rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-5433 Fengoffice Feng Office index.php sql injection
A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account&a=set_timezone. The manipulation of the argument tz_offset leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Fengoffice
product: Feng Office
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: XU17 (VulDB User)
Published: 2025-06-02T06:31:04.742Z
CVE-2025-5434 Aem Solutions CMS page.php sql injection
A vulnerability was found in Aem Solutions CMS up to 1.0. It has been classified as critical. This affects an unknown part of the file /page.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Aem Solutions
product: CMS
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: XU17 (VulDB User)
Published: 2025-06-02T07:00:18.097Z
CVE-2025-5435 Marwal Infotech CMS page.php sql injection
A vulnerability was found in Marwal Infotech CMS 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /page.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Marwal Infotech
product: CMS
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: XU17 (VulDB User)
Published: 2025-06-02T07:31:04.282Z
CVE-2025-5436 Multilaser Sirius RE016 cstecgi.cgi information disclosure
A vulnerability was found in Multilaser Sirius RE016 MLT1.0. It has been rated as problematic. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-200
description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: Multilaser
product: Sirius RE016
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: DefaultCh40s (VulDB User)
Published: 2025-06-02T08:00:18.503Z
CVE-2025-5437 Multilaser Sirius RE016 Password Change cstecgi.cgi improper authentication
A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: Multilaser
product: Sirius RE016
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: DefaultCh40s (VulDB User)
Published: 2025-06-02T08:31:04.779Z
CVE-2025-5438 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 WPS command injection
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. Affected by this vulnerability is the function WPS of the file /goform/WPS. The manipulation of the argument PIN leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T09:00:19.465Z
CVE-2025-5439 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 verifyFacebookLike os command injection
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been rated as critical. Affected by this issue is the function verifyFacebookLike of the file /goform/verifyFacebookLike. The manipulation of the argument uid/accessToken leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T09:31:05.517Z
CVE-2025-5440 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 NTP os command injection
A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function NTP of the file /goform/NTP. The manipulation of the argument manual_year_select/manual_month_select/manual_day_select/manual_hour_select/manual_min_select/manual_sec_select leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T10:00:18.531Z
CVE-2025-5441 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 setDeviceURL os command injection
A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function setDeviceURL of the file /goform/setDeviceURL. The manipulation of the argument DeviceURL leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T10:31:04.552Z
CVE-2025-5442 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_pingGatewayByBBS os command injection
A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RP_pingGatewayByBBS of the file /goform/RP_pingGatewayByBBS. The manipulation of the argument ip/nm/gw leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T11:00:18.937Z
CVE-2025-5443 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 wirelessAdvancedHidden os command injection
A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function wirelessAdvancedHidden of the file /goform/wirelessAdvancedHidden. The manipulation of the argument ExtChSelector/24GSelector/5GSelector leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T11:31:04.438Z
CVE-2025-5444 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_UpgradeFWByBBS os command injection
A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified as critical. Affected by this vulnerability is the function RP_UpgradeFWByBBS of the file /goform/RP_UpgradeFWByBBS. The manipulation of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T12:00:17.752Z
CVE-2025-5445 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkFWByBBS os command injection
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified as critical. Affected by this issue is the function RP_checkFWByBBS of the file /goform/RP_checkFWByBBS. The manipulation of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T12:31:04.618Z
CVE-2025-5446 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_checkCredentialsByBBS os command injection
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been classified as critical. This affects the function RP_checkCredentialsByBBS of the file /goform/RP_checkCredentialsByBBS. The manipulation of the argument pwd leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T13:00:17.423Z
CVE-2025-5447 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 ssid1MACFilter os command injection
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter. The manipulation of the argument apselect_%d/newap_text_%d leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Linksys
product: RE6500
vendor: Linksys
product: RE6250
vendor: Linksys
product: RE6300
vendor: Linksys
product: RE6350
vendor: Linksys
product: RE7000
vendor: Linksys
product: RE9000
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: pjqwudi (VulDB User)
Published: 2025-06-02T13:31:04.197Z
CVE-2025-5449 Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
Problem types: cwe_id: CWE-190
description: Integer Overflow or Wraparound
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Ronald Crane for reporting this issue.
Published: 2025-07-25T17:19:39.345Z
CVE-2025-5450 
Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated admin with read-only rights to modify settings that should be restricted.
Problem types: cwe_id: CWE-602
description: CWE-602: Client-Side Enforcement of Server-Side Security
Affected products: vendor: Ivanti
product: Connect Secure
default_status: affected
vendor: Ivanti
product: Policy Secure
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-07-08T15:00:02.314Z
CVE-2025-5451 
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to trigger a denial of service.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Ivanti
product: Connect Secure
default_status: affected
vendor: Ivanti
product: Policy Secure
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-08T15:02:00.522Z
CVE-2025-5452 
A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP application. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Problem types: cwe_id: CWE-214
description: CWE-214: Invocation of Process Using Visible Sensitive Information
Affected products: vendor: Axis Communications AB
product: AXIS OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Keanesec
Published: 2025-11-11T07:00:46.077Z
CVE-2025-5454 
An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal: '.../...//'
Affected products: vendor: Axis Communications AB
product: AXIS OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: 51l3nc3
Published: 2025-11-11T06:50:19.130Z
CVE-2025-5455 Possible denial of service when passing malformed data in a URL to qDecodeDataUrl
An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.

If the function was called with malformed data, for example, an URL that
contained a "charset" parameter that lacked a value (such as
"data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service
(abort).

This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: The Qt Company
product: Qt
default_status: unaffected
Published: 2025-06-02T08:46:20.524Z
CVE-2025-5456 
A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. CWE-125
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Ivanti
product: Connect Secure
default_status: affected
vendor: Ivanti
product: Policy Secure
default_status: affected
vendor: Ivanti
product: ZTA Gateway
default_status: affected
vendor: Ivanti
product: Neurons for Secure
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-08-12T14:50:46.329Z
CVE-2025-5459 OS Command Injection
A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Perforce
product: Puppet Enterprise
default_status: unaffected
Credits: lang: en
value: TIM Security Red Team Research - https://www.gruppotim.it/it/footer/red-team.html
lang: en
value: Marco Ventura
lang: en
value: Claudia Bartolini
lang: en
value: Andrea Carlo Maria Dattola
lang: en
value: Stefano Carbè
lang: en
value: Massimiliano Brolli
Published: 2025-06-26T06:30:56.546Z