125, CWE-119 Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument src.entries leads to out-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Addi
-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300860 - https://vuldb.com/?ctiid.300860 - https://vuldb.com/?submit.517789 - https://github.com/assimp/assimp/issues/6017 - https://github.com/assimp/assimp/issues/6017#issue-2877374161
CVE ID: CVE-2025-2756 State: PUBLISHED Published: 2025-03-25T09:31:04.310Z Last Updated: 2025-03-31T16:26:30.042Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument tmp leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additiona
It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300861 - https://vuldb.com/?ctiid.300861 - https://vuldb.com/?submit.517790 - https://github.com/assimp/assimp/issues/6018 - https://github.com/assimp/assimp/issues/6018#issue-2877375815
CVE ID: CVE-2025-2757 State: PUBLISHED Published: 2025-03-25T09:31:06.160Z Last Updated: 2025-03-31T16:25:42.302Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst
. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300862 - https://vuldb.com/?ctiid.300862 - https://vuldb.com/?submit.517817 - https://github.com/assimp/assimp/issues/6019 - https://github.com/assimp/assimp/issues/6019#issue-2877376386
CVE ID: CVE-2025-2759 State: PUBLISHED Published: 2025-05-22T00:57:49.889Z Last Updated: 2025-05-22T13:35:22.940Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GStreamer Products: GStreamer Problem Types: CWE-732 Description: GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An atta
The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25448. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-268/
CVE ID: CVE-2025-2760 State: PUBLISHED Published: 2025-04-23T16:47:21.455Z Last Updated: 2025-11-03T17:32:23.789Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GIMP Products: GIMP Problem Types: CWE-190 Description: GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, whic
exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-203/
CVE ID: CVE-2025-2761 State: PUBLISHED Published: 2025-04-23T16:47:31.812Z Last Updated: 2025-11-03T17:32:24.718Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GIMP Products: GIMP Problem Types: CWE-787 Description: GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, w
aw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-204/
CVE ID: CVE-2025-2762 State: PUBLISHED Published: 2025-04-23T16:47:46.789Z Last Updated: 2025-04-23T18:20:33.799Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CarlinKit Products: CPC200-CCPA Problem Types: CWE-1326 Description: CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the application system-on-chip (SoC). T
exploit this vulnerability. The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-25948. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-176/
CVE ID: CVE-2025-2763 State: PUBLISHED Published: 2025-04-23T16:48:00.717Z Last Updated: 2025-04-23T18:14:09.276Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CarlinKit Products: CPC200-CCPA Problem Types: CWE-347 Description: CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of update packages on USB drives. The issue results from the lack of proper verificatio
flaw exists within the handling of update packages on USB drives. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24356. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-179/
CVE ID: CVE-2025-2764 State: PUBLISHED Published: 2025-04-23T16:48:43.116Z Last Updated: 2025-04-23T18:08:36.195Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CarlinKit Products: CPC200-CCPA Problem Types: CWE-347 Description: CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of update packages pro
e existing authentication mechanism can be bypassed. The specific flaw exists within the handling of update packages provided to update.cgi. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24355. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-178/
CVE ID: CVE-2025-2765 State: PUBLISHED Published: 2025-04-23T16:48:56.902Z Last Updated: 2025-04-23T18:05:38.533Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: CarlinKit Products: CPC200-CCPA Problem Types: CWE-798 Description: CarlinKit CPC200-CCPA Wireless Hotspot Hard-Coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the wireless hotspot. The issue results from the use of hard-coded credentials. An att
xists within the configuration of the wireless hotspot. The issue results from the use of hard-coded credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-24349. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-177/
CVE ID: CVE-2025-2766 State: PUBLISHED Published: 2025-06-06T18:53:31.631Z Last Updated: 2025-06-09T14:13:21.737Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: 70mai Products: A510 Problem Types: CWE-1393 Description: 70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of 70mai A510. Authentication is not required to exploit this vulnerability. The specific flaw exists within the default configuration of user accounts. The configuration contains default password. An attacker can leverage this vulnerability to bypass authentication and e
The configuration contains default password. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the root. Was ZDI-CAN-24996. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-180/
CVE ID: CVE-2025-2767 State: PUBLISHED Published: 2025-04-23T16:51:13.474Z Last Updated: 2025-04-23T18:04:24.256Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Arista Products: NG Firewall Problem Types: CWE-79 Description: Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the processing of the User-Agent HTTP header. The issue results from the lack of proper validation of user-supplied data, which can lead
f the User-Agent HTTP header. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24407. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-181/
CVE ID: CVE-2025-2768 State: PUBLISHED Published: 2025-04-23T16:51:28.112Z Last Updated: 2025-04-23T18:03:14.680Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Bdrive Products: NetDrive Problem Types: CWE-427 Description: Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Bdrive NetDrive. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration fil