rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-27692 
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote execution
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Dell
product: Wyse Management Suite Repository
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Dell Technologies would like to thank Alain Mowat from Orange Cyberdefense Switzerland's research lab for reporting these issues.
Published: 2025-04-02T00:24:44.123Z
CVE-2025-27693 
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Dell
product: Wyse Management Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Dell Technologies would like to thank Alain Mowat from Orange Cyberdefense Switzerland's research lab for reporting these issues.
Published: 2025-04-02T00:19:55.827Z
CVE-2025-27694 
Dell Wyse Management Suite, versions prior to  WMS 5.1, contains an Insufficient Resource Pool vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
Problem types: cwe_id: CWE-410
description: CWE-410: Insufficient Resource Pool
Affected products: vendor: Dell
product: Wyse Management Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Dell Technologies would like to thank Alain Mowat from Orange Cyberdefense Switzerland's research lab for reporting these issues.
Published: 2025-04-02T00:12:16.032Z
CVE-2025-27695 
Dell Wyse Management Suite, versions prior to WMS 5.1 contain an Authentication Bypass by Spoofing vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.
Problem types: cwe_id: CWE-290
description: CWE-290: Authentication Bypass by Spoofing
Affected products: vendor: Dell
product: Wyse Management Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Dell Technologies would like to thank Alain Mowat from Orange Cyberdefense Switzerland's
Published: 2025-05-08T19:06:42.090Z
CVE-2025-27696 Apache Superset: Incorrect authorization leading to resource ownership takeover
Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions.

This issue affects Apache Superset: through 4.1.1.

Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Apache Software Foundation
product: Apache Superset
default_status: unaffected
Credits: lang: en
value: João Marono
lang: en
value: Daniel Gaspar
Published: 2025-05-13T08:21:21.199Z
CVE-2025-27700 
There is a possible bypass of carrier restrictions due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-05-27T15:41:52.015Z
CVE-2025-27701 
In the function process_crypto_cmd, the values of ptrs[i] can be potentially equal to NULL which is valid value after calling slice_map_array(). Later this values will be derefenced without prior NULL check, which can lead to local Temporary DoS or OOB Read, leading to information disclosure.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-05-27T15:42:11.318Z
CVE-2025-27702 Permissions bypass in the management console of Absolute Secure Access prior to version 13.54
CVE-2025-27702 is a vulnerability in the management console of Absolute 
Secure Access prior to version 13.54. Attackers with administrative 
access to the console and who have been assigned a certain set of 
permissions can bypass those permissions to improperly modify settings. 
The attack complexity is low, there are no preexisting attack 
requirements; the privileges required are high, and there is no user 
interaction required. There is no impact to system confidentiality or 
availability, impact to system integrity is high.
Affected products: vendor: Absolute Security
product: Secure Access
default_status: unaffected
Published: 2025-05-28T20:42:34.657Z
CVE-2025-27703 Privilege escalation in the management console of Absolute Secure Access prior to version 13.54
CVE-2025-27703 is a privilege escalation vulnerability in the management
 console of Absolute Secure Access prior to version 13.54. Attackers 
with administrative access to a specific subset of privileged features 
in the console can elevate their permissions to access additional 
features in the console. The attack complexity is low, there are no 
preexisting attack requirements; the privileges required are high, and 
there is no user interaction required. The impact to system 
confidentiality is low, the impact to system integrity is high and the 
impact to system availability is low.
Affected products: vendor: Absolute Security
product: Secure Access
default_status: unaffected
Published: 2025-05-28T20:56:53.459Z
CVE-2025-27704 
There is a cross-site scripting vulnerability in the Secure
Access administrative console of Absolute Secure Access prior to version 13.53.
Attackers with system administrator permissions can interfere with another
system administrator’s use of the management console when the second
administrator logs in.  Attack complexity is high, attack requirements are
present, privileges required are none, user interaction is required. The impact
to confidentiality is low, the impact to availability is none, and the impact
to system integrity is none.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Absolute Security
product: Secure Access
default_status: unaffected
Published: 2025-03-19T19:08:26.262Z
CVE-2025-27705 
There is a cross-site scripting vulnerability in the Secure
Access administrative console of Absolute Secure Access prior to version 13.53.
Attackers with system administrator permissions can interfere with another
system administrator’s use of the management console when the second
administrator logs in.  Attack complexity is high, attack requirements are
present, privileges required are none, user interaction is required. The impact
to confidentiality is low, the impact to availability is none, and the impact
to system integrity is none.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Absolute Security
product: Secure Access
default_status: unaffected
Published: 2025-03-19T19:15:08.265Z
CVE-2025-27706 Cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.54
CVE-2025-27706 is a cross-site scripting vulnerability in the management
 console of Absolute Secure Access prior to version 13.54. Attackers 
with system administrator permissions can interfere with another system 
administrator’s use of the management console when the second 
administrator visits the page. Attack complexity is low, there are no 
preexisting attack requirements, privileges required are high and active
 user interaction is required. There is no impact on confidentiality, 
the impact on integrity is low and there is no impact on availability.
Affected products: vendor: Absolute Security
product: Secure Access
default_status: unaffected
Published: 2025-05-28T21:01:08.548Z
CVE-2025-27707 
Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
Problem types: description: Denial of Service
cwe_id: CWE-200
description: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: Edge Orchestrator software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.6
baseSeverity: LOW
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
Published: 2025-08-12T16:59:33.769Z
CVE-2025-27708 
Out-of-bounds read in the firmware for some Intel(R) Converged Security and Management Engine (CSME) Firmware (FW) within Ring 0: Kernel may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Information Disclosure
cwe_id: CWE-125
description: Out-of-bounds Read
Affected products: vendor: n/a
product: Intel(R) Converged Security and Management Engine (CSME) Firmware (FW)
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
Published: 2026-02-10T16:25:29.434Z
CVE-2025-27709 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2025-06-09T11:04:38.114Z
CVE-2025-27710 
Untrusted pointer dereference for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Information Disclosure
cwe_id: CWE-822
description: Untrusted Pointer Dereference
Affected products: vendor: n/a
product: Intel(R) QAT Windows software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
Published: 2025-11-11T16:50:22.300Z
CVE-2025-27711 
Incorrect default permissions for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: n/a
product: Intel(R) One Boot Flash Update (Intel(R) OFU) software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-11-11T16:50:24.723Z
CVE-2025-27712 
Improper neutralization for some Intel(R) Neural Compressor software before version v3.4 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-707
description: Improper Neutralization
Affected products: vendor: n/a
product: Intel(R) Neural Compressor software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
Published: 2025-11-11T16:50:26.475Z
CVE-2025-27713 
Out-of-bounds write for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-787
description: Out-of-bounds Write
Affected products: vendor: n/a
product: Intel(R) QAT Windows software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-11-11T16:50:28.055Z
CVE-2025-27714 INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type
An attacker could exploit this vulnerability by uploading arbitrary 
files via the a specific endpoint, leading to unauthorized remote code 
execution or system compromise.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: INFINITT Healthcare
product: INFINITT PACS System Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA.
Published: 2025-08-21T19:42:59.699Z
CVE-2025-27715 Auto-Enrollment of Team Admins into Private Channels without explicit consent
Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Joram Wilander
Published: 2025-03-21T08:22:25.321Z
CVE-2025-27716 
Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered by a crafted HTTP request to specific functions of the product from a device connected to the LAN side.
Problem types: cwe_id: CWE-22
description: Improper limitation of a pathname to a restricted directory ('Path Traversal')
Affected products: vendor: KDDI CORPORATION
product: HGW-BL1500HM
Published: 2025-03-28T08:18:23.782Z
CVE-2025-27717 
Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privilege via local access
Problem types: description: Escalation of Privilege
cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: Intel(R) Graphics Driver software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-08-12T16:59:35.302Z
CVE-2025-27718 
Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vulnerability is exploited, the product's files may be obtained and/or altered or arbitrary code may be executed by a crafted HTTP request to specific functions of the product from a device connected to the LAN side.
Problem types: cwe_id: CWE-22
description: Improper limitation of a pathname to a restricted directory ('Path Traversal')
Affected products: vendor: KDDI CORPORATION
product: HGW-BL1500HM
Published: 2025-03-28T08:18:36.814Z
CVE-2025-27719 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can query an API endpoint and get device details.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Growatt
product: Cloud portal
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Forescout Technologies reported these vulnerabilities to CISA.
Published: 2025-04-15T21:09:29.425Z
CVE-2025-27720 Pixmeo OsiriX MD Cleartext Transmission of Sensitive Information
The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Pixmeo
product: OsiriX MD
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Chizuru Toyama of TXOne Networks and Canaan Kao of TXOne Networks reported these vulnerabilities to CISA.
Published: 2025-05-08T22:43:28.046Z
CVE-2025-27721 INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere
Unauthorized users can access INFINITT PACS System Manager without proper authorization, 
which could lead to unauthorized access to system resources.
Problem types: cwe_id: CWE-497
description: CWE-497
Affected products: vendor: INFINITT Healthcare
product: INFINITT PACS System Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Piotr Kijewski of the Shadowserver Foundation reported these vulnerabilities to CISA.
Published: 2025-08-21T19:33:03.503Z