Instruction: Please provide detailed information about CVE-2025-2122

CVE:CVE-2025-2122
Description:A vulnerability classified as problematic was found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected by this vulnerability is an unknown functionality of the component Connection Handler. The manipulation leads to denial of service. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-09T14:15:15.430


Instruction: Please provide detailed information about CVE-2025-2123

CVE:CVE-2025-2123
Description:A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function get_var of the file /contrib/cssgen.php of the component CSS Handler. The manipulation of the argument default-styles/keywords-1/keywords-2/keywords-3/keywords-4/comments leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-09T15:15:36.413


Instruction: Please provide detailed information about CVE-2025-2124

CVE:CVE-2025-2124
Description:A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/change_password of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-09T16:15:11.533


Instruction: Please provide detailed information about CVE-2025-2125

CVE:CVE-2025-2125
Description:A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovante_marcacao/?companyId=1 of the component PDF Document Handler. The manipulation of the argument nsr leads to improper control of resource identifiers. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-09T16:15:12.550


Instruction: Please provide detailed information about CVE-2025-2126

CVE:CVE-2025-2126
Description:A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the argument title leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-09T17:15:37.453


Instruction: Please provide detailed information about CVE-2025-2127

CVE:CVE-2025-2127
Description:A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-09T18:15:12.807


Instruction: Please provide detailed information about CVE-2025-2129

CVE:CVE-2025-2129
Description:A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. After 7 months of repeated follow-ups by the researcher, Mage AI has decided to not accept this issue as a valid security vulnerability and has confirmed that they will not be addressing it.
published:2025-03-09T20:15:27.157


Instruction: Please provide detailed information about CVE-2025-26204

CVE:CVE-2025-26204
Description:Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
published:2025-03-09T21:15:35.310


Instruction: Please provide detailed information about CVE-2025-26205

CVE:CVE-2025-26205
Description:Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
published:2025-03-09T21:15:35.457


Instruction: Please provide detailed information about CVE-2025-2130

CVE:CVE-2025-2130
Description:A vulnerability was found in OpenXE up to 1.12. It has been declared as problematic. This vulnerability affects unknown code of the component Ticket Bearbeiten Page. The manipulation of the argument Notizen leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-09T22:15:12.253


Instruction: Please provide detailed information about CVE-2025-2131

CVE:CVE-2025-2131
Description:A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. It has been rated as problematic. This issue affects some unknown processing of the component Friendly Links Handler. The manipulation of the argument Website Address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-09T23:15:34.397


Instruction: Please provide detailed information about CVE-2025-2132

CVE:CVE-2025-2132
Description:A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajax_all_lists of the component Search. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-09T23:15:34.580


Instruction: Please provide detailed information about CVE-2025-2133

CVE:CVE-2025-2133
Description:A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/edit. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-10T00:15:11.040


Instruction: Please provide detailed information about CVE-2025-1926

CVE:CVE-2025-1926
Description:The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayer_save_post function. This makes it possible for unauthenticated attackers to modify post contents via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-03-10T05:15:35.347


Instruction: Please provide detailed information about CVE-2025-2150

CVE:CVE-2025-2150
Description:The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malicious JavaScript code, which will be executed in the recipient's browser when they view the email.
published:2025-03-10T08:15:11.917


Instruction: Please provide detailed information about CVE-2025-27253

CVE:CVE-2025-27253
Description:An improper input validation in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that enstablishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network
published:2025-03-10T09:15:10.897


Instruction: Please provide detailed information about CVE-2025-27254

CVE:CVE-2025-27254
Description:Improper Authentication vulnerability in GE Vernova EnerVista UR Setup allows Authentication Bypass.  The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.
published:2025-03-10T09:15:11.167


Instruction: Please provide detailed information about CVE-2025-27255

CVE:CVE-2025-27255
Description:Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcoded password retrievable by an attacker analyzing the application code.
published:2025-03-10T09:15:11.323


Instruction: Please provide detailed information about CVE-2025-27256

CVE:CVE-2025-27256
Description:Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH server authentication. Since the client connection is not authenticated, an attacker may perform a man-in-the-middle attack on the network.
published:2025-03-10T09:15:11.463


Instruction: Please provide detailed information about CVE-2025-27257

CVE:CVE-2025-27257
Description:Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.
published:2025-03-10T09:15:11.613


Instruction: Please provide detailed information about CVE-2025-24387

CVE:CVE-2025-24387
Description:A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive  cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation.    This issue affects:    *  OTRS 7.0.X   *  OTRS 8.0.X   *  OTRS 2023.X   *  OTRS 2024.X   *  OTRS 2025.x
published:2025-03-10T10:15:14.360


Instruction: Please provide detailed information about CVE-2025-2147

CVE:CVE-2025-2147
Description:A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-10T11:15:38.157


Instruction: Please provide detailed information about CVE-2025-1944

CVE:CVE-2025-1944
Description:picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.
published:2025-03-10T12:15:10.967


Instruction: Please provide detailed information about CVE-2025-1945

CVE:CVE-2025-1945
Description:picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.
published:2025-03-10T12:15:12.450


Instruction: Please provide detailed information about CVE-2025-2148

CVE:CVE-2025-2148
Description:A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.
published:2025-03-10T12:15:12.617


Instruction: Please provide detailed information about CVE-2025-2149

CVE:CVE-2025-2149
Description:A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initialization. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
published:2025-03-10T13:15:36.290


Instruction: Please provide detailed information about CVE-2025-2151

CVE:CVE-2025-2151
Description:A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-10T13:15:36.497


Instruction: Please provide detailed information about CVE-2025-1497

CVE:CVE-2025-1497
Description:A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability.
published:2025-03-10T14:15:24.723


Instruction: Please provide detailed information about CVE-2025-25615

CVE:CVE-2025-25615
Description:Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.
published:2025-03-10T14:15:24.960


Instruction: Please provide detailed information about CVE-2025-25616

CVE:CVE-2025-25616
Description:Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam_rule_id=1.
published:2025-03-10T14:15:25.097


Instruction: Please provide detailed information about CVE-2025-26865

CVE:CVE-2025-26865
Description:Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.  This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.    It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used.  In other words, if you use 18.12.17 you are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is.  In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.
published:2025-03-10T14:15:25.220


Instruction: Please provide detailed information about CVE-2025-2152

CVE:CVE-2025-2152
Description:A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-10T14:15:26.543


Instruction: Please provide detailed information about CVE-2025-2153

CVE:CVE-2025-2153
Description:A vulnerability, which was classified as critical, was found in HDF5 1.14.6. Affected is the function H5SM_delete of the file H5SM.c of the component h5 File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
published:2025-03-10T14:15:26.737


Instruction: Please provide detailed information about CVE-2025-25614

CVE:CVE-2025-25614
Description:Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.
published:2025-03-10T15:15:37.330


Instruction: Please provide detailed information about CVE-2025-25620

CVE:CVE-2025-25620
Description:Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
published:2025-03-10T15:15:37.490


Instruction: Please provide detailed information about CVE-2025-26910

CVE:CVE-2025-26910
Description:Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit allows Stored XSS. This issue affects WPBookit: from n/a through 1.0.1.
published:2025-03-10T15:15:37.660


Instruction: Please provide detailed information about CVE-2025-26916

CVE:CVE-2025-26916
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in EPC Massive Dynamic. This issue affects Massive Dynamic: from n/a through 8.2.
published:2025-03-10T15:15:37.830


Instruction: Please provide detailed information about CVE-2025-26933

CVE:CVE-2025-26933
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment allows PHP Local File Inclusion. This issue affects WC Place Order Without Payment: from n/a through 2.6.7.
published:2025-03-10T15:15:37.997


Instruction: Please provide detailed information about CVE-2025-26936

CVE:CVE-2025-26936
Description:Improper Control of Generation of Code ('Code Injection') vulnerability in NotFound Fresh Framework allows Code Injection. This issue affects Fresh Framework: from n/a through 1.70.0.
published:2025-03-10T15:15:38.177


Instruction: Please provide detailed information about CVE-2025-25382

CVE:CVE-2025-25382
Description:An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amounts via a crafted request.
published:2025-03-10T16:15:13.393


Instruction: Please provide detailed information about CVE-2025-25940

CVE:CVE-2025-25940
Description:VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.
published:2025-03-10T16:15:13.520


Instruction: Please provide detailed information about CVE-2025-25977

CVE:CVE-2025-25977
Description:An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
published:2025-03-10T16:15:13.633


Instruction: Please provide detailed information about CVE-2025-24813

CVE:CVE-2025-24813
Description:Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.  This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.  If all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT  If all of the following were true, a malicious user was able to       perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack  Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
published:2025-03-10T17:15:35.067


Instruction: Please provide detailed information about CVE-2025-1296

CVE:CVE-2025-1296
Description:Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
published:2025-03-10T18:15:30.237


Instruction: Please provide detailed information about CVE-2025-22603

CVE:CVE-2025-22603
Description:AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior to autogpt-platform-beta-v0.4.2 contains a server-side request forgery (SSRF) vulnerability inside component (or block) `Send Web Request`. The root cause is  that IPV6 address is not restricted or filtered, which allows attackers to perform a server side request forgery to visit an IPV6 service. autogpt-platform-beta-v0.4.2 fixes the issue.
published:2025-03-10T19:15:39.970


Instruction: Please provide detailed information about CVE-2025-25306

CVE:CVE-2025-25306
Description:Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url` fields of ActivityPub objects. An attacker can forge an object where they claim authority in the `url` field even if the specific ActivityPub object type require authority in the `id` field. Version 2025.2.1 addresses the issue.
published:2025-03-10T19:15:40.230


Instruction: Please provide detailed information about CVE-2025-26695

CVE:CVE-2025-26695
Description:When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability affects Thunderbird < 136 and Thunderbird < 128.8.
published:2025-03-10T19:15:40.567


Instruction: Please provide detailed information about CVE-2025-26696

CVE:CVE-2025-26696
Description:Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability affects Thunderbird < 136 and Thunderbird < 128.8.
published:2025-03-10T19:15:40.670


Instruction: Please provide detailed information about CVE-2025-27136

CVE:CVE-2025-27136
Description:LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare an external entity that references an internal URL, which the server will then attempt to fetch when parsing the XML. The vulnerability specifically occurs in the location constraint processing, where the XML parser resolves external entities without proper validation or restrictions. When the external entity is resolved, the server makes an HTTP request to the specified URL and includes the response content in the parsed XML document. This vulnerability can be exploited to perform server-side request forgery (SSRF) attacks, allowing an attacker to make requests to internal services or resources that should not be accessible from external networks. The server will include the responses from these internal requests in the resulting bucket configuration, effectively leaking sensitive information. The attacker only needs to be able to send HTTP requests to the LocalS3 service to exploit this vulnerability.
published:2025-03-10T19:15:40.770


Instruction: Please provide detailed information about CVE-2025-27615

CVE:CVE-2025-27615
Description:umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit 5d81a3412bc0051754a3095d89a06d6d743f2b16 uses `127.0.0.1:8080:8080` to limit access to the local network. For those who are unable to use this proposed patch, a firewall on Port 8080 may block remote access, but the workaround may not be perfect because Docker may also bypass a firewall by its iptable based rules for port forwarding.
published:2025-03-10T19:15:40.917


Instruction: Please provide detailed information about CVE-2025-27616

CVE:CVE-2025-27616
Description:Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available.
published:2025-03-10T19:15:41.080


Instruction: Please provide detailed information about CVE-2025-27913

CVE:CVE-2025-27913
Description:Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
published:2025-03-10T20:15:14.500


Instruction: Please provide detailed information about CVE-2025-0660

CVE:CVE-2025-0660
Description:Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names.  The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Versions below 9 are not affected. Thanks, Alfin Joseph for reporting.
published:2025-03-10T21:15:40.110


Instruction: Please provide detailed information about CVE-2025-1920

CVE:CVE-2025-1920
Description:Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
published:2025-03-10T21:15:40.280


Instruction: Please provide detailed information about CVE-2025-2135

CVE:CVE-2025-2135
Description:Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
published:2025-03-10T21:15:40.613


Instruction: Please provide detailed information about CVE-2025-2136

CVE:CVE-2025-2136
Description:Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
published:2025-03-10T21:15:40.730


Instruction: Please provide detailed information about CVE-2025-2137

CVE:CVE-2025-2137
Description:Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
published:2025-03-10T21:15:40.857


Instruction: Please provide detailed information about CVE-2025-25907

CVE:CVE-2025-25907
Description:tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.
published:2025-03-10T22:15:26.533


Instruction: Please provide detailed information about CVE-2025-25908

CVE:CVE-2025-25908
Description:A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save.
published:2025-03-10T22:15:27.150


Instruction: Please provide detailed information about CVE-2025-27910

CVE:CVE-2025-27910
Description:tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.
published:2025-03-10T22:15:27.287


Instruction: Please provide detailed information about CVE-2025-27610

CVE:CVE-2025-27610
Description:Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of `Rack::Static`, or ensuring that `root:` points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue.
published:2025-03-10T23:15:35.073


Instruction: Please provide detailed information about CVE-2025-27924

CVE:CVE-2025-27924
Description:Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.
published:2025-03-10T23:15:35.280


Instruction: Please provide detailed information about CVE-2025-27925

CVE:CVE-2025-27925
Description:Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.
published:2025-03-10T23:15:35.473


Instruction: Please provide detailed information about CVE-2025-27926

CVE:CVE-2025-27926
Description:In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.
published:2025-03-10T23:15:35.670


Instruction: Please provide detailed information about CVE-2025-1828

CVE:CVE-2025-1828
Description:Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions.  If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Random will default to use the insecure Crypt::Random::rand provider.  In particular, Windows versions of perl will encounter this issue by default.
published:2025-03-11T00:15:11.060


Instruction: Please provide detailed information about CVE-2025-0062

CVE:CVE-2025-0062
Description:SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impact on confidentiality and integrity within the scope of victim�s browser. There is no impact on availability. This vulnerability occurs only when script/html execution is enabled by the administrator in Central Management Console.
published:2025-03-11T01:15:33.740


Instruction: Please provide detailed information about CVE-2025-0071

CVE:CVE-2025-0071
Description:SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impact on integrity or availability.
published:2025-03-11T01:15:33.917


Instruction: Please provide detailed information about CVE-2025-23185

CVE:CVE-2025-23185
Description:Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privileges has access to this disclosed information, and they could use it to craft further exploits. There is no impact on the integrity and availability of the application.
published:2025-03-11T01:15:34.330


Instruction: Please provide detailed information about CVE-2025-23188

CVE:CVE-2025-23188
Description:An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions beyond their intended permissions. This causes a low impact on integrity with no impact on confidentiality and availability.
published:2025-03-11T01:15:34.480


Instruction: Please provide detailed information about CVE-2025-23194

CVE:CVE-2025-23194
Description:SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user can set it to an undesired value causing low impact on integrity. There is no impact on confidentiality or availability of the application.
published:2025-03-11T01:15:34.630


Instruction: Please provide detailed information about CVE-2025-25242

CVE:CVE-2025-25242
Description:SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.
published:2025-03-11T01:15:34.777


Instruction: Please provide detailed information about CVE-2025-25244

CVE:CVE-2025-25244
Description:SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results in business reporting leading to a significant impact on integrity. However, there is no impact on confidentiality or availability.
published:2025-03-11T01:15:34.927


Instruction: Please provide detailed information about CVE-2025-25245

CVE:CVE-2025-25245
Description:SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a limited impact on confidentiality and integrity within the scope of victim�s browser. There is no impact on availability.
published:2025-03-11T01:15:35.080


Instruction: Please provide detailed information about CVE-2025-26655

CVE:CVE-2025-26655
Description:SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted.
published:2025-03-11T01:15:35.230


Instruction: Please provide detailed information about CVE-2025-26656

CVE:CVE-2025-26656
Description:OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on integrity of the application.
published:2025-03-11T01:15:35.383


Instruction: Please provide detailed information about CVE-2025-26658

CVE:CVE-2025-26658
Description:The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify and/or write new data. To gain authenticated sessions of other users, the attacker must invest considerable time and effort. This vulnerability has a high impact on the confidentiality and integrity of the application with no effect on the availability of the application.
published:2025-03-11T01:15:35.533


Instruction: Please provide detailed information about CVE-2025-26659

CVE:CVE-2025-26659
Description:SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability
published:2025-03-11T01:15:35.683


Instruction: Please provide detailed information about CVE-2025-26660

CVE:CVE-2025-26660
Description:SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted.
published:2025-03-11T01:15:35.837


Instruction: Please provide detailed information about CVE-2025-26661

CVE:CVE-2025-26661
Description:Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high impact on the integrity and availability of the application.
published:2025-03-11T01:15:35.993


Instruction: Please provide detailed information about CVE-2025-27430

CVE:CVE-2025-27430
Description:Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application's confidentiality. There is no impact on integrity or availability
published:2025-03-11T01:15:36.157


Instruction: Please provide detailed information about CVE-2025-27431

CVE:CVE-2025-27431
Description:User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS). This could enable an attacker to inject malicious payload that gets stored and executed when a user accesses the functionality, hence leading to information disclosure or unauthorized data modifications within the scope of victim�s browser. There is no impact on availability.
published:2025-03-11T01:15:36.310


Instruction: Please provide detailed information about CVE-2025-27432

CVE:CVE-2025-27432
Description:The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized access to each transaction. By executing the specific ABAP method within the ABAP system, an unauthorized attacker could call each transaction and view the inbound delivery details. This vulnerability has a low impact on the confidentiality with no effect on the integrity and the availability of the application.
published:2025-03-11T01:15:36.467


Instruction: Please provide detailed information about CVE-2025-27433

CVE:CVE-2025-27433
Description:The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's integrity, with no effect on confidentiality and availability of the application.
published:2025-03-11T01:15:36.607


Instruction: Please provide detailed information about CVE-2025-27434

CVE:CVE-2025-27434
Description:Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce.
published:2025-03-11T01:15:36.760


Instruction: Please provide detailed information about CVE-2025-27436

CVE:CVE-2025-27436
Description:The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact with a resource is legitimate, allowing the attacker to delete the attachment of a posted bank statement. This leads to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application.
published:2025-03-11T01:15:36.920


Instruction: Please provide detailed information about CVE-2025-1661

CVE:CVE-2025-1661
Description:The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
published:2025-03-11T04:15:24.803


Instruction: Please provide detailed information about CVE-2025-26707

CVE:CVE-2025-26707
Description:Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
published:2025-03-11T04:15:25.093


Instruction: Please provide detailed information about CVE-2025-2169

CVE:CVE-2025-2169
Description:The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
published:2025-03-11T04:15:25.330


Instruction: Please provide detailed information about CVE-2024-13413

CVE:CVE-2024-13413
Description:The ProductDyno plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘res’ parameter in all versions up to, and including, 1.0.24 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is potentially a duplicate of CVE-2025-22320.
published:2025-03-11T05:15:37.083


Instruction: Please provide detailed information about CVE-2025-0629

CVE:CVE-2025-0629
Description:The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-11T06:15:26.513


Instruction: Please provide detailed information about CVE-2025-26702

CVE:CVE-2025-26702
Description:Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.
published:2025-03-11T07:15:34.133


Instruction: Please provide detailed information about CVE-2025-26703

CVE:CVE-2025-26703
Description:Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04.
published:2025-03-11T07:15:34.580


Instruction: Please provide detailed information about CVE-2025-26704

CVE:CVE-2025-26704
Description:Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
published:2025-03-11T07:15:34.967


Instruction: Please provide detailed information about CVE-2025-26705

CVE:CVE-2025-26705
Description:Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05.
published:2025-03-11T07:15:35.330


Instruction: Please provide detailed information about CVE-2025-26706

CVE:CVE-2025-26706
Description:Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07.
published:2025-03-11T07:15:35.703


Instruction: Please provide detailed information about CVE-2025-2173

CVE:CVE-2025-2173
Description:A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
published:2025-03-11T07:15:36.057


Instruction: Please provide detailed information about CVE-2025-2174

CVE:CVE-2025-2174
Description:A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
published:2025-03-11T07:15:36.887


Instruction: Please provide detailed information about CVE-2025-2175

CVE:CVE-2025-2175
Description:A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
published:2025-03-11T07:15:37.440


Instruction: Please provide detailed information about CVE-2025-2190

CVE:CVE-2025-2190
Description:The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks.
published:2025-03-11T07:15:37.950


Instruction: Please provide detailed information about CVE-2025-1434

CVE:CVE-2025-1434
Description:The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. Disclosure of secrets or other system settings is not affected as well as other spreadsheets still work as expected.
published:2025-03-11T08:15:11.207


Instruction: Please provide detailed information about CVE-2025-27911

CVE:CVE-2025-27911
Description:An issue was discovered in Datalust Seq before 2024.3.13545. Expansion of identifiers in message templates can be used to bypass the system "Event body limit bytes" setting, leading to increased resource consumption. With sufficiently large events, there can be disk space exhaustion (if saved to disk) or a termination of the server process with an out-of-memory error.
published:2025-03-11T08:15:11.500


Instruction: Please provide detailed information about CVE-2025-27912

CVE:CVE-2025-27912
Description:An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when (1) Entra ID or OpenID Connect authentication is in use and a user visits a compromised/malicious site, or (2) when username/password or Active Directory authentication is in use and a user visits a compromised/malicious site under the same effective top-level domain as the Seq server. Exploitation of the vulnerability allows the attacker to conduct impersonation attacks and perform actions in Seq on behalf of the targeted user.
published:2025-03-11T08:15:11.727


Instruction: Please provide detailed information about CVE-2025-2176

CVE:CVE-2025-2176
Description:A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
published:2025-03-11T08:15:12.090


Instruction: Please provide detailed information about CVE-2025-2177

CVE:CVE-2025-2177
Description:A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional.
published:2025-03-11T08:15:12.297


Instruction: Please provide detailed information about CVE-2025-1550

CVE:CVE-2025-1550
Description:The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
published:2025-03-11T09:15:25.217


Instruction: Please provide detailed information about CVE-2025-27893

CVE:CVE-2025-27893
Description:In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. This enables unauthorized modification of system-generated metadata, compromising data integrity and potentially impacting auditing, compliance, and security controls.
published:2025-03-11T09:15:25.457


Instruction: Please provide detailed information about CVE-2025-23384

CVE:CVE-2025-23384
Description:A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.2.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.2.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.2.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.2.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.2.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.2.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.2.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.2.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.2.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.2.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.2.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.2.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.2.1), SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1) (All versions < V8.2.1), SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1) (All versions < V8.2.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.2.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.2.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.2.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.2.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.2.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.2.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.2.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.2.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.2.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.2.1), SCALANCE SC-600 family (All versions). Affected devices improperly validate usernames during OpenVPN authentication. This could allow an attacker to get partial invalid usernames accepted by the server.
published:2025-03-11T10:15:16.330


Instruction: Please provide detailed information about CVE-2025-23396

CVE:CVE-2025-23396
Description:A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected applications contain an out of bounds write vulnerability when parsing a specially crafted WRL file.
 This could allow an attacker to execute code in the context of the current process.
published:2025-03-11T10:15:16.670


Instruction: Please provide detailed information about CVE-2025-23397

CVE:CVE-2025-23397
Description:A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.
published:2025-03-11T10:15:16.840


Instruction: Please provide detailed information about CVE-2025-23398

CVE:CVE-2025-23398
Description:A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.
published:2025-03-11T10:15:17.003


Instruction: Please provide detailed information about CVE-2025-23399

CVE:CVE-2025-23399
Description:A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files.
 This could allow an attacker to execute code in the context of the current process.
published:2025-03-11T10:15:17.170


Instruction: Please provide detailed information about CVE-2025-23400

CVE:CVE-2025-23400
Description:A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.
published:2025-03-11T10:15:17.340


Instruction: Please provide detailed information about CVE-2025-23401

CVE:CVE-2025-23401
Description:A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files.
 This could allow an attacker to execute code in the context of the current process.
published:2025-03-11T10:15:17.510


Instruction: Please provide detailed information about CVE-2025-23402

CVE:CVE-2025-23402
Description:A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted WRL files.
 An attacker could leverage this vulnerability to execute code in the context of the current process.
published:2025-03-11T10:15:17.680


Instruction: Please provide detailed information about CVE-2025-25266

CVE:CVE-2025-25266
Description:A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict access to the file deletion functionality.
 This could allow an unauthorized attacker to delete files even when access to the system should be prohibited, resulting in potential data loss or unauthorized modification of system files.
published:2025-03-11T10:15:17.850


Instruction: Please provide detailed information about CVE-2025-25267

CVE:CVE-2025-25267
Description:A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict the scope of files accessible to the simulation model. This could allow an unauthorized attacker to compromise the confidentiality of the system.
published:2025-03-11T10:15:18.030


Instruction: Please provide detailed information about CVE-2025-27392

CVE:CVE-2025-27392
Description:A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when creating new VXLAN configurations.
 This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device.
published:2025-03-11T10:15:18.203


Instruction: Please provide detailed information about CVE-2025-27393

CVE:CVE-2025-27393
Description:A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when creating new users.
 This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device.
published:2025-03-11T10:15:18.367


Instruction: Please provide detailed information about CVE-2025-27394

CVE:CVE-2025-27394
Description:A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when creating new SNMP users.
 This could allow an authenticated highly-privileged remote attacker to execute arbitrary code on the device.
published:2025-03-11T10:15:18.530


Instruction: Please provide detailed information about CVE-2025-27395

CVE:CVE-2025-27395
Description:A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit the scope of files accessible through and the privileges of the SFTP functionality.
 This could allow an authenticated highly-privileged remote attacker to read and write arbitrary files.
published:2025-03-11T10:15:18.700


Instruction: Please provide detailed information about CVE-2025-27396

CVE:CVE-2025-27396
Description:A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit the elevation of privileges required to perform certain valid functionality.
 This could allow an authenticated lowly-privileged remote attacker to escalate their privileges.
published:2025-03-11T10:15:18.913


Instruction: Please provide detailed information about CVE-2025-27397

CVE:CVE-2025-27397
Description:A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit user controlled paths to which logs are written and from where they are read.
 This could allow an authenticated highly-privileged remote attacker to read and write arbitrary files in the filesystem, if and only if the malicious path ends with 'log' .
published:2025-03-11T10:15:19.083


Instruction: Please provide detailed information about CVE-2025-27398

CVE:CVE-2025-27398
Description:A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly neutralize special characters when interpreting user controlled log paths.
 This could allow an authenticated highly-privileged remote attacker to execute a limited set of binaries that are already present on the filesystem.
published:2025-03-11T10:15:19.247


Instruction: Please provide detailed information about CVE-2025-27438

CVE:CVE-2025-27438
Description:A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files.
 This could allow an attacker to execute code in the context of the current process.
published:2025-03-11T10:15:19.407


Instruction: Please provide detailed information about CVE-2025-27493

CVE:CVE-2025-27493
Description:A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize user input for specific commands on the telnet command line interface. This could allow an authenticated local administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.
published:2025-03-11T10:15:19.577


Instruction: Please provide detailed information about CVE-2025-27494

CVE:CVE-2025-27494
Description:A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.
published:2025-03-11T10:15:19.783


Instruction: Please provide detailed information about CVE-2025-2189

CVE:CVE-2025-2189
Description:This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable device.
published:2025-03-11T12:15:12.057


Instruction: Please provide detailed information about CVE-2025-2191

CVE:CVE-2025-2191
Description:A vulnerability, which was classified as problematic, has been found in Claro A7600-A1 RNR4-A72T-2x16_v2110403_CLA_32_160817. Affected by this issue is some unknown functionality of the file /form2pingv6.cgi of the component Ping6 Diagnóstico. The manipulation of the argument ip6addr with the input <img/src/onerror=prompt(8)> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T12:15:12.277


Instruction: Please provide detailed information about CVE-2025-2192

CVE:CVE-2025-2192
Description:A vulnerability, which was classified as problematic, was found in Stoque Zeev.it 4.24. This affects an unknown part of the file /Login?inpLostSession=1 of the component Login Page. The manipulation of the argument inpRedirectURL leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T13:15:43.780


Instruction: Please provide detailed information about CVE-2025-2193

CVE:CVE-2025-2193
Description:A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path/name leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T13:15:43.997


Instruction: Please provide detailed information about CVE-2025-22366

CVE:CVE-2025-22366
Description:The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS.
published:2025-03-11T14:15:24.313


Instruction: Please provide detailed information about CVE-2025-22367

CVE:CVE-2025-22367
Description:The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS.
published:2025-03-11T14:15:24.480


Instruction: Please provide detailed information about CVE-2025-22368

CVE:CVE-2025-22368
Description:The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are improperly neutralized when certain fields are passed to the underlying OS.
published:2025-03-11T14:15:24.627


Instruction: Please provide detailed information about CVE-2025-22369

CVE:CVE-2025-22369
Description:The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS.
published:2025-03-11T14:15:24.767


Instruction: Please provide detailed information about CVE-2025-22370

CVE:CVE-2025-22370
Description:Many fields for the web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to execute arbitrary SQL commands because the values are insufficiently neutralized.
published:2025-03-11T14:15:24.917


Instruction: Please provide detailed information about CVE-2025-27363

CVE:CVE-2025-27363
Description:An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
published:2025-03-11T14:15:25.427


Instruction: Please provide detailed information about CVE-2025-2194

CVE:CVE-2025-2194
Description:A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects the function list of the file /admin/file/list.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T14:15:27.753


Instruction: Please provide detailed information about CVE-2025-2195

CVE:CVE-2025-2195
Description:A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is the function rename of the file /admin/file/rename.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument name/path leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T14:15:27.937


Instruction: Please provide detailed information about CVE-2025-2196

CVE:CVE-2025-2196
Description:A vulnerability was found in MRCMS 3.1.2. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /admin/file/upload.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-11T14:15:28.123


Instruction: Please provide detailed information about CVE-2025-22454

CVE:CVE-2025-22454
Description:Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
published:2025-03-11T15:15:44.737


Instruction: Please provide detailed information about CVE-2025-27403

CVE:CVE-2025-27403
Description:Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment only those that comply with policies the user creates. In a Kubernetes environment, Ratify can be configured to authenticate to a private Azure Container Registry (ACR). The Azure workload identity and Azure managed identity authentication providers are configured in this setup. Users that configure a private ACR to be used with the Azure authentication providers may be impacted by a vulnerability that exists in versions prior to 1.2.3 and 1.3.2. Both Azure authentication providers attempt to exchange an Entra ID (EID) token for an ACR refresh token. However, Ratify’s Azure authentication providers did not verify that the target registry is an ACR. This could have led to the EID token being presented to a non-ACR registry during token exchange. EID tokens with ACR access can potentially be extracted and abused if a user workload contains an image reference to a malicious registry. As of versions 1.2.3 and 1.3.2, the Azure workload identity and Azure managed identity authentication providers are updated to add new validation prior to EID token exchange. Validation relies upon registry domain validation against a pre-configured list of well-known ACR endpoints. EID token exchange will be executed only if at least one of the configured well-known domain suffixes (wildcard support included) matches the registry domain of the image reference.
published:2025-03-11T15:15:45.570


Instruction: Please provide detailed information about CVE-2025-25680

CVE:CVE-2025-25680
Description:LSC Smart Connect LSC Indoor PTZ Camera 7.6.32 is contains a RCE vulnerability in the tuya_ipc_direct_connect function of the anyka_ipc process. The vulnerability allows arbitrary code execution through the Wi-Fi configuration process when a specially crafted QR code is presented to the camera.
published:2025-03-11T16:15:17.413


Instruction: Please provide detailed information about CVE-2025-25747

CVE:CVE-2025-25747
Description:Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristina_backup parameter in the crea_backup.php endpoint
published:2025-03-11T16:15:17.547


Instruction: Please provide detailed information about CVE-2025-27601

CVE:CVE-2025-27601
Description:Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. The issue is patched in versions 15.2.3 and 14.3.3. No known workarounds are available.
published:2025-03-11T16:15:17.943


Instruction: Please provide detailed information about CVE-2025-27602

CVE:CVE-2025-27602
Description:Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. The issue is patched in versions 10.8.9 and 13.7.1. No known workarounds are available.
published:2025-03-11T16:15:18.100


Instruction: Please provide detailed information about CVE-2025-27617

CVE:CVE-2025-27617
Description:Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue.
published:2025-03-11T16:15:18.310


Instruction: Please provide detailed information about CVE-2025-0149

CVE:CVE-2025-0149
Description:Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.
published:2025-03-11T17:16:17.523


Instruction: Please provide detailed information about CVE-2025-21169

CVE:CVE-2025-21169
Description:Substance3D - Designer versions 14.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T17:16:18.423


Instruction: Please provide detailed information about CVE-2025-21180

CVE:CVE-2025-21180
Description:Heap-based buffer overflow in Windows exFAT File System allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:18.790


Instruction: Please provide detailed information about CVE-2025-21199

CVE:CVE-2025-21199
Description:Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:19.670


Instruction: Please provide detailed information about CVE-2025-21247

CVE:CVE-2025-21247
Description:Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
published:2025-03-11T17:16:20.400


Instruction: Please provide detailed information about CVE-2025-22213

CVE:CVE-2025-22213
Description:Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.
published:2025-03-11T17:16:24.577


Instruction: Please provide detailed information about CVE-2025-24035

CVE:CVE-2025-24035
Description:Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
published:2025-03-11T17:16:25.373


Instruction: Please provide detailed information about CVE-2025-24043

CVE:CVE-2025-24043
Description:Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network.
published:2025-03-11T17:16:25.897


Instruction: Please provide detailed information about CVE-2025-24044

CVE:CVE-2025-24044
Description:Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:26.093


Instruction: Please provide detailed information about CVE-2025-24045

CVE:CVE-2025-24045
Description:Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
published:2025-03-11T17:16:26.290


Instruction: Please provide detailed information about CVE-2025-24046

CVE:CVE-2025-24046
Description:Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:26.503


Instruction: Please provide detailed information about CVE-2025-24048

CVE:CVE-2025-24048
Description:Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:26.703


Instruction: Please provide detailed information about CVE-2025-24049

CVE:CVE-2025-24049
Description:Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to elevate privileges locally.
published:2025-03-11T17:16:26.907


Instruction: Please provide detailed information about CVE-2025-24050

CVE:CVE-2025-24050
Description:Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:27.273


Instruction: Please provide detailed information about CVE-2025-24051

CVE:CVE-2025-24051
Description:Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
published:2025-03-11T17:16:27.467


Instruction: Please provide detailed information about CVE-2025-24054

CVE:CVE-2025-24054
Description:External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
published:2025-03-11T17:16:27.660


Instruction: Please provide detailed information about CVE-2025-24055

CVE:CVE-2025-24055
Description:Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack.
published:2025-03-11T17:16:27.887


Instruction: Please provide detailed information about CVE-2025-24056

CVE:CVE-2025-24056
Description:Heap-based buffer overflow in Windows Telephony Server allows an unauthorized attacker to execute code over a network.
published:2025-03-11T17:16:28.130


Instruction: Please provide detailed information about CVE-2025-24057

CVE:CVE-2025-24057
Description:Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:28.390


Instruction: Please provide detailed information about CVE-2025-24059

CVE:CVE-2025-24059
Description:Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:28.593


Instruction: Please provide detailed information about CVE-2025-24061

CVE:CVE-2025-24061
Description:Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally.
published:2025-03-11T17:16:28.800


Instruction: Please provide detailed information about CVE-2025-24064

CVE:CVE-2025-24064
Description:Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
published:2025-03-11T17:16:29.007


Instruction: Please provide detailed information about CVE-2025-24066

CVE:CVE-2025-24066
Description:Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:29.223


Instruction: Please provide detailed information about CVE-2025-24067

CVE:CVE-2025-24067
Description:Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:29.477


Instruction: Please provide detailed information about CVE-2025-24070

CVE:CVE-2025-24070
Description:Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.
published:2025-03-11T17:16:29.680


Instruction: Please provide detailed information about CVE-2025-24071

CVE:CVE-2025-24071
Description:Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
published:2025-03-11T17:16:29.867


Instruction: Please provide detailed information about CVE-2025-24072

CVE:CVE-2025-24072
Description:Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:30.070


Instruction: Please provide detailed information about CVE-2025-24075

CVE:CVE-2025-24075
Description:Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:30.270


Instruction: Please provide detailed information about CVE-2025-24076

CVE:CVE-2025-24076
Description:Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:30.480


Instruction: Please provide detailed information about CVE-2025-24077

CVE:CVE-2025-24077
Description:Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:30.657


Instruction: Please provide detailed information about CVE-2025-24078

CVE:CVE-2025-24078
Description:Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:30.863


Instruction: Please provide detailed information about CVE-2025-24079

CVE:CVE-2025-24079
Description:Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:31.100


Instruction: Please provide detailed information about CVE-2025-24080

CVE:CVE-2025-24080
Description:Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:31.323


Instruction: Please provide detailed information about CVE-2025-24081

CVE:CVE-2025-24081
Description:Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:32.533


Instruction: Please provide detailed information about CVE-2025-24082

CVE:CVE-2025-24082
Description:Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:33.087


Instruction: Please provide detailed information about CVE-2025-24083

CVE:CVE-2025-24083
Description:Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:33.310


Instruction: Please provide detailed information about CVE-2025-24084

CVE:CVE-2025-24084
Description:Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:33.523


Instruction: Please provide detailed information about CVE-2025-24983

CVE:CVE-2025-24983
Description:Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:33.890


Instruction: Please provide detailed information about CVE-2025-24984

CVE:CVE-2025-24984
Description:Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
published:2025-03-11T17:16:34.090


Instruction: Please provide detailed information about CVE-2025-24985

CVE:CVE-2025-24985
Description:Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:34.303


Instruction: Please provide detailed information about CVE-2025-24986

CVE:CVE-2025-24986
Description:Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.
published:2025-03-11T17:16:34.563


Instruction: Please provide detailed information about CVE-2025-24987

CVE:CVE-2025-24987
Description:Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
published:2025-03-11T17:16:34.767


Instruction: Please provide detailed information about CVE-2025-24988

CVE:CVE-2025-24988
Description:Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
published:2025-03-11T17:16:35.013


Instruction: Please provide detailed information about CVE-2025-24991

CVE:CVE-2025-24991
Description:Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
published:2025-03-11T17:16:35.297


Instruction: Please provide detailed information about CVE-2025-24992

CVE:CVE-2025-24992
Description:Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally.
published:2025-03-11T17:16:35.523


Instruction: Please provide detailed information about CVE-2025-24993

CVE:CVE-2025-24993
Description:Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:35.797


Instruction: Please provide detailed information about CVE-2025-24994

CVE:CVE-2025-24994
Description:Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:36.150


Instruction: Please provide detailed information about CVE-2025-24995

CVE:CVE-2025-24995
Description:Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:36.490


Instruction: Please provide detailed information about CVE-2025-24996

CVE:CVE-2025-24996
Description:External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
published:2025-03-11T17:16:36.803


Instruction: Please provide detailed information about CVE-2025-24997

CVE:CVE-2025-24997
Description:Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally.
published:2025-03-11T17:16:37.103


Instruction: Please provide detailed information about CVE-2025-24998

CVE:CVE-2025-24998
Description:Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:37.670


Instruction: Please provide detailed information about CVE-2025-25003

CVE:CVE-2025-25003
Description:Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:38.043


Instruction: Please provide detailed information about CVE-2025-25008

CVE:CVE-2025-25008
Description:Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:38.483


Instruction: Please provide detailed information about CVE-2025-26627

CVE:CVE-2025-26627
Description:Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:38.930


Instruction: Please provide detailed information about CVE-2025-26629

CVE:CVE-2025-26629
Description:Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:39.537


Instruction: Please provide detailed information about CVE-2025-26630

CVE:CVE-2025-26630
Description:Use after free in Microsoft Office Access allows an unauthorized attacker to execute code locally.
published:2025-03-11T17:16:42.820


Instruction: Please provide detailed information about CVE-2025-26631

CVE:CVE-2025-26631
Description:Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
published:2025-03-11T17:16:43.110


Instruction: Please provide detailed information about CVE-2025-26633

CVE:CVE-2025-26633
Description:Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
published:2025-03-11T17:16:43.390


Instruction: Please provide detailed information about CVE-2025-26634

CVE:CVE-2025-26634
Description:Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges over a network.
published:2025-03-11T17:16:43.743


Instruction: Please provide detailed information about CVE-2025-26645

CVE:CVE-2025-26645
Description:Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
published:2025-03-11T17:16:44.200


Instruction: Please provide detailed information about CVE-2025-27172

CVE:CVE-2025-27172
Description:Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T17:16:44.420


Instruction: Please provide detailed information about CVE-2025-0150

CVE:CVE-2025-0150
Description:Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access.
published:2025-03-11T18:15:29.800


Instruction: Please provide detailed information about CVE-2025-0151

CVE:CVE-2025-0151
Description:Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
published:2025-03-11T18:15:29.940


Instruction: Please provide detailed information about CVE-2025-24201

CVE:CVE-2025-24201
Description:An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).
published:2025-03-11T18:15:30.190


Instruction: Please provide detailed information about CVE-2025-24431

CVE:CVE-2025-24431
Description:Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:30.277


Instruction: Please provide detailed information about CVE-2025-24439

CVE:CVE-2025-24439
Description:Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:30.437


Instruction: Please provide detailed information about CVE-2025-24440

CVE:CVE-2025-24440
Description:Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:30.603


Instruction: Please provide detailed information about CVE-2025-24441

CVE:CVE-2025-24441
Description:Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:30.753


Instruction: Please provide detailed information about CVE-2025-24442

CVE:CVE-2025-24442
Description:Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:30.903


Instruction: Please provide detailed information about CVE-2025-24443

CVE:CVE-2025-24443
Description:Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:31.047


Instruction: Please provide detailed information about CVE-2025-24444

CVE:CVE-2025-24444
Description:Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:31.203


Instruction: Please provide detailed information about CVE-2025-24445

CVE:CVE-2025-24445
Description:Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:31.370


Instruction: Please provide detailed information about CVE-2025-24448

CVE:CVE-2025-24448
Description:Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:31.543


Instruction: Please provide detailed information about CVE-2025-24449

CVE:CVE-2025-24449
Description:Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-03-11T18:15:31.700