Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54733 State: PUBLISHED Published: 2025-08-28T12:37:38.529Z Last Updated: 2025-08-28T13:39:40.398Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Miles Products: All Bootstrap Blocks Problem Types: CWE-862 Description: Missing Authorization vulnerability in Miles All Bootstrap Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects All Bootstrap Blocks: from n/a through 1.3.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/all-bootstrap-blocks/vulnerability/wordpress-all-bootstrap-blocks-plugin-1-3-28-broken-access-control-vulnerabi
s/plugin/all-bootstrap-blocks/vulnerability/wordpress-all-bootstrap-blocks-plugin-1-3-28-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54734 State: PUBLISHED Published: 2025-08-28T12:37:39.117Z Last Updated: 2025-08-28T13:36:29.482Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: bPlugins Products: B Slider Problem Types: CWE-862 Description: Missing Authorization vulnerability in bPlugins B Slider allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B Slider: from n/a through 1.1.30. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/b-slider/vulnerability/wordpress-b-slider-plugin-1-1-30-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54735 State: PUBLISHED Published: 2025-08-20T08:02:50.749Z Last Updated: 2025-08-20T15:15:47.792Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Emraan Cheema Products: CubeWP Framework Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Emraan Cheema CubeWP Framework allows Privilege Escalation. This issue affects CubeWP Framework: from n/a through 1.1.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cubewp-framework/vulnerability/wordpress-cubewp-framework-plugin-1-1-24-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-54736 State: PUBLISHED Published: 2025-08-14T18:21:38.816Z Last Updated: 2025-08-14T19:34:11.690Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: NordicMade Products: Savoy Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy allows Retrieve Embedded Sensitive Data. This issue affects Savoy: from n/a through 3.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/savoy/vulnerability/wordpress-savoy-theme-plugin-3-0-8-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-54737 State: PUBLISHED Published: 2025-11-06T15:54:17.806Z Last Updated: 2025-11-13T10:33:42.635Z Vendors: NooTheme Products: Jobmonster Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-7-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54738 State: PUBLISHED Published: 2025-08-28T12:37:39.678Z Last Updated: 2025-08-28T13:28:32.400Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NooTheme Products: Jobmonster Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster allows Authentication Abuse. This issue affects Jobmonster: from n/a through 4.7.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-7-9-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-54739 State: PUBLISHED Published: 2025-08-14T18:21:38.205Z Last Updated: 2025-08-14T19:53:36.791Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: POSIMYTH Products: Nexter Blocks Problem Types: CWE-862 Description: Missing Authorization vulnerability in POSIMYTH Nexter Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexter Blocks: from n/a through 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-plus-addons-for-block-editor/vulnerability/wordpress-nexter-blocks-plugin-plugin-4-5-4-broken-access-control-vulnerability?
s-addons-for-block-editor/vulnerability/wordpress-nexter-blocks-plugin-plugin-4-5-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54740 State: PUBLISHED Published: 2025-08-14T18:21:37.483Z Last Updated: 2025-08-14T19:58:22.284Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Michael Nelson Products: Print My Blog Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog allows Stored XSS. This issue affects Print My Blog: from n/a through 3.27.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/print-my-blog/vulnerability/wordpress-print-my-blog-plugin-plugin-3-27-9-cross-site-scripting-xss-vulnerab
dpress/plugin/print-my-blog/vulnerability/wordpress-print-my-blog-plugin-plugin-3-27-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54742 State: PUBLISHED Published: 2025-08-28T12:37:40.246Z Last Updated: 2025-08-28T13:26:21.650Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: magepeopleteam Products: WpEvently Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently allows Object Injection. This issue affects WpEvently: from n/a through 4.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-4-4-8-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54744 State: PUBLISHED Published: 2025-09-05T16:15:39.296Z Last Updated: 2025-09-05T18:21:48.629Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Stylemix Products: MasterStudy LMS Problem Types: CWE-862 Description: Missing Authorization vulnerability in Stylemix MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.6.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-6-15-broken-access-control-v
masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-6-15-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54746 State: PUBLISHED Published: 2025-08-14T18:21:36.347Z Last Updated: 2025-08-14T20:11:39.751Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: cartpauj Products: Shortcode Redirect Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj Shortcode Redirect allows Stored XSS. This issue affects Shortcode Redirect: from n/a through 1.0.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shortcode-redirect/vulnerability/wordpress-shortcode-redirect-plugin-plugin-1-0-02-cross-site-scripting
wordpress/plugin/shortcode-redirect/vulnerability/wordpress-shortcode-redirect-plugin-plugin-1-0-02-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54747 State: PUBLISHED Published: 2025-08-14T18:21:35.789Z Last Updated: 2025-08-15T12:53:04.467Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: wpbakery Products: Templatera Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbakery Templatera allows DOM-Based XSS. This issue affects Templatera: from n/a through 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/templatera/vulnerability/wordpress-templatera-plugin-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54749 State: PUBLISHED Published: 2025-08-14T18:21:35.192Z Last Updated: 2025-08-15T12:53:20.053Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetProductGallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery allows Stored XSS. This issue affects JetProductGallery: from n/a through 2.2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-woo-product-gallery/vulnerability/wordpress-jetproductgallery-plugin-plugin-2-2-0-2-cross-site-sc
e/wordpress/plugin/jet-woo-product-gallery/vulnerability/wordpress-jetproductgallery-plugin-plugin-2-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54750 State: PUBLISHED Published: 2025-08-20T08:02:50.191Z Last Updated: 2025-08-20T15:17:47.625Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FunnelKit Products: Funnel Builder by FunnelKit Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FunnelKit Funnel Builder by FunnelKit allows PHP Local File Inclusion. This issue affects Funnel Builder by FunnelKit: from n/a through 3.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/funnel-builder/vulnerability/wordpress-funn
Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-11-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-54752 State: PUBLISHED Published: 2025-07-31T07:21:57.639Z Last Updated: 2025-07-31T15:44:45.539Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Alfasado Inc. Products: PowerCMS Problem Types: CWE-1236 Description: Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.powercms.jp/news/release-powercms-671-531-461.html - https://jvn.jp/en/vu/JVNVU93412964/
CVE ID: CVE-2025-54754 State: PUBLISHED Published: 2025-09-18T21:06:15.053Z Last Updated: 2025-09-19T13:04:14.180Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cognex Products: In-Sight 2000 series, In-Sight 7000 series, In-Sight 8000 series, In-Sight 9000 series, In-Sight Explorer Problem Types: CWE-259 Description: An attacker with adjacent access, without authentication, can exploit this vulnerability to retrieve a hard-coded password embedded in publicly available software. This password can then be used to decrypt sensitive network traffic, affecting the Cognex device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/
fic, affecting the Cognex device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE ID: CVE-2025-54755 State: PUBLISHED Published: 2025-10-15T13:55:55.936Z Last Updated: 2025-10-16T19:51:50.225Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-146 Description: A directory traversal vulnerability exists in TMUI that allows an authenticated attacker to access files which are not limited to the intended files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156801
CVE ID: CVE-2025-54757 State: PUBLISHED Published: 2025-07-31T07:20:30.689Z Last Updated: 2025-07-31T17:28:13.000Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Alfasado Inc. Products: PowerCMS Problem Types: CWE-434 Description: Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.powercms.jp/news/release-powercms-671-531-461.html - https://jvn.jp/en/vu/JVNVU93412964/
CVE ID: CVE-2025-54759 State: PUBLISHED Published: 2025-08-18T21:26:10.126Z Last Updated: 2025-08-19T19:22:23.058Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Santesoft Products: Sante PACS Server Problem Types: CWE-79 Description: Sante PACS Server is vulnerable to stored cross-site scripting. An attacker could inject malicious HTML codes redirecting a user to a malicious webpage and stealing the user's cookie. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-224-01
CVE ID: CVE-2025-54760 State: PUBLISHED Published: 2025-10-16T10:03:19.367Z Last Updated: 2025-10-16T13:58:37.591Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: NEOJAPAN Inc. Products: desknet's NEO Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.desknets.com/neo/support/mainte/17475/ - https://jvn.jp/en/jp/JVN90757550/
CVE ID: CVE-2025-54761 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T20:13:18.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yandaozi/PPress/releases/tag/v0.0.9-beta - https://github.com/quarter77/PPress-CMS_vulnerability_chain_details/blob/main/CVE-2025-54761%20Details.md
CVE ID: CVE-2025-54762 State: PUBLISHED Published: 2025-08-28T08:28:14.302Z Last Updated: 2025-08-28T14:12:10.931Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: DOS Co., Ltd. Products: SS1 Problem Types: CWE-434 Description: SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dos-osaka.co.jp/news/2025/08/250827.html - https://jvn.jp/en/jp/JVN99577552/
CVE ID: CVE-2025-54763 State: PUBLISHED Published: 2025-10-31T05:55:24.573Z Last Updated: 2025-10-31T17:15:10.387Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Century Systems Co., Ltd. Products: FutureNet MA-X series, FutureNet MA-E300 series, FutureNet MA-S series, FutureNet MA-P series, FutureNet IP-K series Problem Types: CWE-78 Description: FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the Web UI of the product may execute an arbitrary OS command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.centurysys.co.jp/backnumber/common/jvnvu9
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.centurysys.co.jp/backnumber/common/jvnvu98191201.html - https://jvn.jp/en/vu/JVNVU98191201/
CVE ID: CVE-2025-54764 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-21T13:55:01.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/ - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-ssbleed-mstep/
CVE ID: CVE-2025-54765 State: PUBLISHED Published: 2025-07-28T23:25:12.409Z Last Updated: 2025-11-03T20:06:32.315Z Vendors: Xorux Products: XorMon-NG Problem Types: CWE-648 Description: An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://korelogic.com/Resources/Advisories/KL-001-2025-013.txt - https://x
hment: - CVE Program Container: References: - https://korelogic.com/Resources/Advisories/KL-001-2025-013.txt - https://xormon.com/note190.php
CVE ID: CVE-2025-54766 State: PUBLISHED Published: 2025-07-28T23:16:13.316Z Last Updated: 2025-11-03T20:06:33.686Z Vendors: Xorux Products: XorMon-NG Problem Types: CWE-648 Description: An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://korelogic.com/Resources/Advisories/KL-001-2025-012.txt - https://xormon.com/note190.php
CVE ID: CVE-2025-54767 State: PUBLISHED Published: 2025-07-28T23:28:27.996Z Last Updated: 2025-11-03T20:06:35.060Z Vendors: Xorux Products: LPAR2RRD Problem Types: CWE-648 Description: An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://korelogic.com/Resources/Advisories/KL-001-2025-014.txt - https://lpar2rrd.com/note800.php
CVE ID: CVE-2025-54768 State: PUBLISHED Published: 2025-07-28T23:31:09.836Z Last Updated: 2025-11-03T20:06:36.441Z Vendors: Xorux Products: LPAR2RRD Problem Types: CWE-648 Description: An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://korelogic.com/Resources/Advisories/KL-001-2025-015.txt - https://lpar2rrd.com/note800.php
CVE ID: CVE-2025-54769 State: PUBLISHED Published: 2025-07-28T23:34:38.972Z Last Updated: 2025-11-03T20:06:37.868Z Vendors: Xorux Products: LPAR2RRD Problem Types: CWE-24, CWE-434, CWE-648 Description: An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://korelogic.com/Resources/Advisories/KL-001-2025-016.txt - https://lpar2rrd.com/note800.php
CVE ID: CVE-2025-54770 State: PUBLISHED Published: 2025-11-18T18:30:10.347Z Last Updated: 2025-11-19T21:37:04.107Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-825 Description: A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker
cause the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-54770 - https://bugzilla.redhat.com/show_bug.cgi?id=2413813
CVE ID: CVE-2025-54771 State: PUBLISHED Published: 2025-11-18T18:20:40.350Z Last Updated: 2025-11-19T21:41:06.871Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-825 Description: A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub
ter, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-54771 - https://bugzilla.redhat.com/show_bug.cgi?id=2413823
CVE ID: CVE-2025-54777 State: PUBLISHED Published: 2025-08-29T06:16:38.053Z Last Updated: 2025-08-29T11:55:53.854Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Konica Minolta, Inc. Products: Multiple products in bizhub series Problem Types: CWE-248 Description: Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of-service issue that disable the Web Connection feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.konicaminolta.jp/business/support/important/250829_01_01.html - https://jvn.jp/en/vu/JVNVU99831542/
CVE ID: CVE-2025-54780 State: PUBLISHED Published: 2025-08-05T00:08:37.728Z Last Updated: 2025-08-05T14:14:53.642Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: cconard96 Products: glpi-screenshot-plugin Problem Types: CWE-73 Description: The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from the system or use PHP wrappers. This is fixed in version 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cconard96/glpi-screenshot-plugin/security/advisories/GHSA-x6mp-jhxw-9xrp
Vulnrichment: References: - https://github.com/cconard96/glpi-screenshot-plugin/security/advisories/GHSA-x6mp-jhxw-9xrp - https://github.com/cconard96/glpi-screenshot-plugin/commit/49215b53a05dc792719b69c098df80100208c2c8