rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-29969 MS-EVEN RPC Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Microsoft
product: Windows 10 Version 1507
vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-05-13T16:58:33.147Z
CVE-2025-29970 Microsoft Brokering File System Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-05-13T16:58:34.056Z
CVE-2025-29971 Web Threat Defense (WTD.sys) Denial of Service Vulnerability
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Published: 2025-05-13T16:58:34.659Z
CVE-2025-29972 Azure Storage Resource Provider Spoofing Vulnerability
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: Microsoft
product: Azure Storage Resource Provider (SRP)
CVSS v3.1: version: 3.1
baseSeverity: CRITICAL
baseScore: 9.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2025-05-08T22:17:24.266Z
CVE-2025-29973 Microsoft Azure File Sync Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Microsoft
product: Azure File Sync
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-05-13T16:58:35.368Z
CVE-2025-29974 Windows Kernel Information Disclosure Vulnerability
Problem types: cwe_id: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Microsoft
product: Windows 10 Version 1507
vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.7
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2025-05-13T16:59:09.119Z
CVE-2025-29975 Microsoft PC Manager Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Microsoft
product: Microsoft PC Manager
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-05-13T16:58:35.844Z
CVE-2025-29976 Microsoft SharePoint Server Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
vendor: Microsoft
product: Microsoft SharePoint Server 2019
vendor: Microsoft
product: Microsoft SharePoint Server Subscription Edition
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-05-13T16:58:36.558Z
CVE-2025-29977 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Excel 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Office Online Server
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-05-13T16:58:37.218Z
CVE-2025-29978 Microsoft PowerPoint Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office LTSC 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-05-13T16:58:37.759Z
CVE-2025-29979 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Office Online Server
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-05-13T16:58:38.313Z
CVE-2025-29980 Blind SQL Injection vulnerability in eTRAKiT.Net
A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.77. eTRAKiT.Net is no longer supported, and users are recommended to migrate to the latest version of CentralSquare Community Development.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CentralSquare
product: eTRAKiT.Net
default_status: affected
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 9.8
attackVector: NETWORK
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: Caleb Lenz, City of Pasco, WA
Published: 2025-03-20T19:03:05.501Z
CVE-2025-29981 
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Problem types: cwe_id: CWE-202
description: CWE-202: Exposure of Sensitive Information Through Data Queries
Affected products: vendor: Dell
product: Wyse Management Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Dell would like to thank coolz0r for reporting this issue.
Published: 2025-04-02T00:01:31.828Z
CVE-2025-29982 
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
Problem types: cwe_id: CWE-277
description: CWE-277: Insecure Inherited Permissions
Affected products: vendor: Dell
product: Wyse Management Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
version: 3.1
Credits: lang: en
value: Dell Technologies would like to thank Pwni and falconCorrup for reporting this issue.
Published: 2025-04-02T00:06:40.090Z
CVE-2025-29983 
Dell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Dell
product: Dell Trusted Device Client
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Dell Technologies would like to thank falconCorrup for reporting these issues.
Published: 2025-04-15T03:30:46.207Z
CVE-2025-29984 
Dell Trusted Device, versions prior to 7.0.3.0, contain an Incorrect Default Permissions  vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Dell
product: Dell Trusted Device Client
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Dell Technologies would like to thank falconCorrup for reporting these issues.
Published: 2025-04-15T03:38:08.310Z
CVE-2025-29985 
Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Initialization of a Resource with an Insecure Default vulnerability in the Common Anti-Virus Agent (CAVA). An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
Problem types: cwe_id: CWE-1188
description: CWE-1188: Initialization of a Resource with an Insecure Default
Affected products: vendor: Dell
product: Common Event Enabler
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2025-04-08T10:44:24.736Z
CVE-2025-29986 
Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Common Anti-Virus Agent (CAVA). An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
Problem types: cwe_id: CWE-923
description: CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
Affected products: vendor: Dell
product: Common Event Enabler
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2025-04-08T10:40:39.690Z
CVE-2025-29987 
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges.
Problem types: cwe_id: CWE-1220
description: CWE-1220: Insufficient Granularity of Access Control
Affected products: vendor: Dell
product: DD OS 8.3
default_status: unaffected
vendor: Dell
product: DD OS 7.13
default_status: unaffected
vendor: Dell
product: DD OS 7.10
default_status: unaffected
vendor: Dell
product: PowerProtect DP Series Appliance (IDPA)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-04-03T15:18:06.144Z
CVE-2025-29988 
Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Dell
product: Dell Client Platform BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Dell would like to thank Matsuo Kazuki from FFRI Security, Inc. for reporting this issue.
Published: 2025-04-09T02:25:06.695Z
CVE-2025-29989 
Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to BIOS upgrade denial.
Problem types: cwe_id: CWE-1328
description: CWE-1328: Security Version Number Mutable to Older Versions
Affected products: vendor: Dell
product: Dell Client Platform BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Published: 2025-04-10T01:55:55.597Z
CVE-2025-29991 
Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, resulting in a partial signature verification.
Problem types: cwe_id: CWE-1390
description: CWE-1390 Weak Authentication
Affected products: vendor: Yubico
product: YubiKey
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 2.2
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Published: 2025-04-03T00:00:00.000Z
CVE-2025-29992 
Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or too busy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-29993 
The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail.
Problem types: cwe_id: CWE-74
description: Improper neutralization of special elements in output used by a downstream component ('Injection')
Affected products: vendor: Alfasado Inc.
product: PowerCMS 6.x series
vendor: Alfasado Inc.
product: PowerCMS 5.x series
vendor: Alfasado Inc.
product: PowerCMS 4.x series
Published: 2025-03-27T09:06:53.028Z
CVE-2025-29994 Improper Authentication Vulnerability in CAP back office application
This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with a valid login ID could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to other user accounts.
Problem types: cwe_id: CWE-1390
description: CWE-1390: Weak Authentication
Affected products: vendor: Rising Technosoft
product: CAP back office application
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Mohit Gadiya.
Published: 2025-03-13T11:12:43.796Z
CVE-2025-29995 Account Takeover Vulnerability in CAP back office application
This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable API endpoint which could lead to account takeover of targeted users.
Problem types: cwe_id: CWE-640
description: CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Affected products: vendor: Rising Technosoft
product: CAP back office application
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Mohit Gadiya.
Published: 2025-03-13T11:16:26.519Z
CVE-2025-29996 Authentication Bypass Vulnerability in CAP back office application
This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Rising Technosoft
product: CAP back office application
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Mohit Gadiya.
Published: 2025-03-13T11:18:54.799Z
CVE-2025-29997 Improper Access Control Vulnerability in CAP back office application
This vulnerability exists in the CAP back office application due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API request URL to gain unauthorized access to other user accounts.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Rising Technosoft
product: CAP back office application
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Mohit Gadiya.
Published: 2025-03-13T11:21:17.016Z
CVE-2025-29998 No Rate Limiting Vulnerability in CAP back office application
This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.
Problem types: cwe_id: CWE-799
description: CWE-799: Improper Control of Interaction Frequency
Affected products: vendor: Rising Technosoft
product: CAP back office application
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Mohit Gadiya.
Published: 2025-03-13T11:23:57.998Z
CVE-2025-29999 
A vulnerability has been identified in Siemens License Server (SLS) (All versions < V4.3). The affected application searches for executable files in the application folder without proper validation.
This could allow an attacker to execute arbitrary code with administrative privileges by placing a malicious executable in the same directory.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Siemens
product: Siemens License Server (SLS)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
baseScore: 6.7
baseSeverity: MEDIUM
Published: 2025-04-08T08:22:28.099Z