rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-35061 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx
Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the user-configured NIX service account.
Problem types: cwe_id: CWE-294
description: CWE-294 Authentication Bypass by Capture-replay
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.9
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
integrityImpact: NONE
userInteraction: NONE
attackComplexity: HIGH
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:22:37.069Z
CVE-2025-35062 Newforma Info Exchange (NIX) default anonymous access
Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.3
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: LOW
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:22:23.136Z
CVE-2025-35112 Agiloft XML external entity local path traversal
Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: Agiloft
product: Agiloft
default_status: unknown
CVSS v3.1: scope: CHANGED
version: 3.1
baseScore: 4.1
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: HIGH
confidentialityImpact: LOW
Credits: lang: en
value: Matthew Galligan, CISA Rapid Action Force (RAF)
Published: 2025-08-26T22:19:20.235Z
CVE-2025-35113 Agiloft improper neutralization in EUI template engine
Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted payload. Users should upgrade to Agiloft Release 31.
Problem types: cwe_id: CWE-1336
description: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: Agiloft
product: Agiloft
default_status: unknown
CVSS v3.1: scope: CHANGED
version: 3.1
baseScore: 5.9
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
integrityImpact: LOW
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: HIGH
confidentialityImpact: LOW
Credits: lang: en
value: Matthew Galligan, CISA Rapid Action Force (RAF)
Published: 2025-08-26T22:17:50.086Z
CVE-2025-35114 Agiloft local privilege escalation via default credentials
Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30.
Problem types: cwe_id: CWE-1392
description: CWE-1392 Use of Default Credentials
Affected products: vendor: Agiloft
product: Agiloft
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 7.5
attackVector: NETWORK
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: Matthew Galligan, CISA Rapid Action Force (RAF)
Published: 2025-08-26T22:18:12.127Z
CVE-2025-35115 Agiloft insecure download of system packages
Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the contents of the download URL. Users should upgrade to Agiloft Release 30.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: Agiloft
product: Agiloft
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 8.1
attackVector: NETWORK
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: HIGH
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: Matthew Galligan, CISA Rapid Action Force (RAF)
Published: 2025-08-26T22:18:30.538Z
CVE-2025-35430 CISA Thorium insecure downloaded file path validation
CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker could access arbitrary files subject to file system permissions. Fixed in 1.1.2.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: CISA
product: Thorium
default_status: unknown
CVSS v3.1: scope: CHANGED
version: 3.1
baseScore: 5
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
integrityImpact: LOW
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: LOW
confidentialityImpact: NONE
Credits: lang: en
value: , OpenAI Security Research
Published: 2025-09-17T16:51:52.544Z
CVE-2025-35431 CISA Thorium LDAP injection
CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1.
Problem types: cwe_id: CWE-90
description: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Affected products: vendor: CISA
product: Thorium
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.4
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
integrityImpact: LOW
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: LOW
confidentialityImpact: LOW
Credits: lang: en
value: , OpenAI Security Research
Published: 2025-09-17T16:52:16.293Z
CVE-2025-35432 CISA Thorium does not rate limit account verification email messages
CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: CISA
product: Thorium
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.3
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: NONE
confidentialityImpact: NONE
Credits: lang: en
value: , OpenAI Security Research
Published: 2025-09-17T16:52:34.949Z
CVE-2025-35433 CISA Thorium does not properly invalidate previously used tokens
CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: CISA
product: Thorium
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
integrityImpact: LOW
userInteraction: NONE
attackComplexity: HIGH
availabilityImpact: LOW
privilegesRequired: LOW
confidentialityImpact: LOW
Credits: lang: en
value: , OpenAI Security Research
Published: 2025-09-17T16:52:53.048Z
CVE-2025-35434 CISA Thorium does not validate TLS connections to Elasticsearch
CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: CISA
product: Thorium
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 4.2
attackVector: ADJACENT_NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
integrityImpact: LOW
userInteraction: NONE
attackComplexity: HIGH
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: LOW
Credits: lang: en
value: , OpenAI Security Research
Published: 2025-09-17T16:53:08.899Z
CVE-2025-35435 CISA Thorium download stream divide by zero
CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to crash. Fixed in commit 89101a6.
Problem types: cwe_id: CWE-369
description: CWE-369 Divide By Zero
Affected products: vendor: CISA
product: Thorium
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 4.3
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: LOW
confidentialityImpact: NONE
Credits: lang: en
value: , OpenAI Security Research
Published: 2025-09-17T16:53:22.388Z
CVE-2025-35436 CISA Thorium account verification email error handling
CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27.
Problem types: cwe_id: CWE-248
description: CWE-248 Uncaught Exception
Affected products: vendor: CISA
product: Thorium
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.3
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: NONE
confidentialityImpact: NONE
Credits: lang: en
value: , OpenAI Security Research
Published: 2025-09-17T16:53:47.289Z
CVE-2025-35451 Pan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabled
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: PTZOptics
product: PT12X-SE-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT12X-LINK-4K-xx
default_status: unknown
vendor: PTZOptics
product: PT20X-SE-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT20X-LINK-4K-xx
default_status: unknown
vendor: PTZOptics
product: PT-STUDIOPRO
default_status: unknown
vendor: PTZOptics
product: PT30X-SE-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT30X-LINK-4K-xx
default_status: unknown
vendor: PTZOptics
product: PT12X-STUDIO-4K-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT20X-STUDIO-4K-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT12X-SDI/NDI-xx
default_status: unknown
vendor: PTZOptics
product: PT12X-USB-xx
default_status: unknown
vendor: PTZOptics
product: PT20X-SDI/NDI-xx
default_status: unknown
vendor: SMTAV
product: Pan-Tilt-Zoom Cameras
default_status: unknown
vendor: PTZOptics
product: PT30X-SDI/NDI-xx
default_status: unknown
vendor: multiCAM Systems
product: Pan-Tilt-Zoom Cameras
default_status: unknown
vendor: PTZOptics
product: VL Fixed Camera/NDI Fixed Camera
default_status: unknown
vendor: PTZOptics
product: 12x Fixed Camera/NDI Fixed Camera
default_status: unknown
vendor: PTZOptics
product: 20x Fixed Camera/NDI Fixed Camera
default_status: unknown
vendor: PTZOptics
product: EPTZ Fixed Camera/NDI Fixed Camera
default_status: unknown
vendor: PTZOptics
product: HC-EPTZ-NDI
default_status: unknown
vendor: PTZOptics
product: PT12X-4K-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT20X-4K-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT20X-USB-xx
default_status: unknown
vendor: PTZOptics
product: PT30X-4K-xx-G3
default_status: unknown
vendor: ValueHD
product: Pan-Tilt-Zoom Cameras
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 9.8
attackVector: NETWORK
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: HIGH
Published: 2025-09-05T17:43:53.108Z
CVE-2025-35452 Pan-Tilt-Zoom cameras default administrative credentials for web interface
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
cwe_id: CWE-1392
description: CWE-1392 Use of Default Credentials
Affected products: vendor: PTZOptics
product: PT12X-SE-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT12X-LINK-4K-xx
default_status: unknown
vendor: PTZOptics
product: PT20X-SE-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT20X-LINK-4K-xx
default_status: unknown
vendor: PTZOptics
product: PT30X-SE-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT30X-LINK-4K-xx
default_status: unknown
vendor: PTZOptics
product: PT-STUDIOPRO
default_status: unknown
vendor: PTZOptics
product: PT12X-STUDIO-4K-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT20X-STUDIO-4K-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT12X-SDI/NDI-xx
default_status: unknown
vendor: PTZOptics
product: PT12X-USB-xx
default_status: unknown
vendor: PTZOptics
product: PT20X-SDI/NDI-xx
default_status: unknown
vendor: SMTAV
product: Pan-Tilt-Zoom Cameras
default_status: unknown
vendor: PTZOptics
product: PT30X-SDI/NDI-xx
default_status: unknown
vendor: multiCAM Systems
product: Pan-Tilt-Zoom Cameras
default_status: unknown
vendor: PTZOptics
product: VL Fixed Camera/NDI Fixed Camera
default_status: unknown
vendor: PTZOptics
product: 12x Fixed Camera/NDI Fixed Camera
default_status: unknown
vendor: PTZOptics
product: 20x Fixed Camera/NDI Fixed Camera
default_status: unknown
vendor: PTZOptics
product: EPTZ Fixed Camera/NDI Fixed Camera
default_status: unknown
vendor: PTZOptics
product: HC-EPTZ-NDI
default_status: unknown
vendor: PTZOptics
product: PT12X-4K-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT20X-4K-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT30X-4K-xx-G3
default_status: unknown
vendor: PTZOptics
product: PT20X-USB-xx
default_status: unknown
vendor: ValueHD
product: Pan-Tilt-Zoom Cameras
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 9.8
attackVector: NETWORK
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: HIGH
Published: 2025-09-05T17:49:02.755Z
CVE-2025-35471 conda-forge openssl-feedstock writable OPENSSLDIR
conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privileged local user can execute arbitrary code with the privileges of the user or process loading openssl-feedstock DLLs. Miniforge before 24.5.0 is also affected.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: conda-forge
product: openssl-feedstock
default_status: unknown
vendor: conda-forge
product: miniforge
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 7.3
attackVector: LOCAL
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: LOW
confidentialityImpact: HIGH
Published: 2025-05-13T01:13:14.639Z
CVE-2025-35939 Craft CMS stores user-provided content in session files
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
Problem types: cwe_id: CWE-472
description: CWE-472 External Control of Assumed-Immutable Web Parameter
Affected products: vendor: Craft
product: CMS
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.3
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
integrityImpact: LOW
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: NONE
Credits: lang: en
value: Joel Land, undefined
Published: 2025-05-07T22:41:29.728Z
CVE-2025-35940 Hard-coded ArchiverSpaApi JWT Signing Key
The ArchiverSpaApi ASP.NET  application uses a hard-coded JWT signing key. An unauthenticated remote attacker can generate and use a verifiable JWT token to access protected ArchiverSpaApi URL endpoints.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: GFI
product: Archiver
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-06-10T20:27:51.562Z
CVE-2025-35941 mySCADA PRO Manager Password Disclosure
A password is exposed locally.
Affected products: vendor: mySCADA
product: myPRO
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-06-11T13:15:50.588Z
CVE-2025-35963 
Insufficient control flow management for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts.
Problem types: description: Denial of Service
cwe_id: CWE-691
description: Insufficient Control Flow Management
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi Software for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.4
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2025-11-11T16:51:13.753Z
CVE-2025-35965 DoS in Mattermost Playbooks via Excessive Task Actions
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: vultza (vultza)
Published: 2025-04-24T06:49:22.669Z
CVE-2025-35966 
A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message handling of Bloomberg Comdb2 8.1. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Bloomberg
product: Comdb2
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Discovered by a member of Cisco Talos.
Published: 2025-07-22T15:26:28.550Z