rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-43908 
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-07T18:22:27.493Z
CVE-2025-43909 
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Use of a Broken or Risky Cryptographic Algorithm vulnerability in the DD boost. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-10-07T19:11:18.767Z
CVE-2025-43910 
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain a Stack-based Buffer Overflow vulnerability in the DDSH CLI. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-10-07T19:16:21.656Z
CVE-2025-43911 
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution. Exploitation may allow privilege escalation to root.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dell
product: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
default_status: unaffected
vendor: Dell
product: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
default_status: unaffected
vendor: Dell
product: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024
default_status: unaffected
vendor: Dell
product: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-07T18:08:29.640Z
CVE-2025-43912 
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-10-07T18:48:57.243Z
CVE-2025-43913 
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Use of a Broken or Risky Cryptographic Algorithm vulnerability in the DDOS. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information disclosure. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-10-07T18:54:46.731Z
CVE-2025-43914 
Dell PowerProtect Data Domain BoostFS for Linux Ubuntu systems of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
Problem types: cwe_id: CWE-266
description: CWE-266: Incorrect Privilege Assignment
Affected products: vendor: Dell
product: PowerProtect Data Domain BoostFS for Linux Ubuntu Feature Release
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain BoostFS for Linux Ubuntu LTS2025
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain BoostFS for Linux Ubuntu LTS2024
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain BoostFS for Linux Ubuntu LTS2023
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-10-07T17:43:48.551Z
CVE-2025-43915 
In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-43916 
Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might have further implications in conjunction with "Decompiling the app revealed a hardcoded secret."
Problem types: cwe_id: CWE-647
description: CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions
Affected products: vendor: Sonos
product: api.sonos.com
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 3.4
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
Published: 2025-04-21T00:00:00.000Z
CVE-2025-43917 
In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. Specifically, an administrator can insert a new file at the pathname of the removed pritunl-service file. This file then is executed by a LaunchDaemon as root.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Pritunl
product: Pritunl-Client
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Published: 2025-04-19T00:00:00.000Z
CVE-2025-43918 
SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued for the domain name of a requester's email address, even when the requester does not otherwise establish administrative control of that domain.
Problem types: cwe_id: CWE-348
description: CWE-348 Use of Less Trusted Source
Affected products: vendor: SSL.com
product: SSL.com
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-04-19T00:00:00.000Z
CVE-2025-43919 
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: GNU
product: Mailman
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Published: 2025-04-20T00:00:00.000Z
CVE-2025-43920 
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: GNU
product: Mailman
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: 2025-04-20T00:00:00.000Z
CVE-2025-43921 
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: GNU
product: Mailman
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: 2025-04-20T00:00:00.000Z
CVE-2025-43922 
The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: FileWave
product: FileWave
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-04-21T00:00:00.000Z
CVE-2025-43923 
An issue was discovered in ReportController in Unicom Focal Point 7.6.1. A user who has administrative privilege in Focal Point can perform SQL injection via the image parameter during a delete report image operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-03T00:00:00.000Z
CVE-2025-43924 
Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController (for /fp/admin/settings/loginpage) and the rootserviceurl parameter in FriendsController (for /fp/admin/settings/friends), entered by an admin, allow stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-03T00:00:00.000Z
CVE-2025-43925 
An issue was discovered in Unicom Focal Point 7.6.1. The database is encrypted with a hardcoded key, making it easier to recover the cleartext data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-03T00:00:00.000Z
CVE-2025-43926 
An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-43928 
In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing.
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: Infodraw
product: Media Relay Service
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Published: 2025-04-20T00:00:00.000Z
CVE-2025-43929 
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).
Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: kitty project
product: kitty
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: 2025-04-20T00:00:00.000Z
CVE-2025-43930 
Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-07T00:00:00.000Z
CVE-2025-43931 
flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-07T00:00:00.000Z
CVE-2025-43932 
JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-07T00:00:00.000Z
CVE-2025-43933 
fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-07T00:00:00.000Z
CVE-2025-43934 
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0, LTS2024 release versions 7.13.1.0 through 7.13.1.30, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service and Unauthorized access.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2025
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2024
default_status: unaffected
vendor: Dell
product: PowerProtect Data Domain with Data Domain Operating System (DD OS) LTS2023
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
version: 3.1
Published: 2025-10-07T18:30:18.124Z
CVE-2025-43935 
Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.
Problem types: cwe_id: CWE-404
description: CWE-404: Improper Resource Shutdown or Release
Affected products: vendor: Dell
product: PowerScale OneFS
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 4.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Published: 2026-04-16T17:59:04.315Z
CVE-2025-43937 
Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: Dell
product: PowerScale OneFS
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.6
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Published: 2026-04-16T18:03:08.750Z
CVE-2025-43938 
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to gain unauthorized access with privileges of the compromised account.
Problem types: cwe_id: CWE-256
description: CWE-256: Plaintext Storage of a Password
Affected products: vendor: Dell
product: PowerProtect Data Manager
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-09-10T16:03:38.951Z
CVE-2025-43939 
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'
Affected products: vendor: Dell
product: Unity
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Dell would like to thank zzcentury from Ubisectech Sirius Team for reporting this issue
Published: 2025-10-30T14:10:14.508Z