deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-40569
Published: 2025-06-10
Description: A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.2), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.2), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.2), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.2). The "Load Configuration from Local PC" functionality in the web interface of affected products contains a race condition vulnerability. This could allow an authenticated remote attacker to make the affected product load an attacker controlled configuration instead of the legitimate one. Successful exploitation requires that a legitimate administrator invokes the functionality and the attacker wins the race condition.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-362
References: https://cert-portal.siemens.com/productcert/html/ssa-693776.html
CVE: CVE-2025-40585
Published: 2025-06-10
Description: A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-276
References: https://cert-portal.siemens.com/productcert/html/ssa-345750.html
CVE: CVE-2025-40591
Published: 2025-06-10
Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versions < V2.16.5), RUGGEDCOM ROX RX1510 (All versions < V2.16.5), RUGGEDCOM ROX RX1511 (All versions < V2.16.5), RUGGEDCOM ROX RX1512 (All versions < V2.16.5), RUGGEDCOM ROX RX1524 (All versions < V2.16.5), RUGGEDCOM ROX RX1536 (All versions < V2.16.5), RUGGEDCOM ROX RX5000 (All versions < V2.16.5). The 'Log Viewers' tool in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated remote attacker to execute the 'tail' command with root privileges and disclose contents of all files in the filesystem.
CVSS Score: 7.7 (HIGH)
CWE: CWE-602
References: https://cert-portal.siemens.com/productcert/html/ssa-301229.html
CVE: CVE-2025-43585
Published: 2025-06-10
Description: Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access leading to a limited impact to confidentiality and a high impact to integrity. Exploitation of this issue does not require user interaction.
CVSS Score: 8.2 (HIGH)
CWE: CWE-285
References: https://helpx.adobe.com/security/products/magento/apsb25-50.html
CVE: CVE-2025-43586
Published: 2025-06-10
Description: Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized elevated access. Exploitation of this issue does not require user interaction.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb25-50.html
CVE: CVE-2025-44043
Published: 2025-06-10
Description: Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery (SSRF) in /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetResults and /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetLocationAndContentCategories. An attacker can specify their own SMB server as the indexDirectory value when making POST requests to the affected components. In doing so an attacker can get the SearchUnit server to read and write configuration and log files from/to the attackers server.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://keyoti.com/products/search/dotNetWeb/HtmlHelp9/?topic=UserGuide/Release%20Notes.htm; https://www.sprocketsecurity.com/blog/cve-alert-cve-2025-44043-cve-2025-44044-the-search-bar-hacks-arent-dead-yet
CVE: CVE-2025-44044
Published: 2025-06-10
Description: Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://keyoti.com/products/search/dotNetWeb/HtmlHelp9/?topic=UserGuide/Release%20Notes.htm; https://www.sprocketsecurity.com/blog/cve-alert-cve-2025-44043-cve-2025-44044-the-search-bar-hacks-arent-dead-yet
CVE: CVE-2025-47110
Published: 2025-06-10
Description: Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed to that of other high-privileged accounts, leading to a high impact on confidentiality, integrity, and availability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb25-50.html
CVE: CVE-2025-48067
Published: 2025-06-10
Description: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability is fixed in 1.11.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-73
References: https://github.com/OctoPrint/OctoPrint/commit/9984b20773f5895a432f965b759999b16c57f7d8; https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-m9jh-jf9h-x3h2
CVE: CVE-2025-48879
Published: 2025-06-10
Description: OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. The issue can be triggered by a broken multipart/form-data request lacking an end boundary to any of OctoPrint's endpoints implemented through the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come. As Tornado is single-threaded, that will effectively block the whole web server. The vulnerability has been patched in version 1.11.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-140, CWE-835
References: https://github.com/OctoPrint/OctoPrint/commit/c9c35c17bd820f19c6b12e6c0359fc0cfdd0c1ec; https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-9wj4-8h85-pgrw
CVE: CVE-2025-48937
Published: 2025-06-10
Description: matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-290
References: https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55; https://github.com/matrix-org/matrix-rust-sdk/commit/56980745b4f27f7dc72ac296e6aa003e5d92a75b; https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w
CVE: CVE-2025-49142
Published: 2025-06-10
Description: Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered or that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user. Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability. The vulnerability can be partially mitigated by configuring object permissions appropriately to limit certain actions to only trusted users.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1336
References: https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description; https://github.com/nautobot/nautobot/pull/7417; https://github.com/nautobot/nautobot/pull/7429
CVE: CVE-2025-49143
Published: 2025-06-10
Description: Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file. Nautobot v2.4.10 and v1.6.32 address this issue by adding enforcement of Nautobot user authentication to this endpoint.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/nautobot/nautobot/commit/9c892dc300429948a4714f743c9c2879d8987340; https://github.com/nautobot/nautobot/commit/d99a53b065129cff3a0fa9abe7355a9ef1ad4c95; https://github.com/nautobot/nautobot/pull/6672
CVE: CVE-2025-4653
Published: 2025-06-10
Description: Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
CWE: CWE-77
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2025-4678
Published: 2025-06-10
Description: Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
CWE: CWE-77
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2025-4801
Published: 2025-06-10
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-20599
Published: 2025-06-10
Description: Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor (CCP) registers from x86 resulting in potential loss of control of cryptographic key pointer/index leading to loss of integrity or confidentiality.
CVSS Score: 7.9 (HIGH)
CWE: CWE-1262
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7039.html
CVE: CVE-2023-29184
Published: 2025-06-10
Description: An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before  & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM privileged attacker to add SSH key files on the system silently via crafted CLI requests.
CVSS Score: 3.2 (LOW)
CWE: CWE-459
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-008
CVE: CVE-2023-48786
Published: 2025-06-10
Description: A server-side request forgery vulnerability [CWE-918] in Fortinet FortiClientEMS version 7.4.0 through 7.4.2 and before 7.2.6 may allow an authenticated attacker to perform internal requests via crafted HTTP or HTTPS requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-342
CVE: CVE-2024-32119
Published: 2025-06-10
Description: An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted user via specially crafted TCP requests.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-1390
References: https://fortiguard.fortinet.com/psirt/FG-IR-23-375
CVE: CVE-2024-43706
Published: 2025-06-10
Description: Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
CVSS Score: 7.6 (HIGH)
CWE: CWE-285
References: https://discuss.elastic.co/t/kibana-8-12-1-security-update-esa-2024-21/379064
CVE: CVE-2024-45329
Published: 2025-06-10
Description: A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.8 may allow an authenticated attacker to view unauthorized device information via key modification in API requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-274
CVE: CVE-2024-50562
Published: 2025-06-10
Description: An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-613
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-339
CVE: CVE-2024-50568
Published: 2025-06-10
Description: A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-300
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-058
CVE: CVE-2024-54019
Published: 2025-06-10
Description: A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow an unauthorized attacker to redirect VPN connections via DNS spoofing or another form of redirection.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-297
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-365
CVE: CVE-2024-57186
Published: 2025-06-10
Description: In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/erxes/erxes/commit/d626070a0fcd435ae29e689aca051ccfb440c2f3; https://www.sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices/
CVE: CVE-2024-57189
Published: 2025-06-10
Description: In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/erxes/erxes/commit/d626070a0fcd435ae29e689aca051ccfb440c2f3; https://www.sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices/
CVE: CVE-2024-57190
Published: 2025-06-10
Description: Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/erxes/erxes/commit/4ed2ca797241d2ba0c9083feeadd9755c1310ce8; https://www.sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices/
CVE: CVE-2025-22251
Published: 2025-06-10
Description: An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets.
CVSS Score: 3.1 (LOW)
CWE: CWE-923
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-287
CVE: CVE-2025-22254
Published: 2025-06-10
Description: An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to Node.js websocket module.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-269
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-006
CVE: CVE-2025-22256
Published: 2025-06-10
Description: A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSRA 1.4.0 through 1.4.1 allows attacker to improper access control via specially crafted HTTP requests
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-280
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-008
CVE: CVE-2025-24065
Published: 2025-06-10
Description: Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24065
CVE: CVE-2025-24068
Published: 2025-06-10
Description: Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24068
CVE: CVE-2025-24069
Published: 2025-06-10
Description: Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24069
CVE: CVE-2025-24471
Published: 2025-06-10
Description: An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-544
CVE: CVE-2025-25250
Published: 2025-06-10
Description: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiOS version 7.6.0, version 7.4.7 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions SSL-VPN web-mode may allow an authenticated user to access full SSL-VPN settings via crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-257
CVE: CVE-2025-29828
Published: 2025-06-10
Description: Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-401
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29828
CVE: CVE-2025-30317
Published: 2025-06-10
Description: InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/indesign/apsb25-53.html
CVE: CVE-2025-30321
Published: 2025-06-10
Description: InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/indesign/apsb25-53.html
CVE: CVE-2025-31104
Published: 2025-06-10
Description: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiADC 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.7, 7.1.0 through 7.1.4, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated attacker to execute unauthorized code via crafted HTTP requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-099
CVE: CVE-2025-32710
Published: 2025-06-10
Description: Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32710
CVE: CVE-2025-32712
Published: 2025-06-10
Description: Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32712
CVE: CVE-2025-32713
Published: 2025-06-10
Description: Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32713
CVE: CVE-2025-32714
Published: 2025-06-10
Description: Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32714
CVE: CVE-2025-32715
Published: 2025-06-10
Description: Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32715
CVE: CVE-2025-32716
Published: 2025-06-10
Description: Out-of-bounds read in Windows Media allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32716
CVE: CVE-2025-32718
Published: 2025-06-10
Description: Integer overflow or wraparound in Windows SMB allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32718
CVE: CVE-2025-32719
Published: 2025-06-10
Description: Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32719