rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-59601 Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware
Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.
Problem types: cwe_id: CWE-1230
description: CWE-1230: Exposure of Sensitive Information Through Metadata
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-06-01T22:05:23.166Z
CVE-2025-59603 Out-of-bounds Write in Computer Vision
Memory Corruption when processing invalid user address with nonstandard buffer address.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-03-02T16:53:58.195Z
CVE-2025-59604 NULL Pointer Dereference in SPS Applications
Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-06-01T22:05:24.558Z
CVE-2025-59605 Out-of-bounds Write in HLOS
Memory Corruption when processing device identifier strings that exceed the expected maximum length.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-06-01T22:05:25.625Z
CVE-2025-59606 NULL Pointer Dereference in HLOS
Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-06-01T22:05:26.836Z
CVE-2025-59609 Buffer Over-read in WLAN Host Communication
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2026-06-01T22:05:27.944Z
CVE-2025-59610 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-06-01T22:05:29.149Z
CVE-2025-59611 Out-of-bounds Write in Core Services
Memory corruption in diagnostic services due to absence of input validation
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-06-01T22:05:30.351Z
CVE-2025-59612 Stack-based Buffer Overflow in Windows Compute
Memory corruption in windows drivers while sending incorrect trusted application request
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-06-01T22:05:31.596Z
CVE-2025-59613 Stack-based Buffer Overflow in Windows Compute
Memory Corruption when output buffer size is smaller than input buffer size during data copying operation.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-06-01T22:05:32.679Z
CVE-2025-59614 Out-of-bounds Write in Windows Compute
Memory Corruption when sending random number generator command with insufficient output buffer size.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-06-01T22:05:33.823Z
CVE-2025-59668 
Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability. When processing a crafted certain UDP packet, the affected device may abnormally terminate.
Problem types: cwe_id: CWE-476
description: NULL pointer dereference
Affected products: vendor: NIHON KOHDEN CORPORATION
product: Central Monitor CNS-6201
Published: 2025-09-30T04:06:11.279Z
CVE-2025-59669 
A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker with shell access to the device to connect to redis service and access its data
Problem types: cwe_id: CWE-798
description: Improper access control
Affected products: vendor: Fortinet
product: FortiWeb
cpes: cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R
Published: 2025-11-18T17:01:19.617Z
CVE-2025-59681 
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: djangoproject
product: Django
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 7.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Published: 2025-10-01T00:00:00.000Z
CVE-2025-59682 
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: djangoproject
product: Django
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 3.1
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Published: 2025-10-01T00:00:00.000Z
CVE-2025-59683 
Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Pexip
product: Infinity
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Published: 2025-12-25T00:00:00.000Z
CVE-2025-59684 
DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-01T00:00:00.000Z
CVE-2025-59685 
Kazaar 1.25.12 allows a JWT with none in the alg field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-01T00:00:00.000Z
CVE-2025-59686 
Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-01T00:00:00.000Z
CVE-2025-59687 
IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arbitrary organization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-01T00:00:00.000Z
CVE-2025-59689 
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Libraesva
product: Email Security Gateway
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: 2025-09-19T00:00:00.000Z
CVE-2025-59691 
PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or system resume. In the CLI client, the VPN auto-reconnects and claims to be connected, but IPv6 traffic is no longer routed or blocked. In the GUI client, the IPv6 connection remains functional after disconnection until the user clicks Reconnect. In both cases, the real IPv6 address is exposed to external services, violating user privacy and defeating the advertised IPv6 leak protection. This affects CLI 2.0.1 and GUI 2.10.0.
Problem types: cwe_id: CWE-669
description: CWE-669 Incorrect Resource Transfer Between Spheres
Affected products: vendor: PureVPN
product: PureVPN
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 3.7
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2025-09-18T00:00:00.000Z
CVE-2025-59692 
PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT policies when connecting to a VPN server. This removes firewall rules that may have been configured manually or by other software (e.g., UFW, container engines, or system security policies). Upon VPN disconnect, the original firewall state is not restored. As a result, the system may become unintentionally exposed to network traffic that was previously blocked. This affects CLI 2.0.1 and GUI 2.10.0.
Problem types: cwe_id: CWE-669
description: CWE-669 Incorrect Resource Transfer Between Spheres
Affected products: vendor: PureVPN
product: PureVPN
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 3.7
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: 2025-09-18T00:00:00.000Z
CVE-2025-59693 
The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to obtain debug access and escalate privileges by bypassing the tamper label and opening the chassis without leaving evidence, and accessing the JTAG connector. This is called F02.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59694 
The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to persistently modify firmware and influence the (insecurely configured) appliance boot process. To exploit this, the attacker must modify the firmware via JTAG or perform an upgrade to the chassis management board firmware. This is called F03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59695 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a user with OS root access to alter firmware on the Chassis Management Board (without Authentication). This is called F04.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59696 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to modify or erase tamper events via the Chassis management board.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59697 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by editing the Legacy GRUB bootloader configuration to start a root shell upon boot of the host OS. This is called F06.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59698 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, might allow a physically proximate attacker to gain access to the EOL legacy bootloader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59699 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs because of insecure default settings in the Legacy GRUB Bootloader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59700 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with root access to modify the Recovery Partition (because of a lack of integrity protection).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59701 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker (with elevated privileges) to read and modify the Appliance SSD contents (because they are unencrypted).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59702 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker with elevated privileges to falsify tamper events by accessing internal components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59703 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to access the internal components of the appliance, without leaving tamper evidence. To exploit this, the attacker needs to remove the tamper label and all fixing screws from the device without damaging it. This is called an F14 attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59704 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an attacker to gain access the the BIOS menu because is has no password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59705 
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a Physically Proximate Attacker to Escalate Privileges by enabling the USB interface through chassis probe insertion during system boot, aka "Unauthorized Reactivation of the USB interface" or F01.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-02T00:00:00.000Z
CVE-2025-59706 
In N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-25T00:00:00.000Z
CVE-2025-59707 
In N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-25T00:00:00.000Z
CVE-2025-59709 
An issue was discovered in Biztalk360 through 11.5. because of mishandling of user-provided input in a path to be read by the server, a Super User attacker is able to read files on the system and/or coerce an authentication from the service, aka Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-03T00:00:00.000Z
CVE-2025-59710 
An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. During the loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-03T00:00:00.000Z
CVE-2025-59711 
An issue was discovered in Biztalk360 before 11.5. Because of mishandling of user-provided input in an upload mechanism, an authenticated attacker is able to write files outside of the destination directory and/or coerce an authentication from the service, aka Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-03T00:00:00.000Z
CVE-2025-59712 
Snipe-IT before 8.1.18 allows XSS.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: snipeitapp
product: Snipe-IT
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-09-19T00:00:00.000Z
CVE-2025-59713 
Snipe-IT before 8.1.18 allows unsafe deserialization.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: snipeitapp
product: Snipe-IT
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Published: 2025-09-19T00:00:00.000Z
CVE-2025-59714 
In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Internet2
product: Grouper
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Published: 2025-09-19T00:00:00.000Z
CVE-2025-59715 
SMSEagle before 6.11 allows reflected XSS via a username or contact phone number.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: SMSEagle
product: SMSEagle
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Published: 2025-09-19T00:00:00.000Z