rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-55068 Dover Fueling Solutions ProGauge MagLink LX4 Devices Integer Overflow or Wraparound
Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point.
 An attacker can manually change the system time to exploit this 
limitation, potentially causing errors in authentication and leading to a
 denial-of-service condition.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: Dover Fueling Solutions
product: ProGauge MagLink LX 4
default_status: unaffected
vendor: Dover Fueling Solutions
product: ProGauge MagLink LX Plus
default_status: unaffected
vendor: Dover Fueling Solutions
product: ProGauge MagLink LX Ultimate
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Pedro Umbelino of Bitsight TRACE reported these vulnerabilities to CISA.
Published: 2025-09-18T20:42:29.547Z
CVE-2025-55069 AutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number Generator
A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software implements a predictable seed for its pseudo-random number generator, which compromises the security of the generated private keys.
Problem types: cwe_id: CWE-337
description: CWE-337 Predictable Seed in Pseudo-Random Number Generator
Affected products: vendor: AutomationDirect
product: CLICK PLUS C0-0x CPU firmware
default_status: unaffected
vendor: AutomationDirect
product: CLICK PLUS C0-1x CPU firmware
default_status: unaffected
vendor: AutomationDirect
product: CLICK PLUS C2-x CPU firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Luca Borzacchiello and Diego Zaffaroni of Nozomi Networks reported these vulnerabilities to Automation Direct.
Published: 2025-09-23T22:15:46.833Z
CVE-2025-55070 Lack of MFA enforcement in WebSocket connections
Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseSeverity: MEDIUM
baseScore: 6.5
Credits: lang: en
value: Agniva De Sarker
Published: 2025-11-14T08:02:24.764Z
CVE-2025-55071 
A reflected cross-site scripting (xss) vulnerability exists in the modifyAnonymize functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MedDream
product: MedDream PACS Premium
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos.
Published: 2026-01-20T14:50:00.120Z
CVE-2025-55072 
Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: NEOJAPAN Inc.
product: desknet's NEO
Published: 2025-10-16T10:03:29.945Z
CVE-2025-55073 MS Teams plugin OAuth allows editing arbitrary posts
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
baseSeverity: MEDIUM
baseScore: 5.4
Credits: lang: en
value: Juho Forsén
Published: 2025-11-14T08:03:16.922Z
CVE-2025-55074 Channel member objects leak read status
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects
Problem types: cwe_id: CWE-1426
description: CWE-1426: Improper Validation of Generative AI Output
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
baseSeverity: LOW
baseScore: 3
Credits: lang: en
value: Juho Forsén
Published: 2025-11-18T15:23:29.642Z
CVE-2025-55075 
Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker.
Problem types: cwe_id: CWE-912
description: Hidden functionality
Affected products: vendor: I-O DATA DEVICE, INC.
product: WN-7D36QR
vendor: I-O DATA DEVICE, INC.
product: WN-7D36QR/UE
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.9
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Published: 2025-09-17T03:08:37.275Z
CVE-2025-55076 
A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The service accepts unauthenticated XPC connections and executes input via system(), which may allow a local user to execute arbitrary commands with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-03T00:00:00.000Z
CVE-2025-55077 Tyler Technologies ERP Pro 9 SaaS application escape
Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Tyler Technologies
product: ERP Pro 9 SaaS
default_status: unknown
CVSS v3.1: scope: CHANGED
version: 3.1
baseScore: 7.4
attackVector: NETWORK
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
integrityImpact: LOW
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: LOW
confidentialityImpact: LOW
Credits: lang: en
value: Shawn Plowman, Brookings County
Published: 2025-08-07T18:37:33.309Z
CVE-2025-55078 Incomplete validation of kernel object pointers in system calls
In Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service (crash) by providing a pointer to a reserved or unmapped memory region. Vulnerable system calls had a check of pointers, but that check wasn't verifying whether the pointer is outside the module memory region.
Problem types: cwe_id: CWE-233
description: CWE-233 Improper Handling of Parameters
Affected products: vendor: Eclipse Foundation
product: ThreadX
default_status: unaffected
Credits: lang: en
value: x-codingman (Saxon Mark)
Published: 2025-10-14T07:28:56.148Z
CVE-2025-55079 Missing check for thread priority
In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority. In some cases the check of that maximum priority wasn't performed, allowing, as a result, to obtain a thread with higher priority than expected and causing a possible denial of service.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Eclipse Foundation
product: ThreadX
default_status: unaffected
Credits: lang: en
value: amgross
Published: 2025-10-15T04:29:00.882Z
CVE-2025-55080 Improper Parameter Check in ThreadX Syscall Implementation
In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write.
Problem types: cwe_id: CWE-233
description: CWE-233 Improper Handling of Parameters
Affected products: vendor: Eclipse Foundation
product: ThreadX
default_status: unaffected
Credits: lang: en
value: x-codingman (Saxon Mark)
Published: 2025-10-15T05:41:50.536Z
CVE-2025-55081 Potential out of bound read in _nx_secure_tls_process_clienthello()
In Eclipse Foundation NextX Duo before 6.4.4, a module of ThreadX, the _nx_secure_tls_process_clienthello() function was missing length verification of 
certain SSL/TLS client hello message: the ciphersuite length and 
compression method length. In case of an attacker-crafted message with 
values outside of the expected range, it could cause an out-of-bound 
read.
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: Ilja van Sprundel
lang: en
value: Justin-Stauffer
Published: 2025-10-15T10:46:05.076Z
CVE-2025-55082 Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()
In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was a potential out of bound read in _nx_secure_tls_process_clienthello() because of a missing validation of PSK length provided in the user message.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: Justin Stauffer
lang: en
value: Ilya van Sprundel
Published: 2025-10-15T11:03:31.806Z
CVE-2025-55083 Broken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()
In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check resulting it out by two out of bound read.
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: Justin Stauffer
lang: en
value: Ilya van Sprundel
Published: 2025-10-15T14:11:23.044Z
CVE-2025-55084 Out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()
In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field.
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: Justin Stauffer
lang: en
value: Ilya van Sprundel
Published: 2025-10-16T06:29:35.631Z
CVE-2025-55085 Web http client: Unchecked Server-Side Malicious Packet Issue
In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsing of HTTP header fields was missing bounds verification. A crafted server response could cause undefined behavior.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
cwe_id: CWE-1286
description: CWE-1286
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: ekleezg
Published: 2025-10-17T14:22:28.880Z
CVE-2025-55086 
In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the server reply. With a crafted packet, an attacker could cause an out of memory read.
Problem types: cwe_id: CWE-1285
description: CWE-1285
cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Eclipse Foundation
product: NextX Duo
default_status: unaffected
Credits: lang: en
value: ekleezg
Published: 2025-10-20T17:49:29.647Z
CVE-2025-55087 
In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a crafted SNMPv3 security parameters.
Problem types: cwe_id: CWE-1285
description: CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Eclipse Foundation
product: NextX Duo
default_status: unaffected
Credits: lang: en
value: ekleezg
Published: 2025-10-17T06:03:14.098Z
CVE-2025-55089 Eclipse ThreadX FileX RAM disk driver buffer overflow
In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in the FileX RAM disk driver. It could cause a remote execurtion after receiving a crafted sequence of packets
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Eclipse Foundation
product: FileX
default_status: unaffected
Credits: lang: en
value: Kelly Patterson
Published: 2025-10-16T06:33:40.809Z
CVE-2025-55090 Potential out of bound read issue in _nx_ipv4_packet_receive()  in NetX Duo
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() function when received an Ethernet frame with less than 4 bytes of IP packet.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
cwe_id: CWE-126
description: CWE-126
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: Justin Stauffer
lang: en
value: Ilja van Sprundel
Published: 2025-10-16T06:43:17.480Z
CVE-2025-55091 Potential out of bound read in _nx_ip_packet_receive()
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ip_packet_receive() function when received an Ethernet with type set as IP but no IP data.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
cwe_id: CWE-126
description: CWE-126
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: Justin Stauffer
lang: en
value: Ilja van Sprundel
Published: 2025-10-16T07:56:33.908Z
CVE-2025-55092 Potential out of bound read in _nx_ipv4_option_process()
In Eclipse Foundation NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_option_process() when processing an IPv4 packet with the timestamp option.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
cwe_id: CWE-126
description: CWE-126
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: Justin Stauffer
lang: en
value: Ilja van Sprundel
Published: 2025-10-17T05:09:16.494Z
CVE-2025-55093 Out of bound read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messages
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() when handling unicast DHCP messages that could cause corruption of 4 bytes of memory.
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: Justin Stauffer
lang: en
value: Ilja van Sprundel
Published: 2025-10-17T05:11:43.761Z
CVE-2025-55094 Potential out-of-bounds read in _nx_icmpv6_validate_options()
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in  _nx_icmpv6_validate_options() when handling a packet with ICMP6 options.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Credits: lang: en
value: Justin Stauffer
lang: en
value: Ilja van Sprundel
Published: 2025-10-17T05:29:00.960Z
CVE-2025-55095 
The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition.

This recursion occurs in _ux_host_class_storage_partition_read(), which parses up to four partition entries. If an extended partition is found (with type UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED or EXTENDED_LBA_MAPPED), the code invokes:
            _ux_host_class_storage_media_mount(storage, sector + _ux_utility_long_get(...));


There is no limit on the recursion depth or tracking of visited sectors. As a result, a malicious or malformed disk image can include cyclic or excessively deep chains of extended partitions, causing the function to recurse until stack overflow occurs.
Problem types: cwe_id: CWE-121
description: CWE-121  Stack-based Buffer Overflow
cwe_id: CWE-674
description: CWE-674 Uncontrolled Recursion
Affected products: vendor: Eclipse Foundation
product: Eclipse ThreadX - USBX
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2026-01-27T15:34:47.755Z
CVE-2025-55096 Inadequate bounds check and potential underflow in _ux_host_class_hid_report_descriptor_get()
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_hid_report_descriptor_get()
 when parsing a descriptor of an USB HID device.
Problem types: cwe_id: CWE-191
description: CWE-191 Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Eclipse Foundation
product: NetX Duo
default_status: unaffected
Published: 2025-10-17T05:32:45.567Z
CVE-2025-55097 Potential out-of-bounds read in _ux_host_class_audio_streaming_sampling_get()
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_streaming_sampling_get() when parsing a descriptor of an USB streaming device.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Eclipse Foundation
product: USBX
default_status: unaffected
Published: 2025-10-17T05:35:02.744Z
CVE-2025-55098 Potential out-of-bounds read in _ux_host_class_audio_device_type_get()
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_device_type_get()
      when parsing a descriptor of an USB audio device.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Eclipse Foundation
product: USBX
default_status: unaffected
Published: 2025-10-17T05:36:59.542Z
CVE-2025-55099 Potential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Eclipse Foundation
product: USBX
default_status: unaffected
Published: 2025-10-17T05:38:30.900Z
CVE-2025-55100 Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio10_sam_parse_func() when parsing a list of sampling frequencies.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Eclipse Foundation
product: USBX
default_status: unaffected
Published: 2025-10-17T05:40:10.333Z
CVE-2025-55102 
A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet Too Big" with more than 15 different source address can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
cwe_id: CWE-404
description: CWE-404 Improper Resource Shutdown or Release
cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Eclipse Foundation
product: Eclipse ThreadX - NetX Duo
default_status: unaffected
Credits: lang: en
value: Haja Mohideen M
Published: 2026-01-27T15:25:36.203Z
CVE-2025-55103 BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Esri
product: Portal for ArcGIS Enterprise Sites
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Lucas Machado
Published: 2025-08-21T19:25:13.460Z