deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-34404
Published: 2025-12-09
Description: MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the InstanceScope parameter of /Mondo/lang/sys/Forms/CAL/compose.aspx. The InstanceScope value is not properly sanitized when processed via a GET request and is reflected inside a <script> block in the JavaScript variable var gInstanceScope. By supplying a crafted payload that terminates the existing PageLoad() function, inserts attacker-controlled script, and comments out remaining code, a remote attacker can execute arbitrary JavaScript in a victim’s browser. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mailenable.com/Standard-ReleaseNotes.txt; https://www.mailenable.com/; https://www.vulncheck.com/advisories/mailenable-reflected-xss-in-instancescope-parameter-of-cal-compose-aspx
CVE: CVE-2025-34406
Published: 2025-12-09
Description: MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id value is not properly sanitized when processed via a GET request and is reflected within a <script> block in the response. By supplying a crafted payload that terminates an existing JavaScript function, inserts attacker-controlled script, and comments out remaining code, a remote attacker can execute arbitrary JavaScript in a victim’s browser when the victim opens a malicious link. Successful exploitation can redirect victims to malicious sites, steal cookies not protected by HttpOnly, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mailenable.com/Standard-ReleaseNotes.txt; https://www.mailenable.com/; https://www.vulncheck.com/advisories/mailenable-reflected-xss-in-id-parameter-of-mobile-contactdetails-aspx
CVE: CVE-2025-34407
Published: 2025-12-09
Description: MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx. The theme value is insufficiently sanitized when processed via a GET request and is reflected in the response, allowing an attacker to break out of an existing iframe context and inject arbitrary script. A remote attacker can supply a crafted payload that closes the iframe tag, inserts attacker-controlled JavaScript, and comments out remaining code, leading to script execution in a victim’s browser when the victim visits a malicious link. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mailenable.com/Standard-ReleaseNotes.txt; https://www.mailenable.com/; https://www.vulncheck.com/advisories/mailenable-reflected-xss-in-theme-parameter-of-statistics-aspx
CVE: CVE-2025-34408
Published: 2025-12-09
Description: MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Added parameter of /Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx. The Added value is not properly sanitized when processed via a GET request and is reflected in the response, allowing an attacker to break out of existing markup and inject arbitrary script. A remote attacker can supply a crafted payload that closes an existing HTML list element, inserts attacker-controlled JavaScript, and comments out remaining code, leading to script execution in a victim’s browser when the victim visits a malicious link. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mailenable.com/Standard-ReleaseNotes.txt; https://www.mailenable.com/; https://www.vulncheck.com/advisories/mailenable-reflected-xss-in-added-parameter-of-mai-addrecipientsresult-aspx
CVE: CVE-2025-34409
Published: 2025-12-09
Description: MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Failed parameter of /Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx. The Failed value is not properly sanitized when processed via a GET request and is reflected in the response, allowing an attacker to break out of existing markup and inject arbitrary script. A remote attacker can supply a crafted payload that closes an existing HTML list element, inserts attacker-controlled JavaScript, and comments out remaining code, leading to script execution in a victim’s browser when the victim visits a malicious link. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mailenable.com/Standard-ReleaseNotes.txt; https://www.mailenable.com/; https://www.vulncheck.com/advisories/mailenable-reflected-xss-in-failed-parameter-of-mai-addrecipientsresult-aspx
CVE: CVE-2025-34413
Published: 2025-12-09
Description: Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers are not emitted by default. Affected deployments omit Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy (with CSP delivered via HTML meta elements being inadequate). The absence of these headers weakens browser-side defenses and increases exposure to client-side attacks such as cross-site scripting, clickjacking, referer leakage, and cross-origin data disclosure.
CWE: CWE-693
References: https://seclists.org/fulldisclosure/2025/Dec/0; https://www.digitalpa.net/en/whistleblowing-software-features/; https://www.vulncheck.com/advisories/legality-whisteblowing-missing-critical-http-security-headers
CVE: CVE-2025-34414
Published: 2025-12-09
Description: Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the Legacy Remoting Service that is enabled by default. The service registers a TCP remoting channel with SOAP and binary formatters configured at TypeFilterLevel=Full and exposes default ObjectURI endpoints such as logfile.rem, photo.rem, cwPhoto.rem, and reports.rem on a network-reachable remoting port. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host.
CWE: CWE-306, CWE-502
References: https://trustedcare.entrust.com/s/article/E25-008-NET-Remoting-Vulnerabilities-in-Instant-Financial-Issuance-On-Premise-Software; https://www.entrust.com/products/issuance-systems/instant/financial-card; https://www.vulncheck.com/advisories/entrust-ifi-legacy-remoting-unauthenticated-net-remoting-exposure
CVE: CVE-2025-46636
Published: 2025-12-09
Description: Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000394657/dsa-2025-442
CVE: CVE-2025-46637
Published: 2025-12-09
Description: Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A local malicious user could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000394657/dsa-2025-442
CVE: CVE-2025-53679
Published: 2025-12-09
Description: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-454
CVE: CVE-2025-53949
Published: 2025-12-09
Description: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-479
CVE: CVE-2025-54100
Published: 2025-12-09
Description: Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54100; https://www.vicarius.io/vsociety/posts/cve-2025-54100-detect-powershell-vulnerability; https://www.vicarius.io/vsociety/posts/cve-2025-54100-mitigate-powershell-vulnerability
CVE: CVE-2025-54353
Published: 2025-12-09
Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-477
CVE: CVE-2025-54838
Published: 2025-12-09
Description: An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-032
CVE: CVE-2025-55233
Published: 2025-12-09
Description: Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55233
CVE: CVE-2025-57823
Published: 2025-12-09
Description: A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints
CVSS Score: 2.7 (LOW)
CWE: CWE-425
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-554
CVE: CVE-2025-59516
Published: 2025-12-09
Description: Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-73, CWE-306
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59516
CVE: CVE-2025-59517
Published: 2025-12-09
Description: Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59517
CVE: CVE-2025-59718
Published: 2025-12-09
Description: A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-647; https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718
CVE: CVE-2025-59719
Published: 2025-12-09
Description: An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-647
CVE: CVE-2025-59808
Published: 2025-12-09
Description: An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an attacker who has already gained access to a victim's user account to reset the account credentials without being prompted for the account's password
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-620
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-599
CVE: CVE-2025-59810
Published: 2025-12-09
Description: An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow information disclosure to an authenticated attacker via crafted requests
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-601
CVE: CVE-2025-59923
Published: 2025-12-09
Description: An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other administrators' messaging services via crafted requests.
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-616
CVE: CVE-2025-60024
Published: 2025-12-09
Description: Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically HTTP or HTTPS commands
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-812
CVE: CVE-2025-61078
Published: 2025-12-09
Description: Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructions parameter for the /app/admin/instructions/edit-result.php endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://phpipam.com; https://glitch0ne.com/2025/12/05/cve-2025-61078-cross-site-scripting-xss-vulnerability-in-request-ip-form-in-phpipam-v1-7-3/
CVE: CVE-2025-61258
Published: 2025-12-09
Description: Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length. NOTE: the Supplier indicates that they are unable to reproduce this.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://balwurk.com/; https://balwurk.github.io/CVE-2025-61258/; https://www.outsystems.com/
CVE: CVE-2025-62221
Published: 2025-12-09
Description: Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62221
CVE: CVE-2025-62454
Published: 2025-12-09
Description: Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62454
CVE: CVE-2025-62455
Published: 2025-12-09
Description: Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62455
CVE: CVE-2025-62456
Published: 2025-12-09
Description: Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62456
CVE: CVE-2025-62457
Published: 2025-12-09
Description: Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62457
CVE: CVE-2025-62458
Published: 2025-12-09
Description: Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62458
CVE: CVE-2025-62461
Published: 2025-12-09
Description: Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62461
CVE: CVE-2025-62462
Published: 2025-12-09
Description: Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62462
CVE: CVE-2025-62463
Published: 2025-12-09
Description: Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62463
CVE: CVE-2025-62464
Published: 2025-12-09
Description: Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62464
CVE: CVE-2025-62465
Published: 2025-12-09
Description: Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62465
CVE: CVE-2025-62466
Published: 2025-12-09
Description: Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62466
CVE: CVE-2025-62467
Published: 2025-12-09
Description: Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62467
CVE: CVE-2025-62468
Published: 2025-12-09
Description: Out-of-bounds read in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62468
CVE: CVE-2025-62469
Published: 2025-12-09
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-415
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62469
CVE: CVE-2025-62470
Published: 2025-12-09
Description: Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62470
CVE: CVE-2025-62472
Published: 2025-12-09
Description: Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62472
CVE: CVE-2025-62473
Published: 2025-12-09
Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62473
CVE: CVE-2025-62474
Published: 2025-12-09
Description: Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62474
CVE: CVE-2025-62549
Published: 2025-12-09
Description: Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62549; https://www.vicarius.io/vsociety/posts/cve-2025-62549-detection-script-rce-vulnerability-in-windows-routing-and-remote-access-service; https://www.vicarius.io/vsociety/posts/cve-2025-62549-mitigation-script-rce-vulnerability-in-windows-routing-and-remote-access-service
CVE: CVE-2025-62550
Published: 2025-12-09
Description: Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-131, CWE-787, CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62550
CVE: CVE-2025-62552
Published: 2025-12-09
Description: Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-23
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62552
CVE: CVE-2025-62553
Published: 2025-12-09
Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62553
CVE: CVE-2025-62554
Published: 2025-12-09
Description: Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62554
CVE: CVE-2025-62555
Published: 2025-12-09
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62555