rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-54282 Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)
Adobe Framemaker versions 2020.9, 2022.7 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow (CWE-122)
Affected products: vendor: Adobe
product: Adobe Framemaker
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.8
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: NONE
modifiedScope: UNCHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-14T19:21:10.101Z
CVE-2025-54283 Illustrator | Out-of-bounds Write (CWE-787)
Illustrator versions 29.7, 28.7.9 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Illustrator
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.8
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: NONE
modifiedScope: UNCHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-14T19:28:26.553Z
CVE-2025-54284 Illustrator | Out-of-bounds Write (CWE-787)
Illustrator versions 29.7, 28.7.9 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Illustrator
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.8
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: NONE
modifiedScope: UNCHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-14T19:28:25.502Z
CVE-2025-54286 CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Canonical
product: LXD
default_status: unaffected
Credits: lang: en
value: GMO Flatt Security Inc.
Published: 2025-10-02T09:12:49.044Z
CVE-2025-54287 Arbitrary File Read via Template Injection in Snapshot Patterns
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration 
permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.
Problem types: cwe_id: CWE-1336
description: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: Canonical
product: LXD
default_status: unaffected
Credits: lang: en
value: GMO Flatt Security Inc.
Published: 2025-10-02T09:16:02.241Z
CVE-2025-54288 Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.
Problem types: cwe_id: CWE-290
description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Canonical
product: LXD
default_status: unaffected
Credits: lang: en
value: GMO Flatt Security Inc.
Published: 2025-10-02T09:20:33.135Z
CVE-2025-54289 Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
Problem types: cwe_id: CWE-1385
description: CWE-1385: Missing Origin Validation in WebSockets
Affected products: vendor: Canonical
product: LXD
default_status: unaffected
Credits: lang: en
value: GMO Flatt Security Inc.
Published: 2025-10-02T09:23:03.238Z
CVE-2025-54290 Project Existence Disclosure via Error Handling in LXD Image Export
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Canonical
product: LXD
default_status: unaffected
Credits: lang: en
value: GMO Flatt Security Inc.
Published: 2025-10-02T09:24:12.894Z
CVE-2025-54291 Project existence disclosure in LXD images API
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: Canonical
product: LXD
default_status: unaffected
Credits: lang: en
value: GMO Flatt Security Inc.
Published: 2025-10-02T09:25:42.466Z
CVE-2025-54292 Client-Side Path Traversal in LXD-UI
Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Canonical
product: LXD
default_status: unaffected
Credits: lang: en
value: GMO Flatt Security Inc.
Published: 2025-10-02T09:26:39.228Z
CVE-2025-54293 Path Traversal in LXD Instance Log File Retrieval
Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Canonical
product: LXD
default_status: unaffected
Credits: lang: en
value: GMO Flatt Security Inc.
Published: 2025-10-02T10:43:58.246Z
CVE-2025-54294 Extension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for Joomla
A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered. The issue allows unprivileged users to execute arbitrary SQL commands.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: stackideas.com
product: Komento component for Joomla
default_status: unaffected
Credits: lang: en
value: Sebastian Jeż
Published: 2025-07-23T11:15:59.659Z
CVE-2025-54295 Extension - dj-extensions.com - Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla
A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: dj-extensions.com
product: DJ-Reviews component for Joomla
default_status: unaffected
Credits: lang: en
value: Sebastian Jeż
Published: 2025-07-23T11:15:23.575Z
CVE-2025-54296 Extension - mooj.org - Stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla
A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: mooj.org
product: ProFiles component for Joomla
default_status: unaffected
Credits: lang: en
value: Sebastian Jeż
Published: 2025-07-23T11:15:01.946Z
CVE-2025-54297 Extension - compojoom.com - Stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla
A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: compojoom.com
product: CComment component for Joomla
default_status: unaffected
Credits: lang: en
value: Sebastian Jeż
Published: 2025-07-23T11:16:12.527Z
CVE-2025-54298 Extension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla
A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: firecoders.com
product: CommentBox component for Joomla
default_status: unaffected
Credits: lang: en
value: Sebastian Jeż
Published: 2025-07-28T17:29:32.441Z
CVE-2025-54299 Extension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla
A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: nobossextensions.com
product: No Boss Testimonials component for Joomla
default_status: unaffected
Credits: lang: en
value: Sebastian Jeż
Published: 2025-07-28T17:30:00.460Z
CVE-2025-54300 Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla
A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: norrnext.com
product: Quantum Mamanger component for Joomla
default_status: unaffected
Credits: lang: en
value: Sebastian Jeż
Published: 2025-08-25T06:54:47.229Z
CVE-2025-54301 Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla
A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: norrnext.com
product: Quantum Mamanger component for Joomla
default_status: unaffected
Credits: lang: en
value: Sebastian Jeż
Published: 2025-08-25T06:54:43.633Z
CVE-2025-54303 
The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user account can be used to authenticate to default deployments with the password ionadmin. The user guide recommends changing default credentials; however, a password change policy for default administrative accounts is not enforced. Many deployments may retain default credentials, in which case an attacker is likely to be able to successfully authenticate with administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-04T00:00:00.000Z
CVE-2025-54304 
An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is started. The display server listens on all network interfaces and is accessible over port 6000. The X11 access control list, by default, allows connections from 127.0.0.1 and 192.168.2.15. If a device is powered on and later connected to a network with DHCP, the device may not be assigned the 192.168.2.15 IP address, leaving the display server accessible by other devices on the network. The exposed X11 display server can then be used to gain root privileges and the ability to execute code remotely by interacting with matchbox-desktop and spawning a terminal. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-04T00:00:00.000Z
CVE-2025-54305 
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, LocalhostAuthMiddleware, authenticates users as ionadmin if the REMOTE_ADDR property in request.META is set to 127.0.0.1, to 127.0.1.1, or to ::1. Any user with local access to the server may bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-04T00:00:00.000Z
CVE-2025-54306 
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerability exists in the network configuration functionality, stemming from insufficient input validation when processing network configuration parameters through administrative endpoints. The application allows administrators to modify the server's network configuration through the Django application. This configuration is processed by Bash scripts (TSsetnoproxy and TSsetproxy) that write user-controlled data directly to environment variables without proper sanitization. After updating environment variables, the scripts execute a source command on /etc/environment; if an attacker injects malicious data into environment variables, this command can enable arbitrary command execution. The vulnerability begins with the /admin/network endpoint, which passes user-supplied form data as arguments to subprocess.Popen calls. The user-supplied input is then used to update environment variables in TSsetnoproxy and TSsetproxy, and finally source $environment is executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-04T00:00:00.000Z
CVE-2025-54307 
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/upload/zip/ and /configure/newupdates/offline/bundle/upload/ endpoints allow low-privilege users to upload ZIP files to the server. The plupload_file_upload function handles these file uploads and constructs the destination file path by using either the name parameter or the uploaded filename, neither of which is properly sanitized. The file extension is extracted by splitting the filename, and a format string is used to construct the final file path, leaving the destination path vulnerable to path traversal. An authenticated attacker with network connectivity can write arbitrary files to the server, enabling remote code execution after overwriting an executable file. An example is the pdflatex executable, which is executed through subprocess.Popen in the write_report_pdf function after requests to a /report/latex/(\d+).pdf endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-04T00:00:00.000Z
CVE-2025-54309 
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Problem types: cwe_id: CWE-420
description: CWE-420 Unprotected Alternate Channel
Affected products: vendor: CrushFTP
product: CrushFTP
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-07-18T00:00:00.000Z
CVE-2025-54310 
qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwidget.cpp.
Problem types: cwe_id: CWE-669
description: CWE-669 Incorrect Resource Transfer Between Spheres
Affected products: vendor: qBittorrent
product: qBittorrent
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Published: 2025-07-18T00:00:00.000Z
CVE-2025-54313 
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
Problem types: cwe_id: CWE-506
description: CWE-506 Embedded Malicious Code
Affected products: vendor: prettier
product: eslint-config-prettier
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Published: 2025-07-19T00:00:00.000Z
CVE-2025-54314 
Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: rubyonrails
product: Thor
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.8
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Published: 2025-07-20T00:00:00.000Z
CVE-2025-54315 
The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
Problem types: cwe_id: CWE-837
description: CWE-837 Improper Enforcement of a Single, Unique Action
Affected products: vendor: Matrix
product: Matrix specification
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Published: 2025-10-02T00:00:00.000Z
CVE-2025-54316 
An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to generate XSS payloads. These payloads can be rendered by the Logpoint Report Template engine, making it vulnerable to cross-site scripting (XSS) attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Logpoint
product: Logpoint
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-07-20T00:00:00.000Z
CVE-2025-54317 
An issue was discovered in Logpoint before 7.6.0. An attacker with operator privileges can exploit a path traversal vulnerability when creating a Layout Template, which can lead to remote code execution (RCE).
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Logpoint
product: Logpoint
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.4
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Published: 2025-07-20T00:00:00.000Z
CVE-2025-54319 
An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system logging information (syslog verbose logging that includes credentials).
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: Westermo
product: WeOS
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Published: 2025-07-20T00:00:00.000Z
CVE-2025-54320 
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-18T00:00:00.000Z
CVE-2025-54321 
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-18T00:00:00.000Z
CVE-2025-54322 
Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.
Problem types: cwe_id: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected products: vendor: Xspeeder
product: SXZOS
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 10
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-12-27T00:00:00.000Z
CVE-2025-54323 
An issue was discovered in the camera in Samsung Mobile Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, and 1580. Improper debug printing leads to information leakage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-04T00:00:00.000Z
CVE-2025-54324 
An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Incorrect Handling of a DL NAS Transport packet leads to a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-06T00:00:00.000Z