Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b. Upgrading the affected component is recommended. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322111 - https://vuldb.com/?ctiid.322111 - https://vuldb.com/?submit.641125 - https://github.com/thinkgem/jeesite5/issues/33 - https://github.com/thinkgem/jeesite5/issues/33#issuecomment-3197374560 - https://github.com/thinkgem/jeesite5/issues/33#issue-3330107533 - https://github.com/thinkgem/jeesite5/commit/63773c97a56bdb3649510e83b66c16db4754965b - https://github.com/thinkgem/jeesite5/releases/tag/v5.13.0.springboo3
CVE ID: CVE-2025-9797 State: PUBLISHED Published: 2025-09-01T22:02:06.955Z Last Updated: 2025-09-02T16:12:02.856Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: mrvautin Products: expressCart Problem Types: CWE-74, CWE-707 Description: A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of the file /admin/product/edit/ of the component Edit Product Page. This manipulation causes injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version det
closed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322112 - https://vuldb.com/?ctiid.322112 - https://vuldb.com/?submit.641127 - https://github.com/mrvautin/expressCart/issues/288 - https://github.com/mrvautin/expressCart/issues/288#issue-3287867610
CVE ID: CVE-2025-9798 State: PUBLISHED Published: 2025-09-23T08:44:32.504Z Last Updated: 2025-09-25T07:11:38.179Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Netcad Software Inc. Products: Netigma Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows Stored XSS.This issue affects Netigma: from 6.3.3 before 6.3.5 V8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0286
CVE ID: CVE-2025-9799 State: PUBLISHED Published: 2025-09-01T22:02:09.356Z Last Updated: 2025-09-02T20:10:18.439Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Langfuse Problem Types: CWE-918 Description: A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult
ay be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322114 - https://vuldb.com/?ctiid.322114 - https://vuldb.com/?submit.641128 - https://github.com/langfuse/langfuse/issues/8522 - https://github.com/langfuse/langfuse/issues/8522#issue-3320549867
CVE ID: CVE-2025-9800 State: PUBLISHED Published: 2025-09-01T22:32:06.885Z Last Updated: 2025-09-02T19:45:42.085Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: SimStudioAI Products: sim Problem Types: CWE-434, CWE-284 Description: A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file apps/sim/app/api/files/upload/route.ts of the component HTML File Parser. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. This product operat
may be launched remotely. The exploit has been made available to the public and could be exploited. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called 45372aece5e05e04b417442417416a52e90ba174. A patch should be applied to remediate this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322115 - https://vuldb.com/?ctiid.322115 - https://vuldb.com/?submit.641129 - https://github.com/simstudioai/sim/issues/958 - https://github.com/simstudioai/sim/issues/958#issuecomment-3221311734 - https://github.com/simstudioai/sim/i
ssues/958 - https://github.com/simstudioai/sim/issues/958#issuecomment-3221311734 - https://github.com/simstudioai/sim/issues/958#issue-3320696271 - https://github.com/simstudioai/sim/commit/45372aece5e05e04b417442417416a52e90ba174
CVE ID: CVE-2025-9801 State: PUBLISHED Published: 2025-09-01T23:02:06.763Z Last Updated: 2025-09-02T19:41:17.897Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: SimStudioAI Products: sim Problem Types: CWE-22 Description: A security vulnerability has been detected in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. This affects an unknown part. The manipulation of the argument filePath leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not pro
lows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The identifier of the patch is 45372aece5e05e04b417442417416a52e90ba174. To fix this issue, it is recommended to deploy a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322116 - https://vuldb.com/?ctiid.322116 - https://vuldb.com/?submit.641130 - https://github.com/simstudioai/sim/issues/959 - https://github.com/simstudioai/sim/issues/959#issuecomment-3221311557 - https://github.com/simstudioai/sim/issues/959#issue-3320697951 - https://github.com/simstudioai/sim/commit/45372aece5e05e04b417442417416a52e90ba174
CVE ID: CVE-2025-9802 State: PUBLISHED Published: 2025-09-01T23:32:07.074Z Last Updated: 2025-09-02T19:35:58.203Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:ND/RC:UR) Vendors: n/a Products: RemoteClinic Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in RemoteClinic 2.0. This vulnerability affects unknown code of the file /staff/profile.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322117 - https://vuldb.com/?ctiid.322117 - https://vuldb.com/?submit.641133 - https://github.com/03hice-collab/CVE/issues/3
CVE ID: CVE-2025-9803 State: PUBLISHED Published: 2025-11-25T00:00:35.380Z Last Updated: 2025-11-25T00:00:35.380Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-287 Description: lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' (audience) field in the access token issued by Google, which is crucial for ensuring the token is intended for the application. This oversight allows attackers to use tokens issued to malicious applications to gain unauthorized access to user accounts. T
versight allows attackers to use tokens issued to malicious applications to gain unauthorized access to user accounts. The issue is resolved in version 1.9.35. References: - https://huntr.com/bounties/4734f35f-514c-4d10-98fa-3a54514f6af6 - https://github.com/lunary-ai/lunary/commit/95a2cc8e012bf5f089edbfa072ba66dcb7e10d91
CVE ID: CVE-2025-9804 State: PUBLISHED Published: 2025-10-16T12:33:45.426Z Last Updated: 2025-10-17T16:01:25.350Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: WSO2 Products: WSO2 Identity Server as Key Manager, WSO2 Identity Server, WSO2 Open Banking KM, WSO2 Open Banking IAM, WSO2 Open Banking AM, WSO2 API Manager, WSO2 Identity Server Analytics, API Manager Analytics, WSO2 Enterprise Integrator, WSO2 Enterprise Service Bus Analytics, WSO2 Data Analytics Server, WSO2 Enterprise Mobility Manager, WSO2 Universal Gateway, WSO2 API Control Plane, WSO2 Traffic Manager, org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.
l Plane, WSO2 Traffic Manager, org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util, org.wso2.carbon:org.wso2.carbon.base, org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt, org.wso2.carbon:org.wso2.carbon.server.admin, org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow Description: An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform
ent in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/
CVE ID: CVE-2025-9805 State: PUBLISHED Published: 2025-09-02T00:02:07.900Z Last Updated: 2025-09-02T19:34:20.352Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: SimStudioAI Products: sim Problem Types: CWE-918 Description: A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2. This issue affects some unknown processing of the file apps/sim/app/api/proxy/image/route.ts. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for
d be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 3424a338b763115f0269b209e777608e4cd31785. Applying a patch is advised to resolve this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322129 - https://vuldb.com/?ctiid.322129 - https://vuldb.com/?submit.640821 - https://github.com/simstudioai/sim/issues/1128 - https://github.com/simstudioai/sim/issues/1128#issuecomment-3226867869 - https://github.com/simstudioai/sim/issues/1128#issue-3349260976 - https://github.com/simstudioai/sim/commit/3424a338b763115f02
//github.com/simstudioai/sim/issues/1128#issue-3349260976 - https://github.com/simstudioai/sim/commit/3424a338b763115f0269b209e777608e4cd31785
CVE ID: CVE-2025-9806 State: PUBLISHED Published: 2025-09-02T00:32:07.898Z Last Updated: 2025-09-02T19:33:32.924Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Tenda Products: F1202 Problem Types: CWE-798, CWE-259 Description: A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation with the input Fireitup causes hard-coded credentials. The attack can only be executed locally. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been publicly disclosed
complexity is needed for the attack. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322130 - https://vuldb.com/?ctiid.322130 - https://vuldb.com/?submit.640980 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e9.md - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e9.md#steps-to-reproduce - https://www.tenda.com.cn/
CVE ID: CVE-2025-9807 State: PUBLISHED Published: 2025-09-12T01:46:00.820Z Last Updated: 2025-09-12T14:35:33.535Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: theeventscalendar Products: The Events Calendar Problem Types: CWE-89 Description: The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sen
unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea2ce90-6c8c-4a31-8faa-4ab99879d8b8?source=cve - https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.0.1/src/Events/Custom_Tables/V1/WP_Query/Custom_Tables_Query.php#L682
CVE ID: CVE-2025-9808 State: PUBLISHED Published: 2025-09-16T05:25:26.060Z Last Updated: 2025-09-16T19:16:02.937Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: theeventscalendar Products: The Events Calendar Problem Types: CWE-200 Description: The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9d
ISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a?source=cve - https://plugins.trac.wordpress.org/changeset/3359403/
CVE ID: CVE-2025-9809 State: PUBLISHED Published: 2025-09-01T18:38:22.165Z Last Updated: 2025-09-03T20:29:21.013Z Vendors: libretro Products: libretro-common Problem Types: CWE-787 Description: Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted .cue file with a file path exceeding PATH_MAX_LENGTH that is copied using memcpy into a fixed-size buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libretro/libretro-common/blob/master/formats/cdfs/cdfs.c#L471 - https://github.com/libretro/libretro-common/issues/222
CVE ID: CVE-2025-9810 State: PUBLISHED Published: 2025-09-01T19:03:19.540Z Last Updated: 2025-09-02T16:13:46.132Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: antirez Products: linenoise Problem Types: CWE-367 Description: TOCTOU in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen("w") on the history path and subsequent chmod() on the same path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/antirez/linenoise/blob/master/linenoise.c#L1321 - https://github.com/antirez/linenoise/pull/202
CVE ID: CVE-2025-9811 State: PUBLISHED Published: 2025-09-02T03:02:06.865Z Last Updated: 2025-09-02T13:58:35.205Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Farm Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Farm Management System 1.0. This affects an unknown part of the file /reviewInput.php. Performing manipulation of the argument rating results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322138 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322138 - https://vuldb.com/?ctiid.322138 - https://vuldb.com/?submit.641146 - https://github.com/zhaodaojie/cve/issues/10 - https://www.campcodes.com/
CVE ID: CVE-2025-9812 State: PUBLISHED Published: 2025-09-02T03:02:10.722Z Last Updated: 2025-09-02T13:57:13.365Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: CH22 Problem Types: CWE-120, CWE-119 Description: A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322139 - https://vuldb.com/?ctiid.32
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322139 - https://vuldb.com/?ctiid.322139 - https://vuldb.com/?submit.641148 - https://github.com/csgii/cve/issues/1 - https://www.tenda.com.cn/
CVE ID: CVE-2025-9813 State: PUBLISHED Published: 2025-09-02T04:02:07.353Z Last Updated: 2025-09-02T13:56:18.157Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: CH22 Problem Types: CWE-120, CWE-119 Description: A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument samba_userNameSda leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322140 - https://vuldb.com/?ctiid.322140
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322140 - https://vuldb.com/?ctiid.322140 - https://vuldb.com/?submit.641151 - https://github.com/csgii/cve/issues/2 - https://www.tenda.com.cn/
CVE ID: CVE-2025-9814 State: PUBLISHED Published: 2025-09-02T04:02:10.495Z Last Updated: 2025-09-02T13:54:21.052Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/contact-us.php. The manipulation of the argument mobnumber results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322141 - https://vuldb.com/?ctiid.322141 - https://vuldb.com/?submit.641237 - https://github.com/dad-zm/myCVE/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-9815 State: PUBLISHED Published: 2025-09-02T04:32:06.302Z Last Updated: 2025-09-02T13:51:23.033Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: alaneuler Products: batteryKid Problem Types: CWE-306, CWE-287 Description: A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHelper.swift of the component NSXPCListener. This manipulation causes missing authentication. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP
al host. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322142 - https://vuldb.com/?ctiid.322142 - https://vuldb.com/?submit.641358 - https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md - https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md#proof-of-concepts
CVE ID: CVE-2025-9816 State: PUBLISHED Published: 2025-09-27T04:26:58.256Z Last Updated: 2025-09-29T13:50:14.795Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: veronalabs Products: WP Statistics – Simple, privacy-friendly Google Analytics alternative Problem Types: CWE-79 Description: The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute
caping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8351204-da6d-443a-98b5-0608bfb1e9d0?source=cve - https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.15.3/includes/admin/templates/pages/devices/models.php#L31
CVE ID: CVE-2025-9817 State: PUBLISHED Published: 2025-09-03T07:38:58.940Z Last Updated: 2025-09-04T03:55:16.710Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-476 Description: SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2025-03.html - https://gitlab.com/wireshark/wireshark/-/issues/20642
CVE ID: CVE-2025-9818 State: PUBLISHED Published: 2025-09-17T03:02:20.527Z Last Updated: 2025-09-17T13:40:05.543Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: OMRON SOCIAL SOLUTIONS CO., Ltd. Products: PowerAttendant Standard Edition, PowerAttendant Basic Edition, PowerAct Pro <Slave Agent>, PowerAct Pro <Master Agent>, Simple Shutdown Software Problem Types: CWE-428 Description: A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of
re the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.omron.com/jp/ja/inquiry/vulnerability_information/OMSR-2025-005_ja.pdf - https://www.omron.com/global/en/inquiry/vulnerability_information/OMSR-2025-005_en.pdf