rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-46737 Origin Validation Error
SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This gateway service includes an API which is not properly configured to reject requests from unexpected sources.
Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5037 Grid Configurator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Published: 2025-05-12T16:06:23.559Z
CVE-2025-46738 Deserialization of Untrusted Data
An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code.
Problem types: cwe_id: CWE-502
description: CWE-502
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-5033 acSELerator RTAC Software
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
version: 3.1
Published: 2025-05-12T16:07:02.820Z
CVE-2025-46739 Improper Restriction of Excessive Authentication Attempts
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-05-12T16:08:38.763Z
CVE-2025-46740 Improper Handling of Insufficient Permissions
An authenticated user without user administrative permissions could  change the administrator Account Name.
Problem types: cwe_id: CWE-280
description: CWE-280
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-05-12T16:09:22.036Z
CVE-2025-46741 Improper Privilege Management
A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-05-12T16:09:53.581Z
CVE-2025-46742 Improper Access Control
Users who were required to change their password could still access system information before changing their password
Problem types: cwe_id: CWE-521
description: CWE-521 Weak Password Requirements
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-05-12T16:10:09.527Z
CVE-2025-46743 Cross-Site Request Forgery
An authenticated user's token could be used by another source after the user had logged out prior to the token expiring.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
version: 3.1
Published: 2025-05-12T16:14:05.722Z
CVE-2025-46744 Improper Privilege Management
An authenticated administrator could modify the Created By username for a user account
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-05-12T16:10:29.888Z
CVE-2025-46745 Improper Privilege Management
An authenticated user without user-management permissions could view other users account information.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-05-12T16:11:08.840Z
CVE-2025-46746 Error Message Contains Sensitive Information
An administrator could discover another account's credentials.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Published: 2025-05-12T16:11:33.768Z
CVE-2025-46747 Exposure of Sensitive System Information
An authenticated user without user-management permissions could identify other user accounts.
Problem types: cwe_id: CWE-497
description: CWE-497
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-05-12T16:11:52.359Z
CVE-2025-46748 Unverified Password Change
An authenticated user attempting to change their password could do so without using the current password.
Problem types: cwe_id: CWE-620
description: CWE-620
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-05-12T16:12:07.018Z
CVE-2025-46749 Improper Neutralization of Input
An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL Blueframe OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-05-12T16:12:25.269Z
CVE-2025-46750 Authentication Bypass
SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected  BIOS settings by importing a BIOS settings file with no password set.
Problem types: cwe_id: CWE-305
description: CWE-305
Affected products: vendor: Schweitzer Engineering Laboratories
product: SEL-3350-1
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3355-2
default_status: unaffected
vendor: Schweitzer Engineering Laboratories
product: SEL-3360-2
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2025-05-12T16:13:03.083Z
CVE-2025-46752 
A insertion of sensitive information into log file in Fortinet FortiDLP 12.0.0 through 12.0.5, 11.5.1, 11.4.6, 11.4.5 allows attacker to information disclosure via re-using the enrollment code.
Problem types: cwe_id: CWE-532
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiDLP
cpes: cpe:2.3:a:fortinet:fortidlp:12.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortidlp:12.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortidlp:12.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortidlp:12.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortidlp:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortidlp:11.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortidlp:11.4.5:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C
Published: 2025-10-16T14:00:30.930Z
CVE-2025-46762 Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code.

While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed.

The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted)

Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: Apache Software Foundation
product: Apache Parquet Java
default_status: unaffected
Credits: lang: en
value: Andrew Pikler
lang: en
value: David Handermann
lang: en
value: Nándor Kollár
Published: 2025-05-06T09:08:13.996Z
CVE-2025-46774 
An Improper Verification of Cryptographic Signature vulnerability [CWE-347] in FortiClient MacOS installer version 7.4.2 and below, version 7.2.9 and below, 7.0 all versions may allow a local user to escalate their privileges via FortiClient related executables.
Problem types: cwe_id: CWE-347
description: Escalation of privilege
Affected products: vendor: Fortinet
product: FortiClientMac
cpes: cpe:2.3:a:fortinet:forticlientmac:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.14:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.13:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientmac:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
Published: 2025-10-14T15:23:47.725Z
CVE-2025-46775 
A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to obtain administrator credentials via debug log commands.
Problem types: cwe_id: CWE-1295
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiExtender
cpes: cpe:2.3:a:fortinet:fortiextender:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C
Published: 2025-11-18T17:01:17.364Z
CVE-2025-46776 
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to execute arbitrary code or commands via crafted CLI commands.
Problem types: cwe_id: CWE-120
description: Escalation of privilege
Affected products: vendor: Fortinet
product: FortiExtender
cpes: cpe:2.3:a:fortinet:fortiextender:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiextender:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
Published: 2025-11-18T17:01:17.437Z
CVE-2025-46777 
A insertion of sensitive information into log file in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.9 may allow an authenticated attacker with at least read-only admin permissions to view encrypted secrets via the FortiPortal System Log.
Problem types: cwe_id: CWE-532
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiPortal
cpes: cpe:2.3:a:fortinet:fortiportal:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiportal:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.2
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C
Published: 2025-05-28T07:56:03.616Z
CVE-2025-46783 
Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If this vulnerability is exploited, arbitrary code may be executed on the PC where the product is running by tampering with specific files used on the product.
Problem types: cwe_id: CWE-22
description: Improper limitation of a pathname to a restricted directory ('Path Traversal')
Affected products: vendor: Ricoh Company, Ltd.
product: RICOH Streamline NX V3 PC Client
Published: 2025-06-13T08:18:58.850Z
CVE-2025-46784 
A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr&#39;ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
Problem types: cwe_id: CWE-401
description: CWE-401: Improper Release of Memory Before Removing Last Reference
Affected products: vendor: Entr'ouvert
product: Lasso
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Keane O&#39;Kelley of and another member of Cisco Advanced Security Initiative Group
Published: 2025-11-05T14:56:57.782Z
CVE-2025-46785 Zoom Workplace Apps for Windows - Buffer Over-read
Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Zoom Communications, Inc
product: Zoom Workplace Apps
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-05-14T17:41:06.374Z
CVE-2025-46786 Zoom Workplace Apps  - Cross-site Scripting
Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Zoom Communications, Inc
product: Zoom Workplace Apps
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-05-14T17:42:30.374Z
CVE-2025-46788 Zoom Workplace for Linux - Improper Certificate Validation
Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via network access.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Zoom Communications Inc.
product: Zoom Workplace for Linux
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-07-10T15:48:04.711Z