rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-53663 
Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins IBM Cloud DevOps Plugin
default_status: unknown
Published: 2025-07-09T15:39:34.283Z
CVE-2025-53664 
Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Apica Loadtest Plugin
default_status: unknown
Published: 2025-07-09T15:39:34.872Z
CVE-2025-53665 
Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Affected products: vendor: Jenkins Project
product: Jenkins Apica Loadtest Plugin
default_status: unknown
Published: 2025-07-09T15:39:35.465Z
CVE-2025-53666 
Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Dead Man's Snitch Plugin
default_status: unknown
Published: 2025-07-09T15:39:36.057Z
CVE-2025-53667 
Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Affected products: vendor: Jenkins Project
product: Jenkins Dead Man's Snitch Plugin
default_status: unknown
Published: 2025-07-09T15:39:36.655Z
CVE-2025-53668 
Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins VAddy Plugin
default_status: unknown
Published: 2025-07-09T15:39:37.219Z
CVE-2025-53669 
Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Affected products: vendor: Jenkins Project
product: Jenkins VAddy Plugin
default_status: unknown
Published: 2025-07-09T15:39:37.810Z
CVE-2025-53670 
Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Nouvola DiveCloud Plugin
default_status: unknown
Published: 2025-07-09T15:39:38.401Z
CVE-2025-53671 
Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
Affected products: vendor: Jenkins Project
product: Jenkins Nouvola DiveCloud Plugin
default_status: unknown
Published: 2025-07-09T15:39:39.001Z
CVE-2025-53672 
Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Kryptowire Plugin
default_status: unknown
Published: 2025-07-09T15:39:39.579Z
CVE-2025-53673 
Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Sensedia Api Platform tools Plugin
default_status: unknown
Published: 2025-07-09T15:39:40.223Z
CVE-2025-53674 
Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it.
Affected products: vendor: Jenkins Project
product: Jenkins Sensedia Api Platform tools Plugin
default_status: unknown
Published: 2025-07-09T15:39:40.807Z
CVE-2025-53675 
Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Warrior Framework Plugin
default_status: unknown
Published: 2025-07-09T15:39:41.411Z
CVE-2025-53676 
Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Xooa Plugin
default_status: unknown
Published: 2025-07-09T15:39:41.984Z
CVE-2025-53677 
Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it.
Affected products: vendor: Jenkins Project
product: Jenkins Xooa Plugin
default_status: unknown
Published: 2025-07-09T15:39:42.556Z
CVE-2025-53678 
Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins User1st uTester Plugin
default_status: unknown
Published: 2025-07-09T15:39:43.280Z
CVE-2025-53679 
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSandbox
cpes: cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: Fortinet
product: FortiSandbox Cloud
cpes: cpe:2.3:a:fortinet:fortisandboxcloud:24.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxcloud:23.4:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C
Published: 2025-12-09T17:19:51.110Z
CVE-2025-53681 
An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated privileged attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.
Problem types: cwe_id: CWE-89
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiMail
cpes: cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-05-12T16:54:11.052Z
CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.

Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: Apache Software Foundation
product: Apache Jackrabbit
default_status: unaffected
Credits: lang: en
value: Lars Krapf - Adobe
lang: en
value: Dylan Pindur - Assetnote
lang: en
value: Adam Kues - Assetnote
Published: 2025-07-14T09:15:38.863Z
CVE-2025-53690 Sitecore Products ViewState Deserialization Vulnerability
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Sitecore
product: Experience Manager (XM)
default_status: unaffected
vendor: Sitecore
product: Experience Platform (XP)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Mandiant Threat Defense
Published: 2025-09-03T20:04:48.223Z
CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Sitecore
product: Experience Manager (XM)
default_status: unaffected
vendor: Sitecore
product: Experience Platform (XP)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Piotr Bazydlo of watchTowr
Published: 2025-09-03T12:36:59.561Z
CVE-2025-53692 Sitecore Experience Platform Cross-Site Scripting Vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Sitecore
product: Sitecore Experience Manager (XM)
default_status: unaffected
vendor: Sitecore
product: Experience Platform (XP)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Published: 2025-09-21T19:42:46.643Z
CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Problem types: cwe_id: CWE-470
description: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Affected products: vendor: Sitecore
product: Sitecore Experience Manager (XM)
default_status: unaffected
vendor: Sitecore
product: Experience Platform (XP)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Piotr Bazydlo of watchTowr
Published: 2025-09-03T12:36:53.745Z
CVE-2025-53694 Information Disclosure in ItemServices API
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Sitecore
product: Sitecore Experience Manager (XM)
default_status: unaffected
vendor: Sitecore
product: Experience Platform (XP)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Piotr Bazydlo of watchTowr
Published: 2025-09-03T12:36:37.520Z
CVE-2025-53695 
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Johnson Controls, Inc
product: iSTAR Ultra
default_status: unknown
Published: 2025-07-28T14:05:36.623Z
CVE-2025-53696 
iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of Code Without Integrity Check
Affected products: vendor: Johnson Controls, Inc
product: iSTAR Ultra
default_status: unknown
Published: 2025-07-28T14:43:01.059Z
CVE-2025-53701 XSS vulnerability in Vilar VS-IPC1002 IP cameras
Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS (Cross-site Scripting) attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users.
The vendor did not respond in any way. Only version 1.1.0.18 was tested, other versions might be vulnerable as well.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Vilar
product: VS-IPC1002
default_status: unknown
Credits: lang: en
value: Szymon Paszun
Published: 2025-10-23T13:39:46.472Z
CVE-2025-53702 DoS vulnerability in Vilar VS-IPC1002 IP cameras
Vilar VS-IPC1002 IP cameras are vulnerable to DoS (Denial-of-Service) attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive. A manual restart of the device is required. 
The vendor did not respond in any way. Only version 1.1.0.18 was tested, other versions might be vulnerable as well.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Vilar
product: VS-IPC1002
default_status: unknown
Credits: lang: en
value: Szymon Paszun
Published: 2025-10-23T13:39:44.596Z
CVE-2025-53703 DuraComm DP-10iN-100-MU Cleartext Transmission of Sensitive Information
DuraComm SPM-500 DP-10iN-100-MU

 transmits sensitive data without encryption over a channel that could be intercepted by attackers.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: DuraComm Corporation
product: SPM-500 DP-10iN-100-MU
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Brandon Vincent of Arizona Public Service reported these vulnerabilities to CISA.
Published: 2025-07-22T21:31:22.451Z
CVE-2025-53704 MAXHUB Pivot Weak Password Recovery Mechanism for Forgotten Password
The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.
Problem types: cwe_id: CWE-640
description: CWE-640
Affected products: vendor: MAXHUB
product: Pivot client application
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Malik MAKKES of Abicom Groupe OCI reported this vulnerability to MAXHUB.
Published: 2025-12-04T21:44:06.466Z
CVE-2025-53705 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Out-of-bounds Write
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Ashlar-Vellum
product: Cobalt
default_status: unaffected
vendor: Ashlar-Vellum
product: Xenon
default_status: unaffected
vendor: Ashlar-Vellum
product: Argon
default_status: unaffected
vendor: Ashlar-Vellum
product: Lithium
default_status: unaffected
vendor: Ashlar-Vellum
product: Cobalt Share
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2025-08-18T21:05:02.356Z
CVE-2025-53707 
A reflected cross-site scripting (xss) vulnerability exists in the modifyTranscript functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MedDream
product: MedDream PACS Premium
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos.
Published: 2026-01-20T14:49:44.990Z
CVE-2025-53709 Access control issues impacting secure-upload service
Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments.

Under specific circumstances, privileged users of secure-upload could have selected email templates not necessarily created for their enrollment when sending data upload requests.
Authenticated and privileged users of one enrollment could have abused an endpoint to redirect existing submission channels to a dataset they control.
An endpoint handling domain validation allowed unauthenticated users to enumerate existing enrollments.
Finally, other endpoints allowed enumerating if a resource with a known RID exists across enrollments.

The affected service has been patched with version 0.815.0 and automatically deployed to all Apollo-managed Foundry instances.
Problem types: cwe_id: CWE-285
description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Affected products: vendor: Palantir
product: com.palantir.secupload:secure-upload
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
baseSeverity: MEDIUM
baseScore: 5.4
Published: 2025-07-10T18:38:31.861Z