Instruction: Please provide detailed information about CVE-2025-23190

CVE:CVE-2025-23190
Description:Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.
published:2025-02-11T01:15:10.413


Instruction: Please provide detailed information about CVE-2025-23191

CVE:CVE-2025-23191
Description:Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the `atom:link` values in the returned metadata redirecting them from the SAP server to a malicious link set by the attacker. Successful exploitation could cause low impact on integrity of the application.
published:2025-02-11T01:15:10.557


Instruction: Please provide detailed information about CVE-2025-23193

CVE:CVE-2025-23193
Description:SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server availability.
published:2025-02-11T01:15:10.700


Instruction: Please provide detailed information about CVE-2025-24867

CVE:CVE-2025-24867
Description:SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application allows an unauthenticated attacker to craft a URL that embeds a malicious script within an unprotected parameter. When a victim clicks the link, the script will be executed in the browser, giving the attacker the ability to access and/or modify information related to the web client with no effect on availability.
published:2025-02-11T01:15:10.847


Instruction: Please provide detailed information about CVE-2025-24868

CVE:CVE-2025-24868
Description:The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker can cause limited impact on confidentiality, integrity, and availability of the system.
published:2025-02-11T01:15:10.990


Instruction: Please provide detailed information about CVE-2025-24869

CVE:CVE-2025-24869
Description:SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information could be exposed without compromising its integrity or availability.
published:2025-02-11T01:15:11.140


Instruction: Please provide detailed information about CVE-2025-24870

CVE:CVE-2025-24870
Description:SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulting in privilege escalation. On successful exploitation, this could result in disclosure of highly sensitive information. This has no impact on integrity, and availability.
published:2025-02-11T01:15:11.280


Instruction: Please provide detailed information about CVE-2025-24872

CVE:CVE-2025-24872
Description:The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact on the confidentiality of the application with no effect on the integrity and availability of the application.
published:2025-02-11T01:15:11.437


Instruction: Please provide detailed information about CVE-2025-24874

CVE:CVE-2025-24874
Description:SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information.
published:2025-02-11T01:15:11.580


Instruction: Please provide detailed information about CVE-2025-24875

CVE:CVE-2025-24875
Description:SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.
published:2025-02-11T01:15:11.733


Instruction: Please provide detailed information about CVE-2025-24876

CVE:CVE-2025-24876
Description:The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
published:2025-02-11T01:15:11.887


Instruction: Please provide detailed information about CVE-2025-25241

CVE:CVE-2025-25241
Description:Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability.
published:2025-02-11T01:15:12.027


Instruction: Please provide detailed information about CVE-2025-25243

CVE:CVE-2025-25243
Description:SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability.
published:2025-02-11T01:15:12.170


Instruction: Please provide detailed information about CVE-2025-0499

CVE:CVE-2025-0499
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-02-11T02:15:37.043


Instruction: Please provide detailed information about CVE-2025-1166

CVE:CVE-2025-1166
Description:A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file endpoint/update.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-11T02:15:37.100


Instruction: Please provide detailed information about CVE-2025-1167

CVE:CVE-2025-1167
Description:A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected by this issue is some unknown functionality of the file /hr_soft/admin/Update_User.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-11T02:15:37.570


Instruction: Please provide detailed information about CVE-2025-1168

CVE:CVE-2025-1168
Description:A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-contact.php. The manipulation of the argument contact leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-11T02:15:37.733


Instruction: Please provide detailed information about CVE-2025-1169

CVE:CVE-2025-1169
Description:A vulnerability was found in SourceCodester Image Compressor Tool 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /image-compressor/compressor.php. The manipulation of the argument image leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-11T03:15:07.640


Instruction: Please provide detailed information about CVE-2025-1170

CVE:CVE-2025-1170
Description:A vulnerability classified as problematic has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /Admin/Category.php. The manipulation of the argument Desc leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-11T03:15:07.810


Instruction: Please provide detailed information about CVE-2025-1143

CVE:CVE-2025-1143
Description:Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.
published:2025-02-11T04:15:08.163


Instruction: Please provide detailed information about CVE-2025-1144

CVE:CVE-2025-1144
Description:School Affairs System from Quanxun has an Exposure of Sensitive Information, allowing unauthenticated attackers to view specific pages and obtain database information as well as plaintext administrator credentials.
published:2025-02-11T04:15:08.330


Instruction: Please provide detailed information about CVE-2025-1145

CVE:CVE-2025-1145
Description:NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques.
published:2025-02-11T04:15:08.480


Instruction: Please provide detailed information about CVE-2025-1171

CVE:CVE-2025-1171
Description:A vulnerability classified as problematic was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin/CustomerReport.php. The manipulation of the argument Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-11T04:15:08.630


Instruction: Please provide detailed information about CVE-2025-1172

CVE:CVE-2025-1172
Description:A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown functionality of the file addtocart.php. The manipulation of the argument bcid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-11T04:15:08.800


Instruction: Please provide detailed information about CVE-2025-1173

CVE:CVE-2025-1173
Description:A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file process_users_del.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely.
published:2025-02-11T05:15:13.530


Instruction: Please provide detailed information about CVE-2025-1174

CVE:CVE-2025-1174
Description:A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file process_book_add.php of the component Add Book Page. The manipulation of the argument Book Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-02-11T05:15:13.810


Instruction: Please provide detailed information about CVE-2025-1211

CVE:CVE-2025-1211
Description:Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/.
This vulnerability can be exploited when users rely on the URL function for host checking.
published:2025-02-11T05:15:14.013


Instruction: Please provide detailed information about CVE-2025-1176

CVE:CVE-2025-1176
Description:A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.
published:2025-02-11T06:15:22.433


Instruction: Please provide detailed information about CVE-2025-1177

CVE:CVE-2025-1177
Description:A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has been classified as critical. Affected is the function import_add of the file dayrui/Fcms/Control/Admin/Linkage.php. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-11T06:15:22.623


Instruction: Please provide detailed information about CVE-2025-0180

CVE:CVE-2025-0180
Description:The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.
published:2025-02-11T07:15:29.277


Instruction: Please provide detailed information about CVE-2025-0181

CVE:CVE-2025-0181
Description:The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.7. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authentication cookie. This makes it possible for unauthenticated attackers to gain access to a target user's (e.g. administrators) account.
published:2025-02-11T07:15:29.827


Instruction: Please provide detailed information about CVE-2025-1178

CVE:CVE-2025-1178
Description:A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue.
published:2025-02-11T07:15:29.997


Instruction: Please provide detailed information about CVE-2025-1179

CVE:CVE-2025-1179
Description:A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. The manipulation leads to memory corruption. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer explains, that "[t]his bug has been fixed at some point between the 2.43 and 2.44 releases".
published:2025-02-11T07:15:30.230


Instruction: Please provide detailed information about CVE-2025-1180

CVE:CVE-2025-1180
Description:A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
published:2025-02-11T08:15:31.590


Instruction: Please provide detailed information about CVE-2025-1181

CVE:CVE-2025-1181
Description:A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue.
published:2025-02-11T08:15:31.797


Instruction: Please provide detailed information about CVE-2025-0589

CVE:CVE-2025-0589
Description:In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two endpoints which would retrieve some data from the associated Active Directory. The requests when crafted correctly would return specific information from user profiles (Email address/UPN and Display name) from one endpoint and group information ( Group ID and Display name) from the other. This vulnerability does not expose data within the Octopus Server product itself.
published:2025-02-11T09:15:09.387


Instruction: Please provide detailed information about CVE-2025-1182

CVE:CVE-2025-1182
Description:A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as b425859021d17adf62f06fb904797cf8642986ad. It is recommended to apply a patch to fix this issue.
published:2025-02-11T09:15:09.530


Instruction: Please provide detailed information about CVE-2025-0525

CVE:CVE-2025-0525
Description:In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an adversary with information that may aid in further attacks against the server.
published:2025-02-11T10:15:09.490


Instruction: Please provide detailed information about CVE-2025-26408

CVE:CVE-2025-26408
Description:The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. This enables an attacker to extract information, modify and debug the device's firmware. All known versions are affected.
published:2025-02-11T10:15:09.617


Instruction: Please provide detailed information about CVE-2025-26409

CVE:CVE-2025-26409
Description:A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used to gain a root shell on the device. This issue is fixed in recent firmware versions BSP >= 6.4.1.
published:2025-02-11T10:15:09.743


Instruction: Please provide detailed information about CVE-2025-26410

CVE:CVE-2025-26410
Description:The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.
published:2025-02-11T10:15:09.863


Instruction: Please provide detailed information about CVE-2025-26411

CVE:CVE-2025-26411
Description:An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web interface to be able to conduct this attack. This issue is fixed in recent firmware versions BSP >= 6.1.0.
published:2025-02-11T10:15:09.973


Instruction: Please provide detailed information about CVE-2025-0513

CVE:CVE-2025-0513
Description:In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they could embed code which may impact the user viewing the error message.
published:2025-02-11T11:15:15.817


Instruction: Please provide detailed information about CVE-2025-0526

CVE:CVE-2025-0526
Description:In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.
published:2025-02-11T11:15:15.923


Instruction: Please provide detailed information about CVE-2025-0862

CVE:CVE-2025-0862
Description:The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is limited to Chromium-based browsers (e.g. Chrome, Edge, Brave).
published:2025-02-11T11:15:16.043


Instruction: Please provide detailed information about CVE-2025-23363

CVE:CVE-2025-23363
Description:A vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions), Teamcenter V2312 (All versions), Teamcenter V2406 (All versions), Teamcenter V2412 (All versions). The SSO login service of affected applications accepts user-controlled input that could specify a link to an external site. This could allow an attacker to redirect the legitimate user to an attacker-chosen URL to steal valid session data. For a successful exploit, the legitimate user must actively click on an attacker-crafted link.
published:2025-02-11T11:15:16.250


Instruction: Please provide detailed information about CVE-2025-23403

CVE:CVE-2025-23403
Description:A vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do not properly restrict the user permission for the registry key. This could allow an authenticated attacker to load vulnerable drivers into the system leading to privilege escalation or bypassing endpoint protection and other security measures.
published:2025-02-11T11:15:16.420


Instruction: Please provide detailed information about CVE-2025-24499

CVE:CVE-2025-24499
Description:A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected devices do not properly validate input while loading the configuration files. This could allow an authenticated remote attacker to execute arbitrary shell commands on the device.
published:2025-02-11T11:15:16.583


Instruction: Please provide detailed information about CVE-2025-24532

CVE:CVE-2025-24532
Description:A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected devices with role `user` is affected by incorrect authorization in SNMPv3 View configuration. This could allow an attacker to change the View Type of SNMPv3 Views.
published:2025-02-11T11:15:16.740


Instruction: Please provide detailed information about CVE-2025-24811


Instruction: Please provide detailed information about CVE-2025-24812

CVE:CVE-2025-24812
Description:A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1211C DC/DC/Rly (6ES7211-1HE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1212C AC/DC/Rly (6ES7212-1BE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1212C DC/DC/DC (6ES7212-1AE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1212C DC/DC/Rly (6ES7212-1HE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1212FC DC/DC/DC (6ES7212-1AF40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1212FC DC/DC/Rly (6ES7212-1HF40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1214C AC/DC/Rly (6ES7214-1BG40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1214C DC/DC/Rly (6ES7214-1HG40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1214FC DC/DC/DC (6ES7214-1AF40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1214FC DC/DC/Rly (6ES7214-1HF40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1215C AC/DC/Rly (6ES7215-1BG40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1215C DC/DC/DC (6ES7215-1AG40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1215C DC/DC/Rly (6ES7215-1HG40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1215FC DC/DC/DC (6ES7215-1AF40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1215FC DC/DC/Rly (6ES7215-1HF40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1217C DC/DC/DC (6ES7217-1AG40-0XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1212 AC/DC/RLY (6AG1212-1BE40-2XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1212 AC/DC/RLY (6AG1212-1BE40-4XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1212 DC/DC/RLY (6AG1212-1HE40-2XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1212 DC/DC/RLY (6AG1212-1HE40-4XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1212C DC/DC/DC (6AG1212-1AE40-2XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1212C DC/DC/DC (6AG1212-1AE40-4XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL (6AG2212-1AE40-1XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214 AC/DC/RLY (6AG1214-1BG40-2XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214 AC/DC/RLY (6AG1214-1BG40-4XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214 AC/DC/RLY (6AG1214-1BG40-5XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214 DC/DC/DC (6AG1214-1AG40-2XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214 DC/DC/DC (6AG1214-1AG40-4XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214 DC/DC/DC (6AG1214-1AG40-5XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214 DC/DC/RLY (6AG1214-1HG40-2XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214 DC/DC/RLY (6AG1214-1HG40-4XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214 DC/DC/RLY (6AG1214-1HG40-5XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL (6AG2214-1AG40-1XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214FC DC/DC/DC (6AG1214-1AF40-5XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1214FC DC/DC/RLY (6AG1214-1HF40-5XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-2XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-4XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215 AC/DC/RLY (6AG1215-1BG40-5XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215 DC/DC/DC (6AG1215-1AG40-2XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215 DC/DC/DC (6AG1215-1AG40-4XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-2XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-4XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215 DC/DC/RLY (6AG1215-1HG40-5XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215C DC/DC/DC (6AG1215-1AG40-5XB0) (All versions < V4.7), SIPLUS S7-1200 CPU 1215FC DC/DC/DC (6AG1215-1AF40-5XB0) (All versions < V4.7). Affected devices do not process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device.
published:2025-02-11T11:15:17.080


Instruction: Please provide detailed information about CVE-2025-24956

CVE:CVE-2025-24956
Description:A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial numbers. Thus, an attacker could introduce a buffer overflow that leads to memory corruption.
published:2025-02-11T11:15:17.273


Instruction: Please provide detailed information about CVE-2025-26490

CVE:CVE-2025-26490
Description:Rejected reason: This CVE ID is a duplicate of CVE-2025-26495.
published:2025-02-11T11:15:17.460


Instruction: Please provide detailed information about CVE-2025-26491

CVE:CVE-2025-26491
Description:Rejected reason: This CVE ID is a duplicate of CVE-2025-26494.
published:2025-02-11T11:15:17.613


Instruction: Please provide detailed information about CVE-2025-0588

CVE:CVE-2025-0588
Description:In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a specifically crafted referrer header the user could ensure that all subsequent server responses would return 500 errors rendering the site mostly unusable. The user would be able to subsequently set and unset the referrer header to control the denial of service state with a valid CSRF token whilst new CSRF tokens could not be generated.
published:2025-02-11T12:15:34.200


Instruction: Please provide detailed information about CVE-2025-1231

CVE:CVE-2025-1231
Description:Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.
published:2025-02-11T14:15:31.130


Instruction: Please provide detailed information about CVE-2025-26492

CVE:CVE-2025-26492
Description:In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources
published:2025-02-11T14:15:31.260


Instruction: Please provide detailed information about CVE-2025-26493

CVE:CVE-2025-26493
Description:In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
published:2025-02-11T14:15:31.473


Instruction: Please provide detailed information about CVE-2025-22467

CVE:CVE-2025-22467
Description:A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution.
published:2025-02-11T16:15:50.840


Instruction: Please provide detailed information about CVE-2025-24807

CVE:CVE-2025-24807
Description:eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0, per design, PermissionsCA is not full chain validated, nor is the expiration date validated. Access control plugin validates only the S/MIME signature which causes an expired PermissionsCA to be taken as valid. Even though this issue is responsible for allowing `governance/permissions` from an expired PermissionsCA and having the system crash when PermissionsCA is not self-signed and contains the full-chain, the impact is low. Versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0 contain a fix for the issue.
published:2025-02-11T16:15:51.190


Instruction: Please provide detailed information about CVE-2025-24896

CVE:CVE-2025-24896
Description:Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named `token` is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary affected users will be users who have logged into Misskey using a public PC or someone else's device, but it's possible that users who have logged out of Misskey before lending their PC to someone else could also be affected. Version 2025.2.0-alpha.0 contains a fix for this issue.
published:2025-02-11T16:15:51.477


Instruction: Please provide detailed information about CVE-2025-24897

CVE:CVE-2025-24897
Description:Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. This vulnerability was fixed in 2025.2.0-alpha.0. As a workaround, block all access to the `/queue` directory with a web application firewall (WAF).
published:2025-02-11T16:15:51.610


Instruction: Please provide detailed information about CVE-2025-24900

CVE:CVE-2025-24900
Description:Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, there is a vulnerability that allows MediaProxy authentication to be bypassed. In versions prior to 12.25Q1.1, the authentication cookie does not have the SameSite attribute. This allows an attacker to bypass MediaProxy authentication and load any image without restrictions under certain circumstances. In versions prior to 12.24Q2.3, this cookie was also used to authenticate the job queue management page (bull-board), so bull-board authentication is also bypassed. This may enable attacks that have a significant impact on availability and integrity. The affected versions are too old to be covered by this advisory, but the maintainers of Concorde strongly recommend not using older versions. Version 12.25Q1.1 contains a patch. There is no effective workaround other than updating.
published:2025-02-11T16:15:51.763


Instruction: Please provide detailed information about CVE-2025-24973

CVE:CVE-2025-24973
Description:Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Prior to version 12.25Q1.1, due to an improper implementation of the logout process, authentication credentials remain in cookies even after a user has explicitly logged out, which may allow an attacker to steal authentication tokens. This could have devastating consequences if a user with admin privileges is (or was) using a shared device. Users who have logged in on a shared device should go to Settings > Security and regenerate their login tokens. Version 12.25Q1.1 fixes the issue. As a workaround, clear cookies and site data in the browser after logging out.
published:2025-02-11T16:15:52.020


Instruction: Please provide detailed information about CVE-2025-24976

CVE:CVE-2025-24976
Description:Distribution is a toolkit to pack, ship, store, and deliver container content. Systems running registry versions 3.0.0-beta.1 through 3.0.0-rc.2 with token authentication enabled may be vulnerable to an issue in which token authentication allows an attacker to inject an untrusted signing key in a JSON web token (JWT). The issue lies in how the JSON web key (JWK) verification is performed. When a JWT contains a JWK header without a certificate chain, the code only checks if the KeyID (`kid`) matches one of the trusted keys, but doesn't verify that the actual key material matches. A fix for the issue is available at commit 5ea9aa028db65ca5665f6af2c20ecf9dc34e5fcd and expected to be a part of version 3.0.0-rc.3. There is no way to work around this issue without patching if the system requires token authentication.
published:2025-02-11T16:15:52.163


Instruction: Please provide detailed information about CVE-2025-1126

CVE:CVE-2025-1126
Description:A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client.
published:2025-02-11T17:15:23.537


Instruction: Please provide detailed information about CVE-2025-21121

CVE:CVE-2025-21121
Description:InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T17:15:23.673


Instruction: Please provide detailed information about CVE-2025-21123

CVE:CVE-2025-21123
Description:InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T17:15:23.817


Instruction: Please provide detailed information about CVE-2025-21124

CVE:CVE-2025-21124
Description:InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T17:15:23.950


Instruction: Please provide detailed information about CVE-2025-21125

CVE:CVE-2025-21125
Description:InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T17:15:24.083


Instruction: Please provide detailed information about CVE-2025-21126

CVE:CVE-2025-21126
Description:InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service condition. An attacker could exploit this vulnerability to cause the application to crash, resulting in a denial of service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T17:15:24.220


Instruction: Please provide detailed information about CVE-2025-21157

CVE:CVE-2025-21157
Description:InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T17:15:24.353


Instruction: Please provide detailed information about CVE-2025-21158

CVE:CVE-2025-21158
Description:InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T17:15:24.487


Instruction: Please provide detailed information about CVE-2025-22399

CVE:CVE-2025-22399
Description:Dell UCC Edge, version 2.3.0, contains a Blind SSRF on Add Customer SFTP Server vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Server-side request forgery
published:2025-02-11T17:15:34.453


Instruction: Please provide detailed information about CVE-2025-24470

CVE:CVE-2025-24470
Description:An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to retrieve source code via crafted HTTP requests.
published:2025-02-11T17:15:34.730


Instruction: Please provide detailed information about CVE-2025-24472

CVE:CVE-2025-24472
Description:An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
published:2025-02-11T17:15:34.867


Instruction: Please provide detailed information about CVE-2025-21155

CVE:CVE-2025-21155
Description:Substance3D - Stager versions 3.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T18:15:27.583


Instruction: Please provide detailed information about CVE-2025-21156

CVE:CVE-2025-21156
Description:InCopy versions 20.0, 19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T18:15:27.787


Instruction: Please provide detailed information about CVE-2025-21159

CVE:CVE-2025-21159
Description:Illustrator versions 29.1, 28.7.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T18:15:27.977


Instruction: Please provide detailed information about CVE-2025-21160

CVE:CVE-2025-21160
Description:Illustrator versions 29.1, 28.7.3 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T18:15:28.163


Instruction: Please provide detailed information about CVE-2025-21161

CVE:CVE-2025-21161
Description:Substance3D - Designer versions 14.0.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T18:15:28.347


Instruction: Please provide detailed information about CVE-2025-21162

CVE:CVE-2025-21162
Description:Photoshop Elements versions 2025.0 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T18:15:28.567


Instruction: Please provide detailed information about CVE-2025-21163

CVE:CVE-2025-21163
Description:Illustrator versions 29.1, 28.7.3 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-02-11T18:15:28.747


Instruction: Please provide detailed information about CVE-2025-21179

CVE:CVE-2025-21179
Description:DHCP Client Service Denial of Service Vulnerability
published:2025-02-11T18:15:29.343


Instruction: Please provide detailed information about CVE-2025-21181

CVE:CVE-2025-21181
Description:Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
published:2025-02-11T18:15:29.553


Instruction: Please provide detailed information about CVE-2025-21182

CVE:CVE-2025-21182
Description:Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
published:2025-02-11T18:15:29.797


Instruction: Please provide detailed information about CVE-2025-21183

CVE:CVE-2025-21183
Description:Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
published:2025-02-11T18:15:29.993


Instruction: Please provide detailed information about CVE-2025-21184

CVE:CVE-2025-21184
Description:Windows Core Messaging Elevation of Privileges Vulnerability
published:2025-02-11T18:15:30.180


Instruction: Please provide detailed information about CVE-2025-21188

CVE:CVE-2025-21188
Description:Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
published:2025-02-11T18:15:30.403


Instruction: Please provide detailed information about CVE-2025-21190

CVE:CVE-2025-21190
Description:Windows Telephony Service Remote Code Execution Vulnerability
published:2025-02-11T18:15:30.610


Instruction: Please provide detailed information about CVE-2025-21194

CVE:CVE-2025-21194
Description:Microsoft Surface Security Feature Bypass Vulnerability
published:2025-02-11T18:15:30.820


Instruction: Please provide detailed information about CVE-2025-21198

CVE:CVE-2025-21198
Description:Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
published:2025-02-11T18:15:31.020


Instruction: Please provide detailed information about CVE-2025-21200

CVE:CVE-2025-21200
Description:Windows Telephony Service Remote Code Execution Vulnerability
published:2025-02-11T18:15:31.203


Instruction: Please provide detailed information about CVE-2025-21201

CVE:CVE-2025-21201
Description:Windows Telephony Server Remote Code Execution Vulnerability
published:2025-02-11T18:15:31.407


Instruction: Please provide detailed information about CVE-2025-21206

CVE:CVE-2025-21206
Description:Visual Studio Installer Elevation of Privilege Vulnerability
published:2025-02-11T18:15:31.610


Instruction: Please provide detailed information about CVE-2025-21208

CVE:CVE-2025-21208
Description:Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
published:2025-02-11T18:15:31.793


Instruction: Please provide detailed information about CVE-2025-21212

CVE:CVE-2025-21212
Description:Internet Connection Sharing (ICS) Denial of Service Vulnerability
published:2025-02-11T18:15:31.980


Instruction: Please provide detailed information about CVE-2025-21216

CVE:CVE-2025-21216
Description:Internet Connection Sharing (ICS) Denial of Service Vulnerability
published:2025-02-11T18:15:32.177


Instruction: Please provide detailed information about CVE-2025-21254

CVE:CVE-2025-21254
Description:Internet Connection Sharing (ICS) Denial of Service Vulnerability
published:2025-02-11T18:15:32.450


Instruction: Please provide detailed information about CVE-2025-21259

CVE:CVE-2025-21259
Description:Microsoft Outlook Spoofing Vulnerability
published:2025-02-11T18:15:32.643


Instruction: Please provide detailed information about CVE-2025-21322

CVE:CVE-2025-21322
Description:Microsoft PC Manager Elevation of Privilege Vulnerability
published:2025-02-11T18:15:33.027


Instruction: Please provide detailed information about CVE-2025-21337

CVE:CVE-2025-21337
Description:Windows NTFS Elevation of Privilege Vulnerability
published:2025-02-11T18:15:33.217


Instruction: Please provide detailed information about CVE-2025-21347

CVE:CVE-2025-21347
Description:Windows Deployment Services Denial of Service Vulnerability
published:2025-02-11T18:15:33.497


Instruction: Please provide detailed information about CVE-2025-21349

CVE:CVE-2025-21349
Description:Windows Remote Desktop Configuration Service Tampering Vulnerability
published:2025-02-11T18:15:33.697


Instruction: Please provide detailed information about CVE-2025-21350

CVE:CVE-2025-21350
Description:Windows Kerberos Denial of Service Vulnerability
published:2025-02-11T18:15:33.903


Instruction: Please provide detailed information about CVE-2025-21351

CVE:CVE-2025-21351
Description:Windows Active Directory Domain Services API Denial of Service Vulnerability
published:2025-02-11T18:15:34.113


Instruction: Please provide detailed information about CVE-2025-21352

CVE:CVE-2025-21352
Description:Internet Connection Sharing (ICS) Denial of Service Vulnerability
published:2025-02-11T18:15:34.310


Instruction: Please provide detailed information about CVE-2025-21358

CVE:CVE-2025-21358
Description:Windows Core Messaging Elevation of Privileges Vulnerability
published:2025-02-11T18:15:34.550


Instruction: Please provide detailed information about CVE-2025-21359

CVE:CVE-2025-21359
Description:Windows Kernel Security Feature Bypass Vulnerability
published:2025-02-11T18:15:34.743


Instruction: Please provide detailed information about CVE-2025-21367

CVE:CVE-2025-21367
Description:Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
published:2025-02-11T18:15:34.943


Instruction: Please provide detailed information about CVE-2025-21368

CVE:CVE-2025-21368
Description:Microsoft Digest Authentication Remote Code Execution Vulnerability
published:2025-02-11T18:15:35.123


Instruction: Please provide detailed information about CVE-2025-21369

CVE:CVE-2025-21369
Description:Microsoft Digest Authentication Remote Code Execution Vulnerability
published:2025-02-11T18:15:35.340


Instruction: Please provide detailed information about CVE-2025-21371

CVE:CVE-2025-21371
Description:Windows Telephony Service Remote Code Execution Vulnerability
published:2025-02-11T18:15:35.540


Instruction: Please provide detailed information about CVE-2025-21373

CVE:CVE-2025-21373
Description:Windows Installer Elevation of Privilege Vulnerability
published:2025-02-11T18:15:35.740


Instruction: Please provide detailed information about CVE-2025-21375

CVE:CVE-2025-21375
Description:Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
published:2025-02-11T18:15:35.947


Instruction: Please provide detailed information about CVE-2025-21376

CVE:CVE-2025-21376
Description:Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
published:2025-02-11T18:15:36.167


Instruction: Please provide detailed information about CVE-2025-21377

CVE:CVE-2025-21377
Description:NTLM Hash Disclosure Spoofing Vulnerability
published:2025-02-11T18:15:36.387


Instruction: Please provide detailed information about CVE-2025-21379

CVE:CVE-2025-21379
Description:DHCP Client Service Remote Code Execution Vulnerability
published:2025-02-11T18:15:36.590


Instruction: Please provide detailed information about CVE-2025-21381

CVE:CVE-2025-21381
Description:Microsoft Excel Remote Code Execution Vulnerability
published:2025-02-11T18:15:36.773


Instruction: Please provide detailed information about CVE-2025-21383

CVE:CVE-2025-21383
Description:Microsoft Excel Information Disclosure Vulnerability
published:2025-02-11T18:15:36.963


Instruction: Please provide detailed information about CVE-2025-21386

CVE:CVE-2025-21386
Description:Microsoft Excel Remote Code Execution Vulnerability
published:2025-02-11T18:15:37.157


Instruction: Please provide detailed information about CVE-2025-21387

CVE:CVE-2025-21387
Description:Microsoft Excel Remote Code Execution Vulnerability
published:2025-02-11T18:15:37.337


Instruction: Please provide detailed information about CVE-2025-21390

CVE:CVE-2025-21390
Description:Microsoft Excel Remote Code Execution Vulnerability
published:2025-02-11T18:15:37.523


Instruction: Please provide detailed information about CVE-2025-21391

CVE:CVE-2025-21391
Description:Windows Storage Elevation of Privilege Vulnerability
published:2025-02-11T18:15:37.723


Instruction: Please provide detailed information about CVE-2025-21392

CVE:CVE-2025-21392
Description:Microsoft Office Remote Code Execution Vulnerability
published:2025-02-11T18:15:37.907


Instruction: Please provide detailed information about CVE-2025-21394

CVE:CVE-2025-21394
Description:Microsoft Excel Remote Code Execution Vulnerability
published:2025-02-11T18:15:38.100


Instruction: Please provide detailed information about CVE-2025-21397

CVE:CVE-2025-21397
Description:Microsoft Office Remote Code Execution Vulnerability
published:2025-02-11T18:15:38.293


Instruction: Please provide detailed information about CVE-2025-21400

CVE:CVE-2025-21400
Description:Microsoft SharePoint Server Remote Code Execution Vulnerability
published:2025-02-11T18:15:38.483


Instruction: Please provide detailed information about CVE-2025-21406

CVE:CVE-2025-21406
Description:Windows Telephony Service Remote Code Execution Vulnerability
published:2025-02-11T18:15:38.907


Instruction: Please provide detailed information about CVE-2025-21407

CVE:CVE-2025-21407
Description:Windows Telephony Service Remote Code Execution Vulnerability
published:2025-02-11T18:15:39.157


Instruction: Please provide detailed information about CVE-2025-21410

CVE:CVE-2025-21410
Description:Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
published:2025-02-11T18:15:39.593


Instruction: Please provide detailed information about CVE-2025-21414

CVE:CVE-2025-21414
Description:Windows Core Messaging Elevation of Privileges Vulnerability
published:2025-02-11T18:15:39.787


Instruction: Please provide detailed information about CVE-2025-21418

CVE:CVE-2025-21418
Description:Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
published:2025-02-11T18:15:40.023


Instruction: Please provide detailed information about CVE-2025-21419

CVE:CVE-2025-21419
Description:Windows Setup Files Cleanup Elevation of Privilege Vulnerability
published:2025-02-11T18:15:40.227


Instruction: Please provide detailed information about CVE-2025-21420

CVE:CVE-2025-21420
Description:Windows Disk Cleanup Tool Elevation of Privilege Vulnerability
published:2025-02-11T18:15:40.427


Instruction: Please provide detailed information about CVE-2025-24036

CVE:CVE-2025-24036
Description:Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
published:2025-02-11T18:15:40.643


Instruction: Please provide detailed information about CVE-2025-24039

CVE:CVE-2025-24039
Description:Visual Studio Code Elevation of Privilege Vulnerability
published:2025-02-11T18:15:40.927


Instruction: Please provide detailed information about CVE-2025-24042

CVE:CVE-2025-24042
Description:Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
published:2025-02-11T18:15:41.117


Instruction: Please provide detailed information about CVE-2025-24406

CVE:CVE-2025-24406
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthenticated attacker could exploit this vulnerability to modify files that are stored outside the restricted directory. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:41.300


Instruction: Please provide detailed information about CVE-2025-24407

CVE:CVE-2025-24407
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:41.497


Instruction: Please provide detailed information about CVE-2025-24408

CVE:CVE-2025-24408
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Information Exposure vulnerability that could result in privilege escalation. A low-privileged attacker could gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:41.677


Instruction: Please provide detailed information about CVE-2025-24409

CVE:CVE-2025-24409
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11  and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:41.860


Instruction: Please provide detailed information about CVE-2025-24410

CVE:CVE-2025-24410
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
published:2025-02-11T18:15:42.057


Instruction: Please provide detailed information about CVE-2025-24411

CVE:CVE-2025-24411
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:42.243


Instruction: Please provide detailed information about CVE-2025-24412

CVE:CVE-2025-24412
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
published:2025-02-11T18:15:42.433


Instruction: Please provide detailed information about CVE-2025-24413

CVE:CVE-2025-24413
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
published:2025-02-11T18:15:42.623


Instruction: Please provide detailed information about CVE-2025-24414

CVE:CVE-2025-24414
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
published:2025-02-11T18:15:42.803


Instruction: Please provide detailed information about CVE-2025-24415

CVE:CVE-2025-24415
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
published:2025-02-11T18:15:42.983


Instruction: Please provide detailed information about CVE-2025-24416

CVE:CVE-2025-24416
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
published:2025-02-11T18:15:43.160


Instruction: Please provide detailed information about CVE-2025-24417

CVE:CVE-2025-24417
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
published:2025-02-11T18:15:43.347


Instruction: Please provide detailed information about CVE-2025-24418

CVE:CVE-2025-24418
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:43.527


Instruction: Please provide detailed information about CVE-2025-24419

CVE:CVE-2025-24419
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:43.713


Instruction: Please provide detailed information about CVE-2025-24420

CVE:CVE-2025-24420
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:43.893


Instruction: Please provide detailed information about CVE-2025-24421

CVE:CVE-2025-24421
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to perform actions with permissions that were not granted. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:44.077


Instruction: Please provide detailed information about CVE-2025-24422

CVE:CVE-2025-24422
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:44.270


Instruction: Please provide detailed information about CVE-2025-24423

CVE:CVE-2025-24423
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:44.457


Instruction: Please provide detailed information about CVE-2025-24424

CVE:CVE-2025-24424
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:44.660


Instruction: Please provide detailed information about CVE-2025-24425

CVE:CVE-2025-24425
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations causing limited data modification. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:44.857


Instruction: Please provide detailed information about CVE-2025-24426

CVE:CVE-2025-24426
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:45.030


Instruction: Please provide detailed information about CVE-2025-24427

CVE:CVE-2025-24427
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:45.223


Instruction: Please provide detailed information about CVE-2025-24428

CVE:CVE-2025-24428
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
published:2025-02-11T18:15:45.423


Instruction: Please provide detailed information about CVE-2025-24429

CVE:CVE-2025-24429
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:45.610


Instruction: Please provide detailed information about CVE-2025-24430

CVE:CVE-2025-24430
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing security mechanisms. Exploitation of this issue requires user interaction.
published:2025-02-11T18:15:45.787


Instruction: Please provide detailed information about CVE-2025-24432

CVE:CVE-2025-24432
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing security mechanisms. Exploitation of this issue requires user interaction.
published:2025-02-11T18:15:45.960


Instruction: Please provide detailed information about CVE-2025-24434

CVE:CVE-2025-24434
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
published:2025-02-11T18:15:46.157


Instruction: Please provide detailed information about CVE-2025-24435

CVE:CVE-2025-24435
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to modify limited fields. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:46.347


Instruction: Please provide detailed information about CVE-2025-24436

CVE:CVE-2025-24436
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:46.537


Instruction: Please provide detailed information about CVE-2025-24437

CVE:CVE-2025-24437
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain elevated privileges. Exploitation of this issue does not require user interaction.
published:2025-02-11T18:15:46.717


Instruction: Please provide detailed information about CVE-2025-24438

CVE:CVE-2025-24438
Description:Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
published:2025-02-11T18:15:46.893


Instruction: Please provide detailed information about CVE-2025-26494

CVE:CVE-2025-26494
Description:Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 through 2023.3.5.
published:2025-02-11T18:15:47.060


Instruction: Please provide detailed information about CVE-2025-26495

CVE:CVE-2025-26495
Description:Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.
published:2025-02-11T18:15:47.237


Instruction: Please provide detailed information about CVE-2025-25202

CVE:CVE-2025-25202
Description:Ash Authentication is an authentication framework for Elixir applications. Applications which have been bootstrapped by the igniter installer present since AshAuthentication v4.1.0 and who have used the magic link strategy _or_ are manually revoking tokens are affected by revoked tokens being allowed to verify as valid. Unless one hase implemented any kind of custom token revocation feature in your application, then one will not be affected. The impact here for users using builtin functionality is that magic link tokens are reusable until they expire. With that said, magic link tokens are only valid for 10 minutes, so the surface area for abuse is extremely low here. The flaw is patched in version 4.4.9. Additionally a compile time warning is shown to users with remediation instructions if they upgrade. 4.4.9 ships with an upgrader, so those who use `mix igniter.upgrade ash_authentication` will have the necessary patch applied. Otherwise, one may run the upgrader manually as described in the error message. As a workaround, delete the generated `:revoked?` generic action in the token resource. This will cause it to use the one internal to Ash Authentication which has always been correct. Alternatively, manually make the changes that are included in the patch.
published:2025-02-11T19:15:18.690


Instruction: Please provide detailed information about CVE-2025-25522

CVE:CVE-2025-25522
Description:Buffer overflow vulnerability in Linksys WAP610N v1.0.05.002 due to the lack of length verification, which is related to the time setting operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability.
published:2025-02-11T19:15:18.883


Instruction: Please provide detailed information about CVE-2025-25523

CVE:CVE-2025-25523
Description:Buffer overflow vulnerability in Trendnet TEG-40128 Web Smart Switch v1(1.00.023) due to the lack of length verification, which is related to the mobile access point setup operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability.
published:2025-02-11T19:15:19.000


Instruction: Please provide detailed information about CVE-2025-25524

CVE:CVE-2025-25524
Description:Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to the addition of Wi-Fi filtering rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
published:2025-02-11T19:15:19.110


Instruction: Please provide detailed information about CVE-2025-0899

CVE:CVE-2025-0899
Description:PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25349.
published:2025-02-11T20:15:34.347


Instruction: Please provide detailed information about CVE-2025-0901

CVE:CVE-2025-0901
Description:PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25372.
published:2025-02-11T20:15:34.480


Instruction: Please provide detailed information about CVE-2025-0902

CVE:CVE-2025-0902
Description:PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25405.
published:2025-02-11T20:15:34.610


Instruction: Please provide detailed information about CVE-2025-0903

CVE:CVE-2025-0903
Description:PDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of RTF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25421.
published:2025-02-11T20:15:34.737


Instruction: Please provide detailed information about CVE-2025-0904

CVE:CVE-2025-0904
Description:PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25422.
published:2025-02-11T20:15:34.867


Instruction: Please provide detailed information about CVE-2025-0905

CVE:CVE-2025-0905
Description:PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25433.
published:2025-02-11T20:15:34.997


Instruction: Please provide detailed information about CVE-2025-0906

CVE:CVE-2025-0906
Description:PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25434.
published:2025-02-11T20:15:35.113


Instruction: Please provide detailed information about CVE-2025-0907

CVE:CVE-2025-0907
Description:PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25435.
published:2025-02-11T20:15:35.240


Instruction: Please provide detailed information about CVE-2025-0908

CVE:CVE-2025-0908
Description:PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25557.
published:2025-02-11T20:15:35.370


Instruction: Please provide detailed information about CVE-2025-0909

CVE:CVE-2025-0909
Description:PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25678.
published:2025-02-11T20:15:35.500


Instruction: Please provide detailed information about CVE-2025-0910

CVE:CVE-2025-0910
Description:PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25748.
published:2025-02-11T20:15:35.633


Instruction: Please provide detailed information about CVE-2025-0911

CVE:CVE-2025-0911
Description:PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25957.
published:2025-02-11T20:15:35.770


Instruction: Please provide detailed information about CVE-2025-1044

CVE:CVE-2025-1044
Description:Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability.  The specific flaw exists within the web service, which listens on TCP port 443 by default. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25336.
published:2025-02-11T20:15:35.913


Instruction: Please provide detailed information about CVE-2025-1052

CVE:CVE-2025-1052
Description:Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mintty. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of sixel images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23382.
published:2025-02-11T20:15:36.070


Instruction: Please provide detailed information about CVE-2025-25525

CVE:CVE-2025-25525
Description:Buffer overflow vulnerability in H3C FA3010L access points SWFA1B0V100R005 due to the lack of length verification, which is related to the setting of firewall rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
published:2025-02-11T20:15:38.727


Instruction: Please provide detailed information about CVE-2025-25526

CVE:CVE-2025-25526
Description:Buffer overflow vulnerability in Mercury MIPC552W Camera v1.0 due to the lack of length verification, which is related to the configuration of the PPTP server. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
published:2025-02-11T20:15:38.850


Instruction: Please provide detailed information about CVE-2025-25527

CVE:CVE-2025-25527
Description:Buffer overflow vulnerability in Ruijie RG-NBR2600S Gateway 10.3(4b12) due to the lack of length verification, which is related to the configuration of source address NAT rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
published:2025-02-11T20:15:38.973


Instruction: Please provide detailed information about CVE-2025-25528

CVE:CVE-2025-25528
Description:Multiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on user-controlled data. By successfully exploiting the vulnerabilities, attackers can crash the remote devices or execute arbitrary commands without any authorization verification.
published:2025-02-11T20:15:39.090


Instruction: Please provide detailed information about CVE-2025-25529

CVE:CVE-2025-25529
Description:Buffer overflow vulnerability in Digital China DCBC Gateway 200-2.1.1 due to the lack of length verification, which is related to the configuration of static NAT rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
published:2025-02-11T20:15:39.217


Instruction: Please provide detailed information about CVE-2025-25530

CVE:CVE-2025-25530
Description:Buffer overflow vulnerability in Digital China DCBI-Netlog-LAB Gateway 1.0 due to the lack of length verification, which is related to saving parental control configuration information. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.
published:2025-02-11T20:15:39.327


Instruction: Please provide detailed information about CVE-2025-0989

CVE:CVE-2025-0989
Description:Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-12315. Reason: This candidate is a reservation duplicate of CVE-2024-12315. Notes: All CVE users should reference CVE-2024-12315 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
published:2025-02-11T21:15:12.823


Instruction: Please provide detailed information about CVE-2025-1240

CVE:CVE-2025-1240
Description:WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of 7Z files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24986.
published:2025-02-11T22:15:29.800


Instruction: Please provide detailed information about CVE-2025-25203

CVE:CVE-2025-25203
Description:CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting (XSS) vulnerability exists in the `TicketsController` and `Moderation/TicketsController` due to insufficient input validation on the `priority` field during ticket creation and unsafe rendering of this field in the moderator panel. Version 1.0 contains a patch for the issue.
published:2025-02-11T23:15:09.450


Instruction: Please provide detailed information about CVE-2025-1243

CVE:CVE-2025-1243
Description:The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the `update response` field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025)  with a proxy leveraging the api-go library before version 1.44.1.  Other data fields were correctly sent to Data Converter. This issue does not impact the Data Converter server. Data was encrypted in transit. Temporal Cloud services are not impacted.
published:2025-02-12T01:15:09.073


Instruction: Please provide detailed information about CVE-2025-23359

CVE:CVE-2025-23359
Description:NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
published:2025-02-12T01:15:09.230


Instruction: Please provide detailed information about CVE-2025-0808

CVE:CVE-2025-0808
Description:The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed exports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-02-12T04:15:09.950


Instruction: Please provide detailed information about CVE-2025-1183

CVE:CVE-2025-1183
Description:A vulnerability has been found in CodeZips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/more-userprofile.php. The manipulation of the argument login_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-12T07:15:07.863


Instruction: Please provide detailed information about CVE-2025-1184

CVE:CVE-2025-1184
Description:A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax=GetModal_MQTTEdit. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-12T07:15:08.410


Instruction: Please provide detailed information about CVE-2025-26520

CVE:CVE-2025-26520
Description:Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146.
published:2025-02-12T07:15:08.617


Instruction: Please provide detailed information about CVE-2025-1185

CVE:CVE-2025-1185
Description:A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?Ajax=GetModal_Sensor_Graph. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-12T08:15:08.870


Instruction: Please provide detailed information about CVE-2025-1186

CVE:CVE-2025-1186
Description:A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/Api.php. The manipulation of the argument thumb leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-12T08:15:09.153


Instruction: Please provide detailed information about CVE-2025-1187

CVE:CVE-2025-1187
Description:A vulnerability classified as critical was found in code-projects Police FIR Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Delete Record Handler. The manipulation leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
published:2025-02-12T09:15:08.613


Instruction: Please provide detailed information about CVE-2025-1188

CVE:CVE-2025-1188
Description:A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/updateroutine.php. The manipulation of the argument tid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-12T09:15:08.803