Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55019 State: REJECTED Published: N/A Last Updated: 2025-08-06T02:55:08.467Z Description: No description available.
CVE ID: CVE-2025-55020 State: REJECTED Published: N/A Last Updated: 2025-08-06T02:55:07.961Z Description: No description available.
CVE ID: CVE-2025-55021 State: REJECTED Published: N/A Last Updated: 2025-08-06T02:55:07.508Z Description: No description available.
CVE ID: CVE-2025-55022 State: REJECTED Published: N/A Last Updated: 2025-08-06T02:55:07.034Z Description: No description available.
CVE ID: CVE-2025-55023 State: REJECTED Published: N/A Last Updated: 2025-08-06T02:55:06.484Z Description: No description available.
CVE ID: CVE-2025-55024 State: REJECTED Published: N/A Last Updated: 2025-08-06T02:55:06.043Z Description: No description available.
CVE ID: CVE-2025-55025 State: REJECTED Published: N/A Last Updated: 2025-08-06T02:55:05.624Z Description: No description available.
CVE ID: CVE-2025-55026 State: REJECTED Published: N/A Last Updated: 2025-08-06T02:55:05.173Z Description: No description available.
CVE ID: CVE-2025-55027 State: REJECTED Published: N/A Last Updated: 2025-08-06T02:55:04.701Z Description: No description available.
CVE ID: CVE-2025-55028 State: PUBLISHED Published: 2025-08-19T20:52:49.372Z Last Updated: 2025-10-30T16:14:23.862Z Vendors: Mozilla Products: Firefox for iOS Description: Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks This vulnerability affects Firefox for iOS < 142. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1850240 - https://www.mozilla.org/security/advisories/mfsa2025-68/
CVE ID: CVE-2025-55029 State: PUBLISHED Published: 2025-08-19T20:52:50.120Z Last Updated: 2025-10-30T16:14:27.492Z Vendors: Mozilla Products: Firefox for iOS Description: Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks This vulnerability affects Firefox for iOS < 142. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1973577 - https://www.mozilla.org/security/advisories/mfsa2025-68/
CVE ID: CVE-2025-55030 State: PUBLISHED Published: 2025-08-19T20:52:48.953Z Last Updated: 2025-10-30T16:14:20.737Z Vendors: Mozilla Products: Firefox for iOS Description: Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks This vulnerability affects Firefox for iOS < 142. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1976304 - https://www.mozilla.org/security/advisories/mfsa2025-68/
CVE ID: CVE-2025-55031 State: PUBLISHED Published: 2025-08-19T20:52:49.748Z Last Updated: 2025-10-30T16:11:09.283Z Vendors: Mozilla Products: Firefox for iOS, Focus for iOS Description: Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target account. This vulnerability affects Firefox for iOS < 142 and Focus for iOS < 142. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1979499 - https://bugzilla.mozilla.org/show_bug.cgi?id=197980
References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1979499 - https://bugzilla.mozilla.org/show_bug.cgi?id=1979804 - https://www.mozilla.org/security/advisories/mfsa2025-68/ - https://www.mozilla.org/security/advisories/mfsa2025-69/
CVE ID: CVE-2025-55032 State: PUBLISHED Published: 2025-08-19T20:52:50.397Z Last Updated: 2025-10-30T16:11:02.847Z Vendors: Mozilla Products: Focus for iOS Description: Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks This vulnerability affects Focus for iOS < 142. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1976296 - https://www.mozilla.org/security/advisories/mfsa2025-69/
CVE ID: CVE-2025-55033 State: PUBLISHED Published: 2025-08-19T20:52:51.056Z Last Updated: 2025-10-30T16:11:06.059Z Vendors: Mozilla Products: Focus for iOS Description: Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks This vulnerability affects Focus for iOS < 142. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1913825 - https://www.mozilla.org/security/advisories/mfsa2025-69/
CVE ID: CVE-2025-55034 State: PUBLISHED Published: 2025-11-14T23:22:29.031Z Last Updated: 2025-11-17T14:53:32.111Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: General Industrial Controls Products: Lynx+ Gateway Problem Types: CWE-521 Description: General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-08 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317
events/ics-advisories/icsa-25-317-08 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-08.json
CVE ID: CVE-2025-55035 State: PUBLISHED Published: 2025-10-16T15:18:25.389Z Last Updated: 2025-10-16T16:28:05.951Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-754 Description: Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having the user configure the malicious server and forcing a modal popup that cannot be closed. Additional Analyst Notes: - CISA ADP Vulnrichment:
the malicious server and forcing a modal popup that cannot be closed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-55036 State: PUBLISHED Published: 2025-10-15T13:55:46.932Z Last Updated: 2025-10-16T03:56:34.423Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-787 Description: When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000151368
CVE ID: CVE-2025-55037 State: PUBLISHED Published: 2025-09-05T05:24:41.118Z Last Updated: 2025-09-05T14:52:47.833Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: kujirahand Products: TkEasyGUI Problem Types: CWE-78 Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote unauthenticated attacker if the settings are configured to construct messages from external sources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kujirahand/tkeasyg
external sources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kujirahand/tkeasygui-python/releases/tag/v1.0.22 - https://jvn.jp/en/jp/JVN48739895/
CVE ID: CVE-2025-55038 State: PUBLISHED Published: 2025-09-23T22:24:28.676Z Last Updated: 2025-09-24T14:07:38.232Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: AutomationDirect Products: CLICK PLUS C0-0x CPU firmware, CLICK PLUS C0-1x CPU firmware, CLICK PLUS C2-x CPU firmware Problem Types: CWE-862 Description: An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level. Additi
ssions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01 - https://www.automationdirect.com/support/software-downloads
CVE ID: CVE-2025-55039 State: PUBLISHED Published: 2025-10-15T07:19:25.493Z Last Updated: 2025-11-04T21:13:00.940Z Vendors: Apache Software Foundation Products: Apache Spark Problem Types: CWE-347, CWE-326 Description: This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This vulnerability al
defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows. To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org
rity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/zrgyy9l85nm2c7vk36vr7bkyorg3w4qq
CVE ID: CVE-2025-55047 State: PUBLISHED Published: 2025-09-09T18:40:54.248Z Last Updated: 2025-09-10T16:22:49.554Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Baicells Products: SPECTRA LTE-U eNB Problem Types: CWE-798 Description: CWE-798 Use of Hard-coded Credentials Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55048 State: PUBLISHED Published: 2025-09-09T18:45:42.603Z Last Updated: 2025-09-10T16:20:06.700Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Baicells Products: NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOVA246, NOVA243, NOVA233, NOVA227 Problem Types: CWE-78 Description: Multiple CWE-78 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55049 State: PUBLISHED Published: 2025-09-09T18:52:00.329Z Last Updated: 2025-09-10T16:09:54.644Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Baicells Products: NEUTRINO430 Problem Types: CWE-1394 Description: Use of Default Cryptographic Key (CWE-1394) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55050 State: PUBLISHED Published: 2025-09-09T18:56:59.092Z Last Updated: 2025-09-10T14:29:16.462Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Baicells Products: NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846 Problem Types: CWE-1242 Description: CWE-1242: Inclusion of Undocumented Features Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55051 State: PUBLISHED Published: 2025-09-09T19:01:43.249Z Last Updated: 2025-09-10T14:29:10.806Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Baicells Products: NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846 Problem Types: CWE-1392 Description: CWE-1392: Use of Default Credentials Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55052 State: PUBLISHED Published: 2025-09-09T19:06:18.558Z Last Updated: 2025-09-10T20:13:26.229Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Baicells Products: NEUTRINO430, NOVA436Q, NOVA430e/430i, NOVA846, NOVA246, NOVA243, NOVA233, NOVA227 Problem Types: CWE-200 Description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55053 State: PUBLISHED Published: 2025-09-09T19:10:49.874Z Last Updated: 2025-09-10T14:03:48.775Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Baicells Products: NOVA430e/430i, NOVA436Q, NEUTRINO430, NOVA846 Problem Types: CWE-328 Description: CWE-328: Use of Weak Hash Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55054 State: PUBLISHED Published: 2025-09-09T19:14:20.330Z Last Updated: 2025-09-10T14:03:32.964Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Baicells Products: EG7035E-M11 Problem Types: CWE-79 Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55055 State: PUBLISHED Published: 2025-11-17T17:25:36.697Z Last Updated: 2025-11-17T21:24:53.295Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Rumpus Products: FTP Server Problem Types: CWE-78 Description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55056 State: PUBLISHED Published: 2025-11-17T17:28:28.345Z Last Updated: 2025-11-17T21:24:21.835Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Rumpus Products: FTP Server Problem Types: CWE-79 Description: Multiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55057 State: PUBLISHED Published: 2025-11-17T17:31:23.641Z Last Updated: 2025-11-17T21:21:55.928Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) Vendors: Rumpus Products: FTP Server Problem Types: CWE-352 Description: Multiple CWE-352 Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55058 State: PUBLISHED Published: 2025-11-17T17:33:55.882Z Last Updated: 2025-11-18T16:36:00.451Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Rumpus Products: FTP Server Problem Types: CWE-20 Description: CWE-20 Improper Input Validation Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55059 State: PUBLISHED Published: 2025-11-17T17:36:20.332Z Last Updated: 2025-11-18T16:35:38.079Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Rumpus Products: FTP Server Problem Types: CWE-79 Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-55067 State: PUBLISHED Published: 2025-10-23T19:39:14.879Z Last Updated: 2025-10-23T20:30:20.323Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Veeder-Root Products: TLS4B Automatic Tank Gauge System Problem Types: CWE-190 Description: The TLS4B ATG system is vulnerable to improper handling of Unix time values that exceed the 2038 epoch rollover. When the system clock reaches January 19, 2038, it resets to December 13, 1901, causing authentication failures and disrupting core system functionalities such as login access, history visibility, and leak detection termination. This vulnerability could allow an attacker to manipulate the system tim
tory visibility, and leak detection termination. This vulnerability could allow an attacker to manipulate the system time to trigger a denial of service (DoS) condition, leading to administrative lockout, operational timer failures, and corrupted log entries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-03 - https://www.veeder.com/us/network-security-reminder - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-03.json
CVE ID: CVE-2025-55068 State: PUBLISHED Published: 2025-09-18T20:42:29.547Z Last Updated: 2025-09-19T13:06:42.627Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Dover Fueling Solutions Products: ProGauge MagLink LX 4, ProGauge MagLink LX Plus, ProGauge MagLink LX Ultimate Problem Types: CWE-190 Description: Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacker can manually change the system time to exploit this limitation, potentially causing errors in authentication and leading to a denial-of-service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa
ding to a denial-of-service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07 - https://www.doverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.html
CVE ID: CVE-2025-55069 State: PUBLISHED Published: 2025-09-23T22:15:46.833Z Last Updated: 2025-09-24T14:07:59.115Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: AutomationDirect Products: CLICK PLUS C0-0x CPU firmware, CLICK PLUS C0-1x CPU firmware, CLICK PLUS C2-x CPU firmware Problem Types: CWE-337 Description: A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software implements a predictable seed for its pseudo-random number generator, which compromises the security of the generated private keys. Additional Analyst Notes: - C
udo-random number generator, which compromises the security of the generated private keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01 - https://www.automationdirect.com/support/software-downloads
CVE ID: CVE-2025-55070 State: PUBLISHED Published: 2025-11-14T08:02:24.764Z Last Updated: 2025-11-14T15:47:52.338Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-306 Description: Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-55072 State: PUBLISHED Published: 2025-10-16T10:03:29.945Z Last Updated: 2025-10-16T13:53:55.892Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: NEOJAPAN Inc. Products: desknet's NEO Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.desknets.com/neo/support/mainte/17475/ - https://jvn.jp/en/jp/JVN90757550/
CVE ID: CVE-2025-55073 State: PUBLISHED Published: 2025-11-14T08:03:16.922Z Last Updated: 2025-11-14T15:46:58.129Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-306 Description: Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-55074 State: PUBLISHED Published: 2025-11-18T15:23:29.642Z Last Updated: 2025-11-18T21:03:22.890Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-1426 Description: Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-55075 State: PUBLISHED Published: 2025-09-17T03:08:37.275Z Last Updated: 2025-09-17T13:38:05.944Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: I-O DATA DEVICE, INC. Products: WN-7D36QR, WN-7D36QR/UE Problem Types: CWE-912 Description: Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iodata.jp/support/information/2025/09_wn-7d36qr/index.htm - https://jvn.jp/en/vu/JVNVU97490987/
CVE ID: CVE-2025-55077 State: PUBLISHED Published: 2025-08-07T18:37:33.309Z Last Updated: 2025-08-12T15:21:13.885Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Tyler Technologies Products: ERP Pro 9 SaaS Problem Types: CWE-250, CWE-668, CWE-863 Description: Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01. Additional Analyst Notes: - CISA ADP Vulnr
onment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-219-01.json - https://www.cve.org/CVERecord?id=CVE-2025-55077