rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-48498 
A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of fields used for coordination. A specially crafted protocol buffer message can lead to a denial of service. An attacker can simply connect to a database instance over TCP and send the crafted message to trigger this vulnerability.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Bloomberg
product: Comdb2
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Discovered by a member of Cisco Talos.
Published: 2025-07-22T15:26:31.314Z
CVE-2025-48499 
Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write
Affected products: vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CP225 w
vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CP228 w
vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CP115 w
vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CP118 w
vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CP116 w
vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CP119 w
vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CM225 fw
vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CM228 fw
vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CM115 w
vendor: FUJIFILM Business Innovation Corp.
product: DocuPrint CM118 w
vendor: FUJIFILM Business Innovation Corp.
product: Apoes 2150 N
vendor: FUJIFILM Business Innovation Corp.
product: Apoes 2350 NDA
vendor: FUJIFILM Business Innovation Corp.
product: Apoes 2150 ND
vendor: FUJIFILM Business Innovation Corp.
product: Apoes 2150 NDA
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2025-08-04T05:17:01.537Z
CVE-2025-48500 BIG-IP APM VPN web client for macOS vulnerability
A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. 
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-353
description: CWE-353: Missing Support for Integrity Check
Affected products: vendor: F5
product: BIG-IP Edge Client
default_status: unknown
vendor: F5
product: BIG-IP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: F5 acknowledges Adwiteeya Agrawal of Snapchat, Inc for bringing this issue to our attention and following the highest standards of coordinated disclosure.
Published: 2025-08-13T14:46:54.682Z
CVE-2025-48501 
An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commands may be executed on the server where the product is running.
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: Nimesa
product: Nimesa Backup and Recovery
vendor: Nimesa
product: Nimesa Backup and Recovery
Published: 2025-07-07T04:51:39.574Z
CVE-2025-48502 
Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial of service.
Problem types: cwe_id: CWE-1285
description: CWE-1285  Improper Validation of Specified Index, Position, or Offset in Input
Affected products: vendor: AMD
product: AMD μProf
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2025-11-21T19:07:34.889Z
CVE-2025-48507 
The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the ability to turn on and off subsystems within the SOC.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: AMD
product: Kria™ SOM
default_status: affected
vendor: AMD
product: Zynq™ UltraScale+™ MPSoCs
default_status: affected
vendor: AMD
product: Zynq™ UltraScale+™ RFSoCs
default_status: affected
Published: 2025-11-23T17:07:56.914Z
CVE-2025-48508 
Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control reset operation potentially causing host or GPU crash or reset resulting in denial of service.
Problem types: cwe_id: CWE-1245
description: CWE-1245  Improper Finite State Machines (FSMs) in Hardware Logic
Affected products: vendor: AMD
product: AMD Radeon™ PRO V710
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
Published: 2026-02-11T14:29:11.534Z
CVE-2025-48509 
Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity
Problem types: cwe_id: CWE-665
description: CWE-665  Improper Initialization
Affected products: vendor: AMD
product: AMD EPYC™ 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 8004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 8004 Series Processors
default_status: affected
Published: 2026-02-10T19:13:21.993Z
CVE-2025-48510 
Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.
Problem types: cwe_id: CWE-394
description: CWE-394  Unexpected Status Code or Return Value
Affected products: vendor: AMD
product: AMD μProf
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2025-11-24T20:56:39.348Z
CVE-2025-48511 
Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crash or denial of service.
Problem types: cwe_id: CWE-1285
description: CWE-1285  Improper Validation of Specified Index, Position, or Offset in Input
Affected products: vendor: AMD
product: AMD μProf
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2025-11-24T21:00:32.010Z
CVE-2025-48513 
Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memory resulting in loss of confidentiality or availability.
Problem types: cwe_id: CWE-908
description: CWE-908  Use of Uninitialized Resource
Affected products: vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Z1 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:51:56.314Z
CVE-2025-48514 
Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality.
Problem types: cwe_id: CWE-1220
description: CWE-1220  Insufficient Granularity of Access Control
Affected products: vendor: AMD
product: AMD EPYC™ 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 8004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 8004 Series Processors
default_status: affected
Published: 2026-02-10T19:14:22.874Z
CVE-2025-48515 
Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, potentially resulting in arbitrary code execution.
Problem types: cwe_id: CWE-190
description: CWE-190  Integer Overflow or Wraparound
Affected products: vendor: AMD
product: AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V2000 Series Processors
default_status: affected
Published: 2026-02-10T19:49:14.504Z
CVE-2025-48517 
Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality.
Problem types: cwe_id: CWE-1220
description: CWE-1220  Insufficient Granularity of Access Control
Affected products: vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
Published: 2026-02-10T19:08:21.524Z
CVE-2025-48518 
Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of service.
Problem types: cwe_id: CWE-787
description: CWE-787  Out-of-bounds Write
Affected products: vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ AI 300 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Al Max+
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
vendor: AMD
product: AMD Radeon™ RX 7000 Series Graphics Products
default_status: affected
vendor: AMD
product: AMD Radeon™ PRO W7000 Series Graphics Products
default_status: affected
vendor: AMD
product: AMD Radeon™ RX 9000 Series Graphics Products
default_status: affected
vendor: AMD
product: AMD Radeon™ PRO V710
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-02-11T14:34:29.714Z
CVE-2025-48519 
An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or write Out-of-Bounds, potentially resulting in privilege escalation
Problem types: cwe_id: CWE-787
description: CWE-787  Out-of-bounds Write
Affected products: vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:50:34.374Z
CVE-2025-48520 
An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read Out-of-Bounds potentially resulting in information disclosure or a crash
Problem types: cwe_id: CWE-125
description: CWE-125  Out-of-bounds Read
Affected products: vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:51:03.047Z
CVE-2025-48522 
In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:04.810Z
CVE-2025-48523 
In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:05.838Z
CVE-2025-48524 
In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:06.885Z
CVE-2025-48525 
In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to a companion device due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-12-08T16:57:00.905Z
CVE-2025-48526 
In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:07.920Z
CVE-2025-48527 
In multiple locations, there is a possible way to leak hidden work profile notifications due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:09.061Z
CVE-2025-48528 
In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:10.219Z
CVE-2025-48529 
In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:11.346Z
CVE-2025-48530 
In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. This could lead to remote code execution in combination with other bugs, with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:17:26.058Z
CVE-2025-48531 
In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:12.489Z
CVE-2025-48532 
In markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:13.538Z
CVE-2025-48533 
In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:17:27.065Z
CVE-2025-48534 
In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:14.563Z
CVE-2025-48535 
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:15.589Z
CVE-2025-48536 
In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-12-08T16:57:02.019Z
CVE-2025-48537 
In multiple locations, there is a possible way to persistently DoS the device due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:16.616Z
CVE-2025-48538 
In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2025-09-04T18:34:17.642Z