rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-27617 Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: pimcore
product: pimcore
Published: 2025-03-11T15:35:51.895Z
CVE-2025-27622 
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2025-03-05T22:33:34.766Z
CVE-2025-27623 
Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2025-03-05T22:33:35.469Z
CVE-2025-27624 
A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2025-03-05T22:33:36.141Z
CVE-2025-27625 
In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects.
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2025-03-05T22:33:36.808Z
CVE-2025-27631 
The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website.
Problem types: cwe_id: CWE-90
description: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Affected products: vendor: Hitachi Energy
product: TRMTracker
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2025-03-25T12:46:08.184Z
CVE-2025-27632 
A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.
Problem types: cwe_id: CWE-644
description: CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
Affected products: vendor: Hitachi Energy
product: TRMTracker
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-03-25T12:37:30.114Z
CVE-2025-27633 
The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to compromise the confidentiality and integrity of the system.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Hitachi Energy
product: TRMTracker
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-03-25T12:40:37.667Z
CVE-2025-27636 Apache Camel: Camel Message Header Injection via Improper Filtering
Bypass/Injection vulnerability in Apache Camel components under particular conditions.

This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3.

Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.



This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific

headers that for some Camel components can alter the behaviours such as the camel-bean component, to call another method

on the bean, than was coded in the application. In the camel-jms component, then a malicious header can be used to send

the message to another queue (on the same broker) than was coded in the application. This could also be seen by using the camel-exec component




The attacker would need to inject custom headers, such as HTTP protocols. So if you have Camel applications that are

directly connected to the internet via HTTP, then an attacker could include malicious HTTP headers in the HTTP requests

that are send to the Camel application.




All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box.

In these conditions an attacker could be able to forge a Camel header name and make the bean component invoking other methods in the same bean.

In terms of usage of the default header filter strategy the list of components using that is: 


  *  camel-activemq
  *  camel-activemq6
  *  camel-amqp
  *  camel-aws2-sqs
  *  camel-azure-servicebus
  *  camel-cxf-rest
  *  camel-cxf-soap
  *  camel-http
  *  camel-jetty
  *  camel-jms
  *  camel-kafka
  *  camel-knative
  *  camel-mail
  *  camel-nats
  *  camel-netty-http
  *  camel-platform-http
  *  camel-rest
  *  camel-sjms
  *  camel-spring-rabbitmq
  *  camel-stomp
  *  camel-tahu
  *  camel-undertow
  *  camel-xmpp






The vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with "Camel", "camel", or "org.apache.camel.". 


Mitigation: You can easily work around this in your Camel applications by removing the headers in your Camel routes. There are many ways of doing this, also globally or per route. This means you could use the removeHeaders EIP, to filter out anything like "cAmel, cAMEL" etc, or in general everything not starting with "Camel", "camel" or "org.apache.camel.".
Problem types: description: Bypass/Injection
Affected products: vendor: Apache Software Foundation
product: Apache Camel
default_status: unaffected
Credits: lang: en
value: Mark Thorson
Published: 2025-03-09T12:09:58.619Z
CVE-2025-27637 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Cross-Site Scripting V-2024-016.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27638 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27639 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Privilege Escalation V-2024-015.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27640 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows SQL Injection V-2024-012.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27641 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-Sign On V-2024-009.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27642 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package Editing V-2024-008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27643 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27644 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Local Privilege Escalation V-2024-007.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27645 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Insecure Extension Installation by Trusting HTTP Permission Methods on the Server Side V-2024-005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27646 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27647 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users Without Authentication V-2024-002.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27648 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Cross Tenant Password Exposure V-2024-003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27649 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.893 Application 20.0.2140 allows Incorrect Access Control: PHP V-2023-016.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27650 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-2023-013.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27651 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: Elatec V-2023-014.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27652 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: rfIDEAS V-2023-015.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27653 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Preauthenticated Cross Site Scripting (XSS): Badge Registration V-2023-012.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27654 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Cross Site Scripting (XSS) V-2023-017.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27655 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: CPA v1 V-2023-009.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27656 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27657 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Code Execution V-2023-008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27658 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Authentication Bypass OVE-20230524-0001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27659 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows SQL Injection OVE-20230524-0002.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27660 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross Site Scripting OVE-20230524-0003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27661 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27662 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27663 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password Encryption / Encoding OVE-20230524-0007.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27664 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient CSRF Protection OVE-20230524-0008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27665 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Antivirus Protection and thus drivers can have known malicious code OVE-20230524-0009.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27666 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks OVE-20230524-0010.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27667 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-0011.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27668 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via Iframe OVE-20230524-0012.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27669 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Network Scanning (XSPA)/DoS OVE-20230524-0013.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27670 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Signature Validation OVE-20230524-0014.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27671 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20230524-0015.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27672 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20230524-0016.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27673 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body OVE-20230524-0017.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27674 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27675 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27676 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Reports V-2023-002.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27677 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged File Interaction V-2022-002.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27678 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote Code Execution V-2023-001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27679 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Badge Registration V-2023-005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27680 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insufficient Verification of Data Authenticity V-2024-004.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27681 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-2022-004.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27682 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Permissions V-2022-005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27683 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Driver Unrestricted Upload of File with Dangerous Type V-2022-006.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27684 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive Data V-2022-003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27685 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Configuration File Contains CA & Private Key V-2022-001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-27686 
Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
Problem types: cwe_id: CWE-90
description: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Affected products: vendor: Dell
product: Unisphere for PowerMax
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-04-07T13:23:08.166Z
CVE-2025-27688 
Dell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Dell
product: Wyse Proprietary OS (Modern ThinOS)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-03-18T15:55:44.470Z
CVE-2025-27689 
Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Dell
product: iDRAC Tools
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Dell would like to thank “falconCorrup” for reporting this issue.
Published: 2025-06-12T20:36:24.943Z
CVE-2025-27690 
Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to the takeover of a high privileged user account.
Problem types: cwe_id: CWE-1393
description: CWE-1393: Use of Default Password
Affected products: vendor: Dell
product: PowerScale OneFS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-04-10T02:04:43.949Z