rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-48015 Observable Response Discrepancy
Failed login response could be different depending on whether the username was local or central.
Problem types: cwe_id: CWE-204
description: CWE-204 Observable Response Discrepancy
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5056 Software-Defined Network Flow Controller
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-05-20T15:11:53.851Z
CVE-2025-48016 Improper Control of Interaction Frequency
OpenFlow discovery protocol can exhaust resources because it is not rate limited
Problem types: cwe_id: CWE-799
description: CWE-799 Improper Control of Interaction Frequency
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5056 Software-Defined Network Flow Controller
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-5056 Software-Defined Network Flow Controller
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-05-20T15:12:20.861Z
CVE-2025-48017 Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5056 Software-Defined Network Flow Controller
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-05-20T15:14:02.728Z
CVE-2025-48018 Deserialization of Untrusted Data
An authenticated user can modify application state data.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5030 acSELerator QuickSet Software
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-05-20T15:14:36.200Z
CVE-2025-48019 
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: Yokogawa Electric Corporation
product: Vnet/IP Interface Package
default_status: unknown
Published: 2026-02-13T04:51:46.316Z
CVE-2025-48020 
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: Yokogawa Electric Corporation
product: Vnet/IP Interface Package
default_status: unknown
Published: 2026-02-13T04:54:09.449Z
CVE-2025-48021 
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
Problem types: cwe_id: CWE-191
description: CWE-191 Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Yokogawa Electric Corporation
product: Vnet/IP Interface Package
default_status: unknown
Published: 2026-02-13T04:56:15.651Z
CVE-2025-48022 
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
Problem types: cwe_id: CWE-130
description: CWE-130
Affected products: vendor: Yokogawa Electric Corporation
product: Vnet/IP Interface Package
default_status: unknown
Published: 2026-02-13T04:58:12.391Z
CVE-2025-48023 
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: Yokogawa Electric Corporation
product: Vnet/IP Interface Package
default_status: unknown
Published: 2026-02-13T05:00:05.985Z
CVE-2025-48024 
In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: BlueWave
product: Checkmate
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Published: 2025-05-15T00:00:00.000Z
CVE-2025-48025 
In Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1280, 1330, 1380, 1480, 1580, W920, W930, and W1000, there is an improper access control vulnerability related to a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-20T00:00:00.000Z
CVE-2025-48026 
A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow an attacker to read files from the underlying OS and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-23T00:00:00.000Z
CVE-2025-48027 
The HttpAuth plugin in pGina.Fork through 3.9.9.12 allows authentication bypass when an adversary controls DNS resolution for pginaloginserver.
Problem types: cwe_id: CWE-290
description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: MutonUfoAI
product: pGina.Fork
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: 2025-05-15T00:00:00.000Z
CVE-2025-48038 Unverified File Handles can Cause Excessive Use of System Resources
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
Credits: lang: en
value: Jakub Witczak
lang: en
value: Ingela Anderton Andin
Published: 2025-09-11T08:13:04.030Z
CVE-2025-48039 Unverified Paths can Cause Excessive Use of System Resources
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
Credits: lang: en
value: Jakub Witczak
lang: en
value: Ingela Anderton Andin
Published: 2025-09-11T08:13:36.878Z
CVE-2025-48040 Malicious Key Exchange Messages may Lead to Excessive Resource Consumption
Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
Credits: lang: en
value: Jakub Witczak
lang: en
value: Ingela Anderton Andin
Published: 2025-09-11T08:14:19.671Z
CVE-2025-48041 SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
Credits: lang: en
value: Jakub Witczak
lang: en
value: Ingela Anderton Andin
Published: 2025-09-11T08:14:20.508Z
CVE-2025-48042 Before action hooks may execute in certain scenarios despite a request being forbidden
Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This vulnerability is associated with program files lib/ash/actions/create/bulk.ex, lib/ash/actions/destroy/bulk.ex, lib/ash/actions/update/bulk.ex and program routines 'Elixir.Ash.Actions.Create.Bulk':run/5, 'Elixir.Ash.Actions.Destroy.Bulk':run/6, 'Elixir.Ash.Actions.Update.Bulk:run'/6.

This issue affects ash: from pkg:hex/ash before pkg:hex/ash@3.5.39, before 3.5.39, before 5d1b6a5d00771fd468a509778637527b5218be9a.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: ash-project
product: ash
cpes: cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: ash-project
product: ash
cpes: cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Zach Daniel
lang: en
value: Jonatan Männchen / EEF
Published: 2025-09-07T16:01:01.470Z
CVE-2025-48043 Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization
Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/authorizer/authorizer.ex and program routines 'Elixir.Ash.Policy.Authorizer':strict_filters/2.

This issue affects ash: from pkg:hex/ash@0 before pkg:hex/ash@3.6.2, before 3.6.2, before 66d81300065b970da0d2f4528354835d2418c7ae.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: ash-project
product: ash
cpes: cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: ash-project
product: ash
cpes: cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Zach Daniel
lang: en
value: Jonatan Männchen / EEF
lang: en
value: Jonatan Männchen / EEF
Published: 2025-10-10T15:57:29.225Z
CVE-2025-48044 Authorization bypass when bypass policy condition evaluates to true
Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/policy.ex and program routines 'Elixir.Ash.Policy.Policy':expression/2.

This issue affects ash: from pkg:hex/ash@3.6.3 before pkg:hex/ash@3.7.1, from 3.6.3 before 3.7.1, from 79749c2685ea031ebb2de8cf60cc5edced6a8dd0 before 8b83efa225f657bfc3656ad8ee8485f9b2de923d.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: ash-project
product: ash
cpes: cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: ash-project
product: ash
cpes: cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Jechol Lee
lang: en
value: Jechol Lee
lang: en
value: Jonatan Männchen / EEF
lang: en
value: Zach Daniel
Published: 2025-10-17T13:52:53.644Z
CVE-2025-48045 MICI Network Co. Ltd. NetFax Server Default Administrator Credentials Disclosure
An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: MICI Network Co. Ltd.
product: NetFax Server
default_status: unknown
Credits: lang: en
value: Anna Quinn, Security Consultant at Rapid7
Published: 2025-05-29T12:29:33.475Z
CVE-2025-48046 MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext
An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint.
Problem types: cwe_id: CWE-256
description: CWE-256: Plaintext Storage of a Password
Affected products: vendor: MICI Network Co. Ltd.
product: NetFax Server
default_status: unknown
Credits: lang: en
value: Anna Quinn, Security Consultant at Rapid7
Published: 2025-05-29T12:33:27.734Z
CVE-2025-48047 MICI Network Co. Ltd. NetFax Server Command Injection
An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via the /test.php endpoint.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: MICI Network Co. Ltd.
product: NetFax Server
default_status: unknown
Credits: lang: en
value: Anna Quinn, Security Consultant at Rapid7
Published: 2025-05-29T12:36:13.667Z
CVE-2025-48050 
In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."
Problem types: cwe_id: CWE-24
description: CWE-24 Path Traversal: '../filedir'
Affected products: vendor: Cure53
product: DOMPurify
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Published: 2025-05-15T00:00:00.000Z
CVE-2025-48051 
powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Lichess
product: Lila
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: 2025-05-15T00:00:00.000Z
CVE-2025-48053 Discourse vulnerable to DoS via large URL payload in PM to a bot
Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, sending a malicious URL in a PM to a bot user can cause a reduced the availability of a Discourse instance. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. No known workarounds are available.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: discourse
product: discourse
Published: 2025-06-09T12:30:33.626Z
CVE-2025-48054 Radashi Vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attacker can control parts of the path argument to the set function, they could potentially modify the prototype of all objects in the JavaScript runtime, leading to unexpected behavior, denial of service, or even remote code execution in some specific scenarios. This issue has been patched in version 12.5.1. A workaround for this issue involves sanitizing the path argument provided to the set function to ensure that no part of the path string is __proto__, prototype, or constructor.
Problem types: cwe_id: CWE-1321
description: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected products: vendor: radashi-org
product: radashi
Published: 2025-05-27T04:04:13.029Z
CVE-2025-48055 Combodo iTop has stored XSS in user portal's browse brick
Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Combodo
product: iTop
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Published: 2025-11-10T20:33:48.310Z
CVE-2025-48056 Hubble CLI vulnerable to character injection
Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inject malicious control characters into Hubble CLI terminal output, potentially leading to loss of integrity and manipulation of the output. This could be leveraged to conceal log entries, rewrite output, or even make the terminal temporarily unusable. Exploitation of this attack would require the victim to be monitoring Kafka traffic using Layer 7 Protocol Visibility at the time of the attack. The issue is patched in Hubble CLI v1.17.2. Hubble CLI users who are unable to upgrade can direct their Hubble flows to a log file and inspect the output within a text editor.
Problem types: cwe_id: CWE-74
description: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: cilium
product: hubble
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-05-20T19:55:58.193Z
CVE-2025-48057 Icinga 2 certificate renewal might incorrectly renew an invalid certificate
Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate() function can be tricked into incorrectly treating certificates as valid. This allows an attacker to send a malicious certificate request that is then treated as a renewal of an already existing certificate, resulting in the attacker obtaining a valid certificate that can be used to impersonate trusted nodes. This only occurs when Icinga 2 is built with OpenSSL older than version 1.1.0. This issue has been patched in versions 2.12.12, 2.13.12, and 2.14.6.
Problem types: cwe_id: CWE-296
description: CWE-296: Improper Following of a Certificate's Chain of Trust
Affected products: vendor: Icinga
product: icinga2
Published: 2025-05-27T16:32:29.931Z
CVE-2025-48058 PowSyBl Core contains Polynomial REDoS’es
PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl's DataSource mechanism. If successfully exploited, a malicious actor can cause significant CPU consumption due to regex backtracking — even with polynomial patterns. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
Problem types: cwe_id: CWE-1333
description: CWE-1333: Inefficient Regular Expression Complexity
Affected products: vendor: powsybl
product: powsybl-core
Published: 2025-06-20T00:39:06.725Z
CVE-2025-48059 PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion
PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-contingency-api versions 5.0.0 to before 6.3.0, there is a a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the RegexCriterion class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).matcher(id).find(). If successfully exploited, a malicious actor can cause significant CPU exhaustion through repeated or recursive filter(...) calls — especially if performed over large network models or filtering operations. This issue has been patched in com.powsybl:powsybl-iidm-criteria 6.7.2.
Problem types: cwe_id: CWE-1333
description: CWE-1333: Inefficient Regular Expression Complexity
Affected products: vendor: powsybl
product: powsybl-core
Published: 2025-06-20T16:50:35.974Z