Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54804 State: PUBLISHED Published: 2025-08-05T00:05:20.971Z Last Updated: 2025-08-05T14:44:05.415Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Eugeny Products: russh Problem Types: CWE-190 Description: Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can c
result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. This is fixed in version 0.54.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm - https://github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5
CVE ID: CVE-2025-54805 State: PUBLISHED Published: 2025-10-15T13:55:48.872Z Last Updated: 2025-10-16T03:56:47.323Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Next SPK, BIG-IP Next CNF, BIG-IP Next for Kubernetes Problem Types: CWE-401 Description: When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can cause an increase in the Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manag
pport (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000151596
CVE ID: CVE-2025-54806 State: PUBLISHED Published: 2025-10-23T04:10:59.281Z Last Updated: 2025-10-23T15:05:14.336Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GROWI, Inc. Products: GROWI Problem Types: CWE-79 Description: GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://growi.co.jp/news/38/ - https://jvn.jp/en/jp/JVN46526244/
CVE ID: CVE-2025-54807 State: PUBLISHED Published: 2025-09-18T20:44:04.094Z Last Updated: 2025-09-19T13:06:19.294Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dover Fueling Solutions Products: ProGauge MagLink LX 4, ProGauge MagLink LX Plus, ProGauge MagLink LX Ultimate Problem Types: CWE-321 Description: The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07 - https://w
Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07 - https://www.doverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.html
CVE ID: CVE-2025-54808 State: PUBLISHED Published: 2025-10-23T18:21:19.252Z Last Updated: 2025-10-28T14:04:15.631Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Oxford Nano Technologies Products: MinKNOW Problem Types: CWE-522 Description: Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory (/tmp) on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the token is leaked (e.g., via malware infection or other local exploit), and remote access is enabled, it can be used to establish
leaked (e.g., via malware infection or other local exploit), and remote access is enabled, it can be used to establish unauthorized remote connections to the sequencer. Remote access must be enabled for remote exploitation to succeed. This may occur either because the user has enabled remote access for legitimate operational reasons or because malware with elevated privileges (e.g., sudo access) enables it without user consent. This vulnerability can be chained with remote access capabilities to generate a developer token from a remote device. Developer tokens can be created with arbitrary expiration dates, enabling persistent access to the sequencer and bypassing standard authentication me
ed with arbitrary expiration dates, enabling persistent access to the sequencer and bypassing standard authentication mechanisms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-294-01 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsma-25-294-01.json - https://nanoporetech.com/software/ - https://nanoporetech.com/about/contact
CVE ID: CVE-2025-54809 State: PUBLISHED Published: 2025-08-13T14:46:53.466Z Last Updated: 2025-08-13T14:59:48.855Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: F5 Products: F5 Access Problem Types: CWE-295 Description: F5 Access for Android before version 3.1.2 which uses HTTPS does not verify the remote endpoint identity. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000152049
CVE ID: CVE-2025-54810 State: PUBLISHED Published: 2025-09-18T21:28:19.297Z Last Updated: 2025-09-19T13:11:33.376Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cognex Products: In-Sight 2000 series, In-Sight 7000 series, In-Sight 8000 series, In-Sight 9000 series, In-Sight Explorer Problem Types: CWE-294 Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying system properties. The user management functionality handles sensitive data such as registered usernames and passwords over an unencrypted channel, allowing an adjacent attacker to intercept valid
such as registered usernames and passwords over an unencrypted channel, allowing an adjacent attacker to intercept valid credentials to gain access to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE ID: CVE-2025-54811 State: PUBLISHED Published: 2025-10-01T21:22:31.015Z Last Updated: 2025-10-02T15:53:32.988Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: OpenPLC_V3 Products: OpenPLC_V3 Problem Types: CWE-758 Description: OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends and execution hits an illegal ud2 instruction. This issue can be triggered remotely without authentication by starting the same server multiple times or if the server exits unexpectedly. The vulnerability allows an attacker to cause a Denial of Service (DoS) against the PLC runtime,
er exits unexpectedly. The vulnerability allows an attacker to cause a Denial of Service (DoS) against the PLC runtime, stopping any PC started remotely without authentication. This results in the PLC process crashing and halting all automation or control logic managed by OpenPLC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-05 - https://github.com/thiagoralves/OpenPLC_v3
CVE ID: CVE-2025-54812 State: PUBLISHED Published: 2025-08-22T18:46:46.205Z Last Updated: 2025-11-04T21:12:52.982Z Vendors: Apache Software Foundation Products: Apache Log4cxx Problem Types: CWE-117 Description: Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user. In order to activate this, the following sequence must occur: * Log4cxx is configured to use HTMLLayout. * Logger name comes from an
ctivate this, the following sequence must occur: * Log4cxx is configured to use HTMLLayout. * Logger name comes from an untrusted string * Logger with compromised name logs a message * User opens the generated HTML log file in their browser, leading to potential XSS Because logger names are generally constant strings, we assess the impact to users as LOW This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://logging.apache.org/security.html#CVE-2025-54812 - https://github.com/apache/logging-log4cxx/pull/509 - https://github.com/
gging.apache.org/security.html#CVE-2025-54812 - https://github.com/apache/logging-log4cxx/pull/509 - https://github.com/apache/logging-log4cxx/pull/514
CVE ID: CVE-2025-54813 State: PUBLISHED Published: 2025-08-22T18:45:42.611Z Last Updated: 2025-11-04T21:12:54.283Z Vendors: Apache Software Foundation Products: Apache Log4cxx Problem Types: CWE-117 Description: Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to u
ly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://logging.apache.org/security.html#CVE-2025-54813 - https://github.com/apache/logging-log4cxx/pull/512
CVE ID: CVE-2025-54815 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T20:05:39.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side template injection (SSTI) vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yandaozi/PPress/releases/tag/v0.0.9-beta - https://github.com/quarter77/PPress-CMS_vulnerability_chain_details/blob/main/CVE-2025-54815%20Details.md
CVE ID: CVE-2025-54818 State: PUBLISHED Published: 2025-09-18T21:26:45.354Z Last Updated: 2025-09-19T13:12:06.509Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cognex Products: In-Sight 2000 series, In-Sight 7000 series, In-Sight 8000 series, In-Sight 9000 series, In-Sight Explorer Problem Types: CWE-319 Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying system properties. The user management functionality handles sensitive data such as registered usernames and passwords over an unencrypted channel, allowing an adjacent attacker to intercept valid
CVE ID: CVE-2025-54819 State: PUBLISHED Published: 2025-08-28T08:28:24.751Z Last Updated: 2025-08-28T13:45:19.835Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: DOS Co., Ltd. Products: SS1, SS1 Cloud Problem Types: CWE-22 Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, legitimate files may be overwritten by a remote authenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dos-osaka.co.jp/news/2025/08/250827.html - https://jvn.jp/en/jp/JVN99577552/
CVE ID: CVE-2025-54821 State: PUBLISHED Published: 2025-11-18T17:01:22.231Z Last Updated: 2025-11-18T20:04:58.245Z Severity: LOW (CVSS 1.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiProxy, FortiOS, FortiPAM Problem Types: CWE-269 Description: An Improper Privilege Management vulnerability [CWE-269] in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.
l versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-545
CVE ID: CVE-2025-54822 State: PUBLISHED Published: 2025-10-14T15:23:47.676Z Last Updated: 2025-10-14T17:35:56.532Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-285 Description: An improper authorization vulnerability [CWE-285] in Fortinet FortiOS version 7.4.0 through 7.4.1 and before 7.2.8 & Fortinet FortiProxy before version 7.4.8 allows an authenticated attacker to access static files of others VDOMs via crafted HTTP or HTTPS requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-684
CVE ID: CVE-2025-54823 State: REJECTED Published: N/A Last Updated: 2025-07-31T02:55:08.703Z Description: No description available.
CVE ID: CVE-2025-54824 State: REJECTED Published: N/A Last Updated: 2025-07-31T02:55:08.236Z Description: No description available.
CVE ID: CVE-2025-54825 State: REJECTED Published: N/A Last Updated: 2025-07-31T02:55:07.642Z Description: No description available.
CVE ID: CVE-2025-54826 State: REJECTED Published: N/A Last Updated: 2025-07-31T02:55:07.138Z Description: No description available.
CVE ID: CVE-2025-54827 State: REJECTED Published: N/A Last Updated: 2025-07-31T02:55:06.660Z Description: No description available.
CVE ID: CVE-2025-54828 State: REJECTED Published: N/A Last Updated: 2025-07-31T02:55:06.091Z Description: No description available.
CVE ID: CVE-2025-54829 State: REJECTED Published: N/A Last Updated: 2025-07-31T02:55:05.537Z Description: No description available.
CVE ID: CVE-2025-54831 State: PUBLISHED Published: 2025-09-26T07:28:59.066Z Last Updated: 2025-11-04T21:12:55.586Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-213 Description: Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_V
with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option. This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior. Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf
CVE ID: CVE-2025-54832 State: PUBLISHED Published: 2025-07-31T17:25:27.272Z Last Updated: 2025-08-07T18:45:45.102Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: OPEXUS Products: FOIAXpress Public Access Link (PAL) Problem Types: CWE-472 Description: OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-174-01.json - https://www.cve.org/CVERecord?id=CVE-2025-54832 - https://docs.opexustech.com/docs/foiaxpress/11.12.0/FOI
-174-01.json - https://www.cve.org/CVERecord?id=CVE-2025-54832 - https://docs.opexustech.com/docs/foiaxpress/11.12.0/FOIAXpress_Release_notes_11.12.3.0.pdf
CVE ID: CVE-2025-54833 State: PUBLISHED Published: 2025-07-31T17:26:31.457Z Last Updated: 2025-08-07T18:49:33.918Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OPEXUS Products: FOIAXpress Public Access Link (PAL) Problem Types: CWE-307, CWE-602 Description: OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-174-01.json - https://www.cve.org/CVERecord?id=CVE-2025
rcontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-174-01.json - https://www.cve.org/CVERecord?id=CVE-2025-54833 - https://docs.opexustech.com/docs/foiaxpress/11.12.0/FOIAXpress_Release_notes_11.12.3.0.pdf
CVE ID: CVE-2025-54834 State: PUBLISHED Published: 2025-07-31T17:26:04.606Z Last Updated: 2025-07-31T18:16:59.684Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OPEXUS Products: FOIAXpress Public Access Link (PAL) Problem Types: CWE-204 Description: OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-174-01.json - https:
References: - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-174-01.json - https://www.cve.org/CVERecord?id=CVE-2025-54834 - https://docs.opexustech.com/docs/foiaxpress/11.12.0/FOIAXpress_Release_notes_11.12.3.0.pdf
CVE ID: CVE-2025-54839 State: REJECTED Published: N/A Last Updated: 2025-08-01T02:55:09.021Z Description: No description available.
CVE ID: CVE-2025-54840 State: REJECTED Published: N/A Last Updated: 2025-08-01T02:55:08.548Z Description: No description available.
CVE ID: CVE-2025-54841 State: REJECTED Published: N/A Last Updated: 2025-08-01T02:55:07.941Z Description: No description available.
CVE ID: CVE-2025-54842 State: REJECTED Published: N/A Last Updated: 2025-08-01T02:55:07.483Z Description: No description available.
CVE ID: CVE-2025-54843 State: REJECTED Published: N/A Last Updated: 2025-08-01T02:55:07.027Z Description: No description available.
CVE ID: CVE-2025-54844 State: REJECTED Published: N/A Last Updated: 2025-08-01T02:55:06.573Z Description: No description available.
CVE ID: CVE-2025-54845 State: REJECTED Published: N/A Last Updated: 2025-08-01T02:55:06.130Z Description: No description available.
CVE ID: CVE-2025-54846 State: REJECTED Published: N/A Last Updated: 2025-08-01T02:55:05.678Z Description: No description available.
CVE ID: CVE-2025-54847 State: REJECTED Published: N/A Last Updated: 2025-08-01T02:55:05.128Z Description: No description available.
CVE ID: CVE-2025-54854 State: PUBLISHED Published: 2025-10-15T13:55:53.609Z Last Updated: 2025-10-16T03:57:06.562Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-125 Description: When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000156602
CVE ID: CVE-2025-54855 State: PUBLISHED Published: 2025-09-23T22:01:25.924Z Last Updated: 2025-09-24T14:08:37.906Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: AutomationDirect Products: CLICK PLUS C0-0x CPU firmware, CLICK PLUS C0-1x CPU firmware, CLICK PLUS C2-x CPU firmware Problem Types: CWE-312 Description: Cleartext storage of sensitive information was discovered in Click Programming Software version v3.60. The vulnerability can be exploited by a local user with access to the file system, while an administrator session is active, to steal credentials stored in clear text. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.c
o steal credentials stored in clear text. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-01 - https://www.automationdirect.com/support/software-downloads
CVE ID: CVE-2025-54856 State: PUBLISHED Published: 2025-10-23T04:10:30.545Z Last Updated: 2025-10-23T15:18:25.113Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Six Apart Ltd. Products: Movable Type (Software Edition), Movable Type Advanced (Software Edition), Movable Type Premium (Software Edition), Movable Type Premium (Advanced Edition) (Software Edition), Movable Type (Cloud Edition), Movable Type Premium (Cloud Edition) Problem Types: CWE-79 Description: Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may b
tData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://movabletype.org/news/2025/10/mt-880-released.html - https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html - https://jvn.jp/en/jp/JVN24333679/
CVE ID: CVE-2025-54857 State: PUBLISHED Published: 2025-09-01T05:27:10.112Z Last Updated: 2025-09-02T14:10:07.142Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Seiko Solutions Inc. Products: SkyBridge BASIC MB-A130 Problem Types: CWE-78 Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earlier. If exploited, a remote unauthenticated attacker may execute arbitrary OS commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.seiko-sol.co.jp/archives/90289/ - https://jvn.jp/en/jp/JVN22016482/