Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
: - CISA ADP Vulnrichment: References: - https://www.switchbot.jp/pages/switchbot-app-vulnerability-fix202507 - https://jvn.jp/en/jp/JVN59585716/
CVE ID: CVE-2025-53650 State: PUBLISHED Published: 2025-07-09T15:39:26.473Z Last Updated: 2025-11-04T21:11:52.810Z Vendors: Jenkins Project Products: Jenkins Credentials Binding Plugin Description: Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3499
CVE ID: CVE-2025-53651 State: PUBLISHED Published: 2025-07-09T15:39:27.086Z Last Updated: 2025-11-04T21:11:54.112Z Vendors: Jenkins Project Products: Jenkins HTML Publisher Plugin Description: Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-build step, exposing information about the Jenkins controller file system in the build log. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3547
CVE ID: CVE-2025-53652 State: PUBLISHED Published: 2025-07-09T15:39:27.816Z Last Updated: 2025-11-04T21:11:55.418Z Vendors: Jenkins Project Products: Jenkins Git Parameter Plugin Description: Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3419
CVE ID: CVE-2025-53653 State: PUBLISHED Published: 2025-07-09T15:39:28.429Z Last Updated: 2025-11-04T21:11:56.727Z Vendors: Jenkins Project Products: Jenkins Aqua Security Scanner Plugin Description: Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3542
CVE ID: CVE-2025-53654 State: PUBLISHED Published: 2025-07-09T15:39:29.010Z Last Updated: 2025-11-04T21:11:58.078Z Vendors: Jenkins Project Products: Jenkins Statistics Gatherer Plugin Description: Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3554
CVE ID: CVE-2025-53655 State: PUBLISHED Published: 2025-07-09T15:39:29.610Z Last Updated: 2025-11-04T21:11:59.389Z Vendors: Jenkins Project Products: Jenkins Statistics Gatherer Plugin Description: Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3554
CVE ID: CVE-2025-53656 State: PUBLISHED Published: 2025-07-09T15:39:30.211Z Last Updated: 2025-11-04T21:12:00.701Z Vendors: Jenkins Project Products: Jenkins ReadyAPI Functional Testing Plugin Description: Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3556
CVE ID: CVE-2025-53657 State: PUBLISHED Published: 2025-07-09T15:39:30.813Z Last Updated: 2025-11-04T21:12:04.123Z Vendors: Jenkins Project Products: Jenkins ReadyAPI Functional Testing Plugin Description: Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3556
CVE ID: CVE-2025-53658 State: PUBLISHED Published: 2025-07-09T15:39:31.371Z Last Updated: 2025-11-04T21:12:05.516Z Vendors: Jenkins Project Products: Jenkins Applitools Eyes Plugin Description: Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3509
CVE ID: CVE-2025-53659 State: PUBLISHED Published: 2025-07-09T15:39:31.936Z Last Updated: 2025-11-04T21:12:06.831Z Vendors: Jenkins Project Products: Jenkins QMetry Test Management Plugin Description: Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3532
CVE ID: CVE-2025-53660 State: PUBLISHED Published: 2025-07-09T15:39:32.515Z Last Updated: 2025-11-04T21:12:08.150Z Vendors: Jenkins Project Products: Jenkins QMetry Test Management Plugin Description: Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3532
CVE ID: CVE-2025-53661 State: PUBLISHED Published: 2025-07-09T15:39:33.106Z Last Updated: 2025-11-04T21:12:09.461Z Vendors: Jenkins Project Products: Jenkins Testsigma Test Plan run Plugin Description: Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3515
CVE ID: CVE-2025-53662 State: PUBLISHED Published: 2025-07-09T15:39:33.696Z Last Updated: 2025-11-04T21:12:10.807Z Vendors: Jenkins Project Products: Jenkins IFTTT Build Notifier Plugin Description: Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3541
CVE ID: CVE-2025-53663 State: PUBLISHED Published: 2025-07-09T15:39:34.283Z Last Updated: 2025-11-04T21:12:12.141Z Vendors: Jenkins Project Products: Jenkins IBM Cloud DevOps Plugin Description: Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3552
CVE ID: CVE-2025-53664 State: PUBLISHED Published: 2025-07-09T15:39:34.872Z Last Updated: 2025-11-04T21:12:13.485Z Vendors: Jenkins Project Products: Jenkins Apica Loadtest Plugin Description: Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3540
CVE ID: CVE-2025-53665 State: PUBLISHED Published: 2025-07-09T15:39:35.465Z Last Updated: 2025-11-04T21:12:14.806Z Vendors: Jenkins Project Products: Jenkins Apica Loadtest Plugin Description: Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3540
CVE ID: CVE-2025-53666 State: PUBLISHED Published: 2025-07-09T15:39:36.057Z Last Updated: 2025-11-04T21:12:16.117Z Vendors: Jenkins Project Products: Jenkins Dead Man's Snitch Plugin Description: Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3524
CVE ID: CVE-2025-53667 State: PUBLISHED Published: 2025-07-09T15:39:36.655Z Last Updated: 2025-11-04T21:12:17.441Z Vendors: Jenkins Project Products: Jenkins Dead Man's Snitch Plugin Description: Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3524
CVE ID: CVE-2025-53668 State: PUBLISHED Published: 2025-07-09T15:39:37.219Z Last Updated: 2025-11-04T21:12:18.771Z Vendors: Jenkins Project Products: Jenkins VAddy Plugin Description: Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3527
CVE ID: CVE-2025-53669 State: PUBLISHED Published: 2025-07-09T15:39:37.810Z Last Updated: 2025-11-04T21:12:20.072Z Vendors: Jenkins Project Products: Jenkins VAddy Plugin Description: Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3527
CVE ID: CVE-2025-53670 State: PUBLISHED Published: 2025-07-09T15:39:38.401Z Last Updated: 2025-11-04T21:12:21.396Z Vendors: Jenkins Project Products: Jenkins Nouvola DiveCloud Plugin Description: Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3526
CVE ID: CVE-2025-53671 State: PUBLISHED Published: 2025-07-09T15:39:39.001Z Last Updated: 2025-11-04T21:12:22.703Z Vendors: Jenkins Project Products: Jenkins Nouvola DiveCloud Plugin Description: Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3526
CVE ID: CVE-2025-53672 State: PUBLISHED Published: 2025-07-09T15:39:39.579Z Last Updated: 2025-11-04T21:12:24.023Z Vendors: Jenkins Project Products: Jenkins Kryptowire Plugin Description: Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3525
CVE ID: CVE-2025-53673 State: PUBLISHED Published: 2025-07-09T15:39:40.223Z Last Updated: 2025-11-04T21:12:25.350Z Vendors: Jenkins Project Products: Jenkins Sensedia Api Platform tools Plugin Description: Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3551
CVE ID: CVE-2025-53674 State: PUBLISHED Published: 2025-07-09T15:39:40.807Z Last Updated: 2025-11-04T21:12:26.666Z Vendors: Jenkins Project Products: Jenkins Sensedia Api Platform tools Plugin Description: Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3551
CVE ID: CVE-2025-53675 State: PUBLISHED Published: 2025-07-09T15:39:41.411Z Last Updated: 2025-11-04T21:12:28.011Z Vendors: Jenkins Project Products: Jenkins Warrior Framework Plugin Description: Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3516
CVE ID: CVE-2025-53676 State: PUBLISHED Published: 2025-07-09T15:39:41.984Z Last Updated: 2025-11-04T21:12:29.348Z Vendors: Jenkins Project Products: Jenkins Xooa Plugin Description: Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3522
CVE ID: CVE-2025-53677 State: PUBLISHED Published: 2025-07-09T15:39:42.556Z Last Updated: 2025-11-04T21:12:30.661Z Vendors: Jenkins Project Products: Jenkins Xooa Plugin Description: Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3522
CVE ID: CVE-2025-53678 State: PUBLISHED Published: 2025-07-09T15:39:43.280Z Last Updated: 2025-11-04T21:12:31.951Z Vendors: Jenkins Project Products: Jenkins User1st uTester Plugin Description: Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3518
CVE ID: CVE-2025-53682 State: REJECTED Published: N/A Last Updated: 2025-07-09T02:55:07.613Z Description: No description available.
CVE ID: CVE-2025-53683 State: REJECTED Published: N/A Last Updated: 2025-07-09T02:55:07.091Z Description: No description available.
CVE ID: CVE-2025-53684 State: REJECTED Published: N/A Last Updated: 2025-07-09T02:55:06.613Z Description: No description available.
CVE ID: CVE-2025-53685 State: REJECTED Published: N/A Last Updated: 2025-07-09T02:55:06.123Z Description: No description available.
CVE ID: CVE-2025-53686 State: REJECTED Published: N/A Last Updated: 2025-07-09T02:55:05.637Z Description: No description available.
CVE ID: CVE-2025-53687 State: REJECTED Published: N/A Last Updated: 2025-07-09T02:55:05.052Z Description: No description available.
CVE ID: CVE-2025-53688 State: REJECTED Published: N/A Last Updated: 2025-07-09T02:55:04.465Z Description: No description available.
CVE ID: CVE-2025-53689 State: PUBLISHED Published: 2025-07-14T09:15:38.863Z Last Updated: 2025-11-04T21:12:33.255Z Vendors: Apache Software Foundation Products: Apache Jackrabbit Problem Types: CWE-611 Description: Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pr
hus users should update to the respective supported version. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24
CVE ID: CVE-2025-53690 State: PUBLISHED Published: 2025-09-03T20:04:48.223Z Last Updated: 2025-10-21T22:45:18.827Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Sitecore Products: Experience Manager (XM), Experience Platform (XP) Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vuln
richment: References: - https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865
CVE ID: CVE-2025-53691 State: PUBLISHED Published: 2025-09-03T12:36:59.561Z Last Updated: 2025-09-03T13:49:39.605Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sitecore Products: Experience Manager (XM), Experience Platform (XP) Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watcht
hrough 9.3, from 10.0 through 10.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/ - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
CVE ID: CVE-2025-53692 State: PUBLISHED Published: 2025-09-21T19:42:46.643Z Last Updated: 2025-09-22T17:27:11.080Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Sitecore Products: Sitecore Experience Manager (XM), Experience Platform (XP) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4. Additional Analyst Notes: - CISA ADP Vulnrichme
from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003734 - https://labs.watchtowr.com/disclosed-vulnerabilities/ - https://chudypb.github.io/
CVE ID: CVE-2025-53693 State: PUBLISHED Published: 2025-09-03T12:36:53.745Z Last Updated: 2025-09-03T13:53:40.699Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sitecore Products: Sitecore Experience Manager (XM), Experience Platform (XP) Problem Types: CWE-470 Description: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4. Additional Analy
gh 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/ - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
CVE ID: CVE-2025-53694 State: PUBLISHED Published: 2025-09-03T12:36:37.520Z Last Updated: 2025-09-03T13:57:58.828Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Sitecore Products: Sitecore Experience Manager (XM), Experience Platform (XP) Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/cache-me-if-you-can-s
10.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/ - https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003734
CVE ID: CVE-2025-53695 State: PUBLISHED Published: 2025-07-28T14:05:36.623Z Last Updated: 2025-08-19T14:43:14.865Z Vendors: Johnson Controls, Inc Products: iSTAR Ultra Problem Types: CWE-78 Description: OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-03.txt