rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-52574 SysmonElixir path traversal in /read endpoint allows arbitrary file read
SysmonElixir is a system monitor HTTP service in Elixir. Prior to version 1.0.1, the /read endpoint reads any file from the server's /etc/passwd by default. In v1.0.1, a whitelist was added that limits reading to only files under priv/data. This issue has been patched in version 1.0.1.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: bocaletto-luca
product: elixir-system-monitor
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-06-24T02:52:11.889Z
CVE-2025-52575 EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements
EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory information depending on the LDAP server configuration. This was fixed in version 9.1.7.
Problem types: cwe_id: CWE-90
description: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Affected products: vendor: espocrm
product: espocrm
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2025-07-21T17:48:11.466Z
CVE-2025-52576 Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker can determine valid usernames and circumvent rate-limiting or blocking mechanisms. Any organization running a publicly accessible Kanboard instance is affected, especially if relying on IP-based protections like Fail2Ban or CAPTCHA for login rate-limiting. Attackers with access to the login page can exploit this flaw to enumerate valid usernames and bypass IP-based blocking mechanisms, putting all user accounts at higher risk of brute-force or credential stuffing attacks. Version 1.2.46 contains a patch for the issue.
Problem types: cwe_id: CWE-203
description: CWE-203: Observable Discrepancy
Affected products: vendor: kanboard
product: kanboard
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-06-25T16:46:01.954Z
CVE-2025-52577 Advantech iView SQL Injection
A vulnerability exists in Advantech iView that could allow SQL injection
 and remote code execution through NetworkServlet.archiveTrapRange(). 
This issue requires an authenticated attacker with at least user-level 
privileges. Certain input parameters are not properly sanitized, 
allowing an attacker to perform SQL injection and potentially execute 
code in the context of the 'nt authority\local service' account.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Advantech
product: iView
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Alex Williams of Converge Technology Solutions reported these vulnerabilities to CISA.
Published: 2025-07-10T23:24:42.965Z
CVE-2025-52578 
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications.

This issue affects Command Centre Server: 

9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
Problem types: cwe_id: CWE-335
description: CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Affected products: vendor: Gallagher
product: High Sec End of Line Module
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-11-18T03:26:20.887Z
CVE-2025-52579 Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory
Emerson ValveLink Products store sensitive information in cleartext in memory. The 
sensitive memory might be saved to disk, stored in a core dump, or 
remain uncleared if the product crashes, or if the programmer does not 
properly clear the memory before freeing it.
Problem types: cwe_id: CWE-316
description: CWE-316
Affected products: vendor: Emerson
product: ValveLink SOLO
default_status: unaffected
vendor: Emerson
product: ValveLink DTM
default_status: unaffected
vendor: Emerson
product: ValveLink PRM
default_status: unaffected
vendor: Emerson
product: ValveLink SNAP-ON
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Emerson reported these vulnerabilities to CISA.
Published: 2025-07-10T23:37:21.515Z
CVE-2025-52580 
Insertion of sensitive information into log file issue exists in "region PAY" App for Android prior to 1.5.28. If exploited, sensitive user information may be exposed to an attacker who has access to the application logs.
Problem types: cwe_id: CWE-532
description: Insertion of sensitive information into log file
Affected products: vendor: Gift Pad Co.,Ltd.
product: "region PAY" App for Android
Published: 2025-07-22T04:49:33.459Z
CVE-2025-52581 
An integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted GDF file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: The Biosig Project
product: libbiosig
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Mark Bereza and Lilith &gt;_&gt; of Cisco Talos.
Published: 2025-08-25T13:53:48.423Z
CVE-2025-52582 
An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Grassroot DICOM
product: Grassroot DICOM
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Emmanuel Tacheau of Cisco Talos.
Published: 2025-12-16T21:32:53.477Z
CVE-2025-52583 
Reflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: NEOJAPAN Inc.
product: desknet's Web Server
Published: 2025-10-16T10:03:14.116Z
CVE-2025-52584 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Heap-based Buffer Overflow
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Ashlar-Vellum
product: Cobalt
default_status: unaffected
vendor: Ashlar-Vellum
product: Xenon
default_status: unaffected
vendor: Ashlar-Vellum
product: Argon
default_status: unaffected
vendor: Ashlar-Vellum
product: Lithium
default_status: unaffected
vendor: Ashlar-Vellum
product: Cobalt Share
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2025-08-18T21:09:30.297Z
CVE-2025-52585 BIG-IP Client SSL profile vulnerability
When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-08-13T14:46:53.883Z
CVE-2025-52586 EG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive Information
The MOD3 command traffic between the monitoring application and the 
inverter is transmitted in plaintext without encryption or obfuscation. 
This vulnerability may allow an attacker with access to a local network 
to intercept, manipulate, replay, or forge critical data, including 
read/write operations for voltage, current, and power configuration, 
operational status, alarms, telemetry, system reset, or inverter control
 commands, potentially disrupting power generation or reconfiguring 
inverter settings.
Problem types: cwe_id: CWE-319
description: CWE-319
Affected products: vendor: EG4 Electronics
product: EG4 12kPV
default_status: unaffected
vendor: EG4 Electronics
product: EG4 18kPV
default_status: unaffected
vendor: EG4 Electronics
product: EG4 Flex 21
default_status: unaffected
vendor: EG4 Electronics
product: EG4 Flex 18
default_status: unaffected
vendor: EG4 Electronics
product: EG4 6000XP
default_status: unaffected
vendor: EG4 Electronics
product: EG4 12000XP
default_status: unaffected
vendor: EG4 Electronics
product: EG4 GridBoss
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Anthony Rose of BC Security reported these vulnerabilities to CISA.
Published: 2025-08-08T16:00:43.694Z
CVE-2025-52598 Insufficient certificate validation
Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has found a flaw that camera's client service does not perform certificate validation. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Hanwha Vision Co., Ltd.
product: QNV-C8012
default_status: unaffected
Published: 2025-12-26T04:07:19.958Z
CVE-2025-52599 Inadequate account permissions management
Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered Inadequate of permission management for camera guest account. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Hanwha Vision Co., Ltd.
product: QNV-C8012
default_status: unaffected
Published: 2025-12-26T04:12:37.550Z
CVE-2025-52600 Improper Input Validation
Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in camera video analytics that Improper input validation. This vulnerability could allow an attacker to execute specific commands on the user's host PC.The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Hanwha Vision Co., Ltd.
product: QNV-C8012
default_status: unaffected
Published: 2025-12-26T04:20:17.014Z
CVE-2025-52601 Hardcoding sensitive information
Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in Device Manager that a hardcoded encryption key for sensitive information. An attacker can use key to decrypt sensitive information. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Problem types: cwe_id: CWE-321
description: CWE-321: Use of Hard-coded Cryptographic Key
Affected products: vendor: Hanwha Vision Co., Ltd.
product: Device Manager
default_status: unaffected
Published: 2025-12-26T04:29:25.830Z
CVE-2025-52602 HCL BigFix Query is affected by a sensitive information disclosure vulnerability in the WebUI Query application
HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application.  An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs).   An attacker can use that information to target individuals with phishing or other social-engineering attacks.
Problem types: cwe_id: CWE-359
description: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Affected products: vendor: HCL Software
product: BigFix Query
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2025-11-05T14:46:46.537Z
CVE-2025-52603 HCL Connections is vulnerable to information disclosure
HCL Connections is vulnerable to information disclosure.  In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.
Problem types: cwe_id: CWE-213
description: CWE-213  Exposure of Sensitive Information Due to Incompatible Schemas
Affected products: vendor: HCLSoftware
product: Connections
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2026-02-20T15:29:55.020Z
CVE-2025-52606 HCL iControl was affected by Weak Input Validation vulnerability. .
HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Problem types: cwe_id: CWE-209
description: CWE-209 : Generation of Error Message Containing Sensitive Information.
Affected products: vendor: HCL
product: iControl
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Published: 2026-06-04T11:56:42.357Z
CVE-2025-52608 HCL  iControl was affected by Missing Cookie Attributes vulnerability.
HCL  iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.
Problem types: cwe_id: CWE-614
description: CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: HCL
product: iControl
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: LOW
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Published: 2026-06-04T11:49:16.313Z
CVE-2025-52609 HCL iControl was affected by Missing Security Headers vulnerability.
HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.
Problem types: cwe_id: CWE-693
description: CWE-693  CWE-693: Protection Mechanism Failure
Affected products: vendor: HCL
product: iControl
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: LOW
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: 2026-06-04T11:42:18.319Z
CVE-2025-52611 HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability
HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the property dashboard key from an object that is undefined. This issue likely stems from one of the following: A missing or improperly initialized object.
Problem types: cwe_id: CWE-209
description: CWE-209: Generation of Error Message Containing Sensitive Information
Affected products: vendor: HCL
product: iControl
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: LOW
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Published: 2026-06-04T11:41:49.449Z
CVE-2025-52612 HCL iControl was affected by Export CSV - CSV Injection vulnerability.
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .
Problem types: cwe_id: CWE-1236
description: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: HCL
product: iControl
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Published: 2026-06-04T11:40:16.884Z
CVE-2025-52613 HCL BigFix Service Management (SM) is affected by use of a vulnerable component
HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: HCL
product: BigFix Service Management (SM)
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Published: 2026-05-06T13:50:47.494Z
CVE-2025-52614 HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability
HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability.  A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: HCL Software
product: Unica Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-10-12T07:52:47.028Z
CVE-2025-52615 HCL Unica Platform is impacted by misconfigured security related HTTP headers
HCL Unica Platform is impacted by misconfigured security related HTTP headers.  This can lead to less secure browser default treatment for the policies controlled by these headers.
Problem types: cwe_id: CWE-693
description: CWE-693 Protection Mechanism Failure
Affected products: vendor: HCL Software
product: Unica Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-10-12T08:18:20.960Z