Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-27565 State: PUBLISHED Published: 2025-04-15T21:23:08.714Z Last Updated: 2025-04-16T15:08:10.427Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-27566 State: PUBLISHED Published: 2025-05-19T08:09:26.427Z Last Updated: 2025-05-19T14:42:50.286Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: appleple inc. Products: a-blog cms Problem Types: CWE-22 Description: Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited, a remote authenticated attacker with the administrator privilege may obtain or delete any file on the server. Additional Analyst Notes: - CISA ADP Vulnrichm
the administrator privilege may obtain or delete any file on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVNVU-90760614.html - https://jvn.jp/en/vu/JVNVU90760614/
CVE ID: CVE-2025-27567 State: PUBLISHED Published: 2025-03-28T08:17:54.622Z Last Updated: 2025-03-28T13:58:11.672Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: KDDI CORPORATION Products: HGW-BL1500HM Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in the NickName registration screen of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the configuration page or functions accessible only from the LAN side of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kddi-tech.com/contents/appendi
of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kddi-tech.com/contents/appendix_L2_06.html#64433e4a-8946-9c06-bddf-91cbfe56c8e5 - https://jvn.jp/en/jp/JVN04278547/
CVE ID: CVE-2025-27568 State: PUBLISHED Published: 2025-04-15T20:53:54.709Z Last Updated: 2025-04-16T15:10:13.777Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-27571 State: PUBLISHED Published: 2025-04-16T07:45:58.802Z Last Updated: 2025-04-16T14:34:19.313Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-27574 State: PUBLISHED Published: 2025-03-28T08:18:11.469Z Last Updated: 2025-03-28T13:57:52.244Z Severity: LOW (CVSS 3.6 CVSS:3.0/AV:P/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: KDDI CORPORATION Products: HGW-BL1500HM Problem Types: CWE-79 Description: Cross-site scripting vulnerability exists in the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the configuration page or functions accessible only from the LAN side of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kddi-tech.com/contents/appen
de of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kddi-tech.com/contents/appendix_L2_06.html#64433e4a-8946-9c06-bddf-91cbfe56c8e5 - https://jvn.jp/en/jp/JVN04278547/
CVE ID: CVE-2025-27575 State: PUBLISHED Published: 2025-04-15T21:18:15.913Z Last Updated: 2025-04-16T15:08:19.282Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-27576 State: PUBLISHED Published: 2025-08-12T16:59:31.878Z Last Updated: 2025-08-13T20:15:09.251Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Edge Orchestrator software Problem Types: Denial of Service, CWE-400 Description: Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01317.html
CVE ID: CVE-2025-27577 State: PUBLISHED Published: 2025-08-11T02:36:29.047Z Last Updated: 2025-08-11T20:40:55.170Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-362 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-08.md
CVE ID: CVE-2025-27578 State: PUBLISHED Published: 2025-05-08T22:38:37.140Z Last Updated: 2025-05-09T13:34:14.542Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Pixmeo Products: OsiriX MD Problem Types: CWE-416 Description: Pixmeo OsiriX MD is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption leading to a denial-of-service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01 - https://www.osirix-viewer.com/osirix/osirix-md/ - https://www.osirix-viewer.com/about/contact/
CVE ID: CVE-2025-27579 State: PUBLISHED Published: 2025-03-02T00:00:00.000Z Last Updated: 2025-03-04T18:59:07.741Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: Bitaxe Products: ESP-MIner Problem Types: CWE-352 Description: In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner, or change the frequency and voltage settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snotra.uk/axeos-csrf-vulnerability.html - https://www.nobsbitcoin.com/bitaxe-firmware-esp-miner-v2-5-0/ - https://github.com/skot/ESP-Miner/pull/637
CVE ID: CVE-2025-27580 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T14:56:11.185Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NIH Products: BRICS Problem Types: CWE-335 Description: NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/brics-dev/brics - https://brics.cit.nih.gov
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/brics-dev/brics - https://brics.cit.nih.gov - https://github.com/brics-dev/brics/blob/26bc6bb627a9a60e6c6a8a8c29735ae98c2e2679/core/src/main/java/gov/nih/tbi/CoreConstants.java#L38 - https://github.com/brics-dev/brics/blob/26bc6bb627a9a60e6c6a8a8c29735ae98c2e2679/service/src/main/java/gov/nih/tbi/account/service/complex/AccountManagerImpl.java#L725-L732 - https://github.com/RoseHacks/Vulnerability.Research/blob/main/CVE-2025-27580/README.md - https://bugculture.io/CVE-2025-27580/
CVE ID: CVE-2025-27581 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T14:54:44.316Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: NIH Products: BRICS Problem Types: CWE-425 Description: NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/brics-dev/brics - https://brics.cit.nih.gov - https://github.com/RoseHacks/Vulnerability.Research/blob/main/CVE-2025-27581/README.md
CVE ID: CVE-2025-27582 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T20:11:00.348Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: One Identity Products: Password Manager Problem Types: CWE-829 Description: The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. Specifically, the application attempts to restrict privileged actions by overriding the native window.print() function. However, this protection can be bypassed by an atta
privileged actions by overriding the native window.print() function. However, this protection can be bypassed by an attacker who accesses the Password Self-Service site from the lock screen and navigates to an attacker-controlled webpage via the Help function. By hosting a crafted web page with JavaScript, the attacker can restore and invoke the window.print() function, launching a SYSTEM-privileged print dialog. From this dialog, the attacker can exploit standard Windows functionality - such as the Print to PDF or Add Printer wizard - to spawn a command prompt with SYSTEM privileges. Successful exploitation allows a local attacker (with access to a locked workstation) to gain SYSTEM-level p
privileges. Successful exploitation allows a local attacker (with access to a locked workstation) to gain SYSTEM-level privileges, granting full control over the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cyberis.com/article/password-manager-privilege-escalation
CVE ID: CVE-2025-27583 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-05T17:01:09.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-53637
CVE ID: CVE-2025-27584 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T16:10:01.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the First Name parameter at /rest/staffResource/update. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89636
CVE ID: CVE-2025-27585 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T16:15:44.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Print Name parameter at /rest/staffResource/update. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VvV1per/Vulnerability-Research-CVEs/tree/main/CVE-2024-89636
CVE ID: CVE-2025-27587 State: PUBLISHED Published: 2025-06-16T00:00:00.000Z Last Updated: 2025-06-26T16:17:47.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, ther
nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openssl/openssl/issues/24253 - https://minerva.crocs.fi.muni.cz
CVE ID: CVE-2025-27590 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T18:51:34.394Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Oxidized Web project Products: Oxidized Web Problem Types: CWE-22 Description: In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ytti/oxidized-web/releases/tag/0.15.0 - https://github.com/ytti/oxidized-web/commit/a5220a0ddc57b85cd122bffee228d3ed4901668e
CVE ID: CVE-2025-27591 State: PUBLISHED Published: 2025-03-11T18:29:21.569Z Last Updated: 2025-03-21T20:38:10.292Z Vendors: Meta Platforms, Inc Products: below Problem Types: Incorrect Permission Assignment for Critical Resource (CWE-732) Description: A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2025-27591
E Program Container: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2025-27591 - https://github.com/facebookincubator/below/commit/da9382e6e3e332fd2c3195e22f34977f83f0f1f3
CVE ID: CVE-2025-27593 State: PUBLISHED Published: 2025-03-14T12:46:58.946Z Last Updated: 2025-03-14T13:36:49.059Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: SICK AG Products: SICK DL100-2xxxxxxx Problem Types: CWE-494 Description: The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-prac
information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.pdf - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.json - https://github.security.telekom.com/2025/03/multiple-vulnerabilities-in-sick-dl100.html
CVE ID: CVE-2025-27594 State: PUBLISHED Published: 2025-03-14T12:50:15.198Z Last Updated: 2025-03-14T13:35:28.200Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SICK AG Products: SICK DL100-2xxxxxxx Problem Types: CWE-319 Description: The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_i
otes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.pdf - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.json - https://github.security.telekom.com/2025/03/multiple-vulnerabilities-in-sick-dl100.html
CVE ID: CVE-2025-27595 State: PUBLISHED Published: 2025-03-14T12:53:13.682Z Last Updated: 2025-03-14T13:35:00.490Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SICK AG Products: SICK DL100-2xxxxxxx Problem Types: CWE-328 Description: The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily calculated by an attacker. This impacts the security and the integrity of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/
m/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.pdf - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0004.json - https://github.security.telekom.com/2025/03/multiple-vulnerabilities-in-sick-dl100.html
CVE ID: CVE-2025-27597 State: PUBLISHED Published: 2025-03-07T15:51:39.753Z Last Updated: 2025-03-07T18:00:10.289Z Vendors: intlify Products: vue-i18n Problem Types: CWE-1321 Description: Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence. Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integr
he consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/intlify/vue-i18n/security/advisories/GHSA-p2ph-7g93-hw3m - https://github.com/intlify/vue-i18n/commit/4bb6eacda7fc2cde5687549afa0efb27ca40862a
CVE ID: CVE-2025-27598 State: PUBLISHED Published: 2025-03-06T22:23:39.486Z Last Updated: 2025-03-07T19:41:43.565Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: SixLabors Products: ImageSharp Problem Types: CWE-787 Description: ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. The problem has been patched. All users are advised to upgrade to v3.1.7 or v2.1.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SixLabors/ImageSharp/security/advisori
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-2cmq-823j-5qj8 - https://github.com/SixLabors/ImageSharp/issues/2859 - https://github.com/SixLabors/ImageSharp/pull/2890
CVE ID: CVE-2025-27599 State: PUBLISHED Published: 2025-04-18T15:49:11.899Z Last Updated: 2025-04-18T16:06:04.952Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: element-hq Products: element-x-android Problem Types: CWE-926, CWE-20 Description: Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2. Additional Analyst Notes: - CISA A
rary access to microphone and camera. This issue has been patched in version 25.04.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/element-x-android/security/advisories/GHSA-m5px-pwq3-4p5m - https://github.com/element-hq/element-x-android/commit/dc058544d7e693c04298191c1aadd5b39c9be52e - https://github.com/element-hq/element-x-android/releases/tag/v25.04.2
CVE ID: CVE-2025-27600 State: PUBLISHED Published: 2025-03-06T19:05:59.684Z Last Updated: 2025-03-06T20:04:06.433Z Vendors: labring Products: FastGPT Problem Types: CWE-918 Description: FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP verification, an attacker can initiate an intranet IP request, causing the system to initiate a request through the intranet and potentially obtain some private data on the intranet. This issue is fixed in 4.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/labring/FastGPT/security/advisories/GHSA-vc67-62v5-8cwx
CVE ID: CVE-2025-27601 State: PUBLISHED Published: 2025-03-11T15:30:09.761Z Last Updated: 2025-03-11T18:53:25.590Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-285, CWE-863 Description: Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. The issue is patched in versions 15.2.3 and 14.3.3. No known workarounds are