Instruction: Please provide detailed information about CVE-2025-25254

CVE:CVE-2025-25254
Description:An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.
published:2025-04-08T14:15:32.857


Instruction: Please provide detailed information about CVE-2025-30150

CVE:CVE-2025-30150
Description:Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates clearly that there is no account for this customer. In contrast you get a success response if the account was found. This vulnerability is fixed in Shopware 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
published:2025-04-08T14:15:34.540


Instruction: Please provide detailed information about CVE-2025-30151

CVE:CVE-2025-30151
Description:Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
published:2025-04-08T14:15:34.737


Instruction: Please provide detailed information about CVE-2025-31498

CVE:CVE-2025-31498
Description:c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.
published:2025-04-08T14:15:35.293


Instruction: Please provide detailed information about CVE-2025-22458

CVE:CVE-2025-22458
Description:DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System.
published:2025-04-08T15:15:48.857


Instruction: Please provide detailed information about CVE-2025-22459

CVE:CVE-2025-22459
Description:Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers.
published:2025-04-08T15:15:49.020


Instruction: Please provide detailed information about CVE-2025-22461

CVE:CVE-2025-22461
Description:SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution.
published:2025-04-08T15:15:49.167


Instruction: Please provide detailed information about CVE-2025-22464

CVE:CVE-2025-22464
Description:An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local access to write arbitrary data into memory causing a denial-of-service condition.
published:2025-04-08T15:15:49.310


Instruction: Please provide detailed information about CVE-2025-22465

CVE:CVE-2025-22465
Description:Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required.
published:2025-04-08T15:15:49.473


Instruction: Please provide detailed information about CVE-2025-22466

CVE:CVE-2025-22466
Description:Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.
published:2025-04-08T15:15:49.620


Instruction: Please provide detailed information about CVE-2025-32020

CVE:CVE-2025-32020
Description:The crud-query-parser library parses query parameters from HTTP requests and converts them to database queries. Improper neutralization of the order/sort parameter in the TypeORM adapter, which allows SQL injection. You are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.  This vulnerability is fixed in 0.1.0.
published:2025-04-08T15:15:50.430


Instruction: Please provide detailed information about CVE-2025-32406

CVE:CVE-2025-32406
Description:An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response.
published:2025-04-08T15:15:50.677


Instruction: Please provide detailed information about CVE-2025-1095

CVE:CVE-2025-1095
Description:IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to escalate their privileges. This vulnerability is due to an incomplete fix for CVE-2024-25029.
published:2025-04-08T16:15:24.910


Instruction: Please provide detailed information about CVE-2025-27078

CVE:CVE-2025-27078
Description:A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating system while using the CLI. Successful exploitation could lead to complete system compromise.
published:2025-04-08T16:15:25.683


Instruction: Please provide detailed information about CVE-2025-27079

CVE:CVE-2025-27079
Description:A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution (RCE). Successful exploitation could allow an attacker to execute arbitrary operating system commands on the underlying operating system leading to potential system compromise.
published:2025-04-08T16:15:25.837


Instruction: Please provide detailed information about CVE-2025-2285

CVE:CVE-2025-2285
Description:A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:26.303


Instruction: Please provide detailed information about CVE-2025-2286

CVE:CVE-2025-2286
Description:A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:26.480


Instruction: Please provide detailed information about CVE-2025-2287

CVE:CVE-2025-2287
Description:A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:26.620


Instruction: Please provide detailed information about CVE-2025-2288

CVE:CVE-2025-2288
Description:A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.   If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:26.750


Instruction: Please provide detailed information about CVE-2025-2293

CVE:CVE-2025-2293
Description:A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.   If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:26.887


Instruction: Please provide detailed information about CVE-2025-2829

CVE:CVE-2025-2829
Description:A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.   If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:27.133


Instruction: Please provide detailed information about CVE-2025-32017

CVE:CVE-2025-32017
Description:Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1.
published:2025-04-08T16:15:27.320


Instruction: Please provide detailed information about CVE-2025-32018

CVE:CVE-2025-32018
Description:Cursor is a code editor built for programming with AI. In versions 0.45.0 through 0.48.6, the Cursor app introduced a regression affecting the set of file paths the Cursor Agent is permitted to modify automatically. Under specific conditions, the agent could be prompted, either directly by the user or via maliciously crafted context, to automatically write to files outside of the opened workspace. This behavior required deliberate prompting, making successful exploitation highly impractical in real-world scenarios. Furthermore, the edited file was still displayed in the UI as usual for user review, making it unlikely for the edit to go unnoticed by the user. This vulnerability is fixed in 0.48.7.
published:2025-04-08T16:15:27.487


Instruction: Please provide detailed information about CVE-2025-32024

CVE:CVE-2025-32024
Description:bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. v0.10.0 added LimitNumTags (default 5000) and LimitTagSize (default 10000) options.
published:2025-04-08T16:15:27.703


Instruction: Please provide detailed information about CVE-2025-32025

CVE:CVE-2025-32025
Description:bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before v0.11.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. v0.11.0 added a 10 MB upper limit.
published:2025-04-08T16:15:27.873


Instruction: Please provide detailed information about CVE-2025-32026

CVE:CVE-2025-32026
Description:Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem.
published:2025-04-08T16:15:28.023


Instruction: Please provide detailed information about CVE-2025-32028

CVE:CVE-2025-32028
Description:HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.
published:2025-04-08T16:15:28.180


Instruction: Please provide detailed information about CVE-2025-3285

CVE:CVE-2025-3285
Description:A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:28.690


Instruction: Please provide detailed information about CVE-2025-3286

CVE:CVE-2025-3286
Description:A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:28.840


Instruction: Please provide detailed information about CVE-2025-3287

CVE:CVE-2025-3287
Description:A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:28.980


Instruction: Please provide detailed information about CVE-2025-3288

CVE:CVE-2025-3288
Description:A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data.  If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:29.120


Instruction: Please provide detailed information about CVE-2025-3289

CVE:CVE-2025-3289
Description:A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
published:2025-04-08T16:15:29.253


Instruction: Please provide detailed information about CVE-2025-25226

CVE:CVE-2025-25226
Description:Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.
published:2025-04-08T17:15:35.453


Instruction: Please provide detailed information about CVE-2025-25227

CVE:CVE-2025-25227
Description:Insufficient state checks lead to a vector that allows to bypass 2FA checks.
published:2025-04-08T17:15:35.610


Instruction: Please provide detailed information about CVE-2025-27082

CVE:CVE-2025-27082
Description:Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying host operating system.
published:2025-04-08T17:15:36.233


Instruction: Please provide detailed information about CVE-2025-27083

CVE:CVE-2025-27083
Description:Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying operating system.
published:2025-04-08T17:15:36.500


Instruction: Please provide detailed information about CVE-2025-27084

CVE:CVE-2025-27084
Description:A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface.
published:2025-04-08T17:15:36.700


Instruction: Please provide detailed information about CVE-2025-27085

CVE:CVE-2025-27085
Description:Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device.
published:2025-04-08T17:15:36.887


Instruction: Please provide detailed information about CVE-2025-27441

CVE:CVE-2025-27441
Description:Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
published:2025-04-08T17:15:37.080


Instruction: Please provide detailed information about CVE-2025-27442

CVE:CVE-2025-27442
Description:Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
published:2025-04-08T17:15:37.487


Instruction: Please provide detailed information about CVE-2025-27443

CVE:CVE-2025-27443
Description:Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.
published:2025-04-08T17:15:38.113


Instruction: Please provide detailed information about CVE-2025-30670

CVE:CVE-2025-30670
Description:Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
published:2025-04-08T17:15:38.413


Instruction: Please provide detailed information about CVE-2025-30671

CVE:CVE-2025-30671
Description:Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
published:2025-04-08T17:15:38.607


Instruction: Please provide detailed information about CVE-2025-32117

CVE:CVE-2025-32117
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light allows Reflected XSS. This issue affects Widgetize Pages Light: from n/a through 3.0.
published:2025-04-08T17:15:38.837


Instruction: Please provide detailed information about CVE-2025-32164

CVE:CVE-2025-32164
Description:Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadList. This issue affects m1.DownloadList: from n/a through 0.21.
published:2025-04-08T17:15:39.143


Instruction: Please provide detailed information about CVE-2025-32211

CVE:CVE-2025-32211
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet allows Stored XSS. This issue affects Broadstreet: from n/a through 1.51.2.
published:2025-04-08T17:15:39.407


Instruction: Please provide detailed information about CVE-2025-32279

CVE:CVE-2025-32279
Description:Missing Authorization vulnerability in Shahjada Live Forms. This issue affects Live Forms: from n/a through 4.8.5.
published:2025-04-08T17:15:39.600


Instruction: Please provide detailed information about CVE-2025-21174

CVE:CVE-2025-21174
Description:Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:44.667


Instruction: Please provide detailed information about CVE-2025-21191

CVE:CVE-2025-21191
Description:Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:44.857


Instruction: Please provide detailed information about CVE-2025-21197

CVE:CVE-2025-21197
Description:Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.
published:2025-04-08T18:15:45.020


Instruction: Please provide detailed information about CVE-2025-21203

CVE:CVE-2025-21203
Description:Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
published:2025-04-08T18:15:45.190


Instruction: Please provide detailed information about CVE-2025-21204

CVE:CVE-2025-21204
Description:Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:45.343


Instruction: Please provide detailed information about CVE-2025-21205

CVE:CVE-2025-21205
Description:Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:45.513


Instruction: Please provide detailed information about CVE-2025-21221

CVE:CVE-2025-21221
Description:Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:45.673


Instruction: Please provide detailed information about CVE-2025-21222

CVE:CVE-2025-21222
Description:Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:45.850


Instruction: Please provide detailed information about CVE-2025-24058

CVE:CVE-2025-24058
Description:Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:46.037


Instruction: Please provide detailed information about CVE-2025-24060

CVE:CVE-2025-24060
Description:Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:46.193


Instruction: Please provide detailed information about CVE-2025-24062

CVE:CVE-2025-24062
Description:Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:46.353


Instruction: Please provide detailed information about CVE-2025-24073

CVE:CVE-2025-24073
Description:Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:46.543


Instruction: Please provide detailed information about CVE-2025-24074

CVE:CVE-2025-24074
Description:Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:46.740


Instruction: Please provide detailed information about CVE-2025-25002

CVE:CVE-2025-25002
Description:Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network.
published:2025-04-08T18:15:47.030


Instruction: Please provide detailed information about CVE-2025-26628

CVE:CVE-2025-26628
Description:Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally.
published:2025-04-08T18:15:47.180


Instruction: Please provide detailed information about CVE-2025-26635

CVE:CVE-2025-26635
Description:Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network.
published:2025-04-08T18:15:47.337


Instruction: Please provide detailed information about CVE-2025-26637

CVE:CVE-2025-26637
Description:Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
published:2025-04-08T18:15:47.490


Instruction: Please provide detailed information about CVE-2025-26639

CVE:CVE-2025-26639
Description:Integer overflow or wraparound in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:47.657


Instruction: Please provide detailed information about CVE-2025-26640

CVE:CVE-2025-26640
Description:Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:47.817


Instruction: Please provide detailed information about CVE-2025-26641

CVE:CVE-2025-26641
Description:Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:47.990


Instruction: Please provide detailed information about CVE-2025-26642

CVE:CVE-2025-26642
Description:Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:15:48.160


Instruction: Please provide detailed information about CVE-2025-26644

CVE:CVE-2025-26644
Description:Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to perform spoofing locally.
published:2025-04-08T18:15:48.347


Instruction: Please provide detailed information about CVE-2025-26647

CVE:CVE-2025-26647
Description:Improper input validation in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
published:2025-04-08T18:15:48.510


Instruction: Please provide detailed information about CVE-2025-26648

CVE:CVE-2025-26648
Description:Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:48.667


Instruction: Please provide detailed information about CVE-2025-26649

CVE:CVE-2025-26649
Description:Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:48.843


Instruction: Please provide detailed information about CVE-2025-26651

CVE:CVE-2025-26651
Description:Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
published:2025-04-08T18:15:49.007


Instruction: Please provide detailed information about CVE-2025-26652

CVE:CVE-2025-26652
Description:Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:49.157


Instruction: Please provide detailed information about CVE-2025-26663

CVE:CVE-2025-26663
Description:Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:49.337


Instruction: Please provide detailed information about CVE-2025-26664

CVE:CVE-2025-26664
Description:Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
published:2025-04-08T18:15:49.510


Instruction: Please provide detailed information about CVE-2025-26665

CVE:CVE-2025-26665
Description:Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:49.670


Instruction: Please provide detailed information about CVE-2025-26666

CVE:CVE-2025-26666
Description:Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.
published:2025-04-08T18:15:49.833


Instruction: Please provide detailed information about CVE-2025-26667

CVE:CVE-2025-26667
Description:Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
published:2025-04-08T18:15:50.000


Instruction: Please provide detailed information about CVE-2025-26668

CVE:CVE-2025-26668
Description:Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:50.160


Instruction: Please provide detailed information about CVE-2025-26669

CVE:CVE-2025-26669
Description:Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
published:2025-04-08T18:15:50.347


Instruction: Please provide detailed information about CVE-2025-26670

CVE:CVE-2025-26670
Description:Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:50.817


Instruction: Please provide detailed information about CVE-2025-26671

CVE:CVE-2025-26671
Description:Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:51.003


Instruction: Please provide detailed information about CVE-2025-26672

CVE:CVE-2025-26672
Description:Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
published:2025-04-08T18:15:51.177


Instruction: Please provide detailed information about CVE-2025-26673

CVE:CVE-2025-26673
Description:Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:51.350


Instruction: Please provide detailed information about CVE-2025-26674

CVE:CVE-2025-26674
Description:Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.
published:2025-04-08T18:15:51.553


Instruction: Please provide detailed information about CVE-2025-26675

CVE:CVE-2025-26675
Description:Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:51.757


Instruction: Please provide detailed information about CVE-2025-26676

CVE:CVE-2025-26676
Description:Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
published:2025-04-08T18:15:52.023


Instruction: Please provide detailed information about CVE-2025-26678

CVE:CVE-2025-26678
Description:Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally.
published:2025-04-08T18:15:52.303


Instruction: Please provide detailed information about CVE-2025-26679

CVE:CVE-2025-26679
Description:Use after free in RPC Endpoint Mapper Service allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:52.463


Instruction: Please provide detailed information about CVE-2025-26680

CVE:CVE-2025-26680
Description:Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:52.667


Instruction: Please provide detailed information about CVE-2025-26681

CVE:CVE-2025-26681
Description:Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:52.863


Instruction: Please provide detailed information about CVE-2025-26682

CVE:CVE-2025-26682
Description:Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:53.033


Instruction: Please provide detailed information about CVE-2025-26686

CVE:CVE-2025-26686
Description:Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:53.220


Instruction: Please provide detailed information about CVE-2025-26687

CVE:CVE-2025-26687
Description:Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.
published:2025-04-08T18:15:53.383


Instruction: Please provide detailed information about CVE-2025-26688

CVE:CVE-2025-26688
Description:Stack-based buffer overflow in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:53.550


Instruction: Please provide detailed information about CVE-2025-27182

CVE:CVE-2025-27182
Description:After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:53.740


Instruction: Please provide detailed information about CVE-2025-27183

CVE:CVE-2025-27183
Description:After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:53.937


Instruction: Please provide detailed information about CVE-2025-27184

CVE:CVE-2025-27184
Description:After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:54.090


Instruction: Please provide detailed information about CVE-2025-27185

CVE:CVE-2025-27185
Description:After Effects versions 25.1, 24.6.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:54.233


Instruction: Please provide detailed information about CVE-2025-27186

CVE:CVE-2025-27186
Description:After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:54.380


Instruction: Please provide detailed information about CVE-2025-27187

CVE:CVE-2025-27187
Description:After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:54.540


Instruction: Please provide detailed information about CVE-2025-27193

CVE:CVE-2025-27193
Description:Bridge versions 14.1.5, 15.0.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:54.687


Instruction: Please provide detailed information about CVE-2025-27194

CVE:CVE-2025-27194
Description:Media Encoder versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:54.853


Instruction: Please provide detailed information about CVE-2025-27195

CVE:CVE-2025-27195
Description:Media Encoder versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:55.027


Instruction: Please provide detailed information about CVE-2025-27196

CVE:CVE-2025-27196
Description:Premiere Pro versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:55.170


Instruction: Please provide detailed information about CVE-2025-27198

CVE:CVE-2025-27198
Description:Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:55.323


Instruction: Please provide detailed information about CVE-2025-27199

CVE:CVE-2025-27199
Description:Animate versions 24.0.7, 23.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:55.477


Instruction: Please provide detailed information about CVE-2025-27200

CVE:CVE-2025-27200
Description:Animate versions 24.0.7, 23.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:55.630


Instruction: Please provide detailed information about CVE-2025-27201

CVE:CVE-2025-27201
Description:Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:55.787


Instruction: Please provide detailed information about CVE-2025-27202

CVE:CVE-2025-27202
Description:Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:55.960


Instruction: Please provide detailed information about CVE-2025-27204

CVE:CVE-2025-27204
Description:After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T18:15:56.130


Instruction: Please provide detailed information about CVE-2025-27205

CVE:CVE-2025-27205
Description:Adobe Experience Manager Screens versions FP11.3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Exploitation of this issue requires user interaction in that a victim must open a malicious link.
published:2025-04-08T18:15:56.290


Instruction: Please provide detailed information about CVE-2025-27467

CVE:CVE-2025-27467
Description:Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:56.453


Instruction: Please provide detailed information about CVE-2025-27469

CVE:CVE-2025-27469
Description:Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:56.613


Instruction: Please provide detailed information about CVE-2025-27470

CVE:CVE-2025-27470
Description:Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:56.797


Instruction: Please provide detailed information about CVE-2025-27471

CVE:CVE-2025-27471
Description:Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:56.970


Instruction: Please provide detailed information about CVE-2025-27472

CVE:CVE-2025-27472
Description:Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.
published:2025-04-08T18:15:57.140


Instruction: Please provide detailed information about CVE-2025-27473

CVE:CVE-2025-27473
Description:Uncontrolled resource consumption in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:57.290


Instruction: Please provide detailed information about CVE-2025-27474

CVE:CVE-2025-27474
Description:Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
published:2025-04-08T18:15:57.457


Instruction: Please provide detailed information about CVE-2025-27475

CVE:CVE-2025-27475
Description:Sensitive data storage in improperly locked memory in Windows Update Stack allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:57.620


Instruction: Please provide detailed information about CVE-2025-27476

CVE:CVE-2025-27476
Description:Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:57.777


Instruction: Please provide detailed information about CVE-2025-27477

CVE:CVE-2025-27477
Description:Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:57.947


Instruction: Please provide detailed information about CVE-2025-27478

CVE:CVE-2025-27478
Description:Heap-based buffer overflow in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:58.120


Instruction: Please provide detailed information about CVE-2025-27479

CVE:CVE-2025-27479
Description:Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:58.287


Instruction: Please provide detailed information about CVE-2025-27480

CVE:CVE-2025-27480
Description:Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:58.447


Instruction: Please provide detailed information about CVE-2025-27481

CVE:CVE-2025-27481
Description:Stack-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:58.610


Instruction: Please provide detailed information about CVE-2025-27482

CVE:CVE-2025-27482
Description:Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
published:2025-04-08T18:15:58.773


Instruction: Please provide detailed information about CVE-2025-27483

CVE:CVE-2025-27483
Description:Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
published:2025-04-08T18:15:58.943


Instruction: Please provide detailed information about CVE-2025-27484

CVE:CVE-2025-27484
Description:Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over a network.
published:2025-04-08T18:15:59.130


Instruction: Please provide detailed information about CVE-2025-27485

CVE:CVE-2025-27485
Description:Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:59.300


Instruction: Please provide detailed information about CVE-2025-27486

CVE:CVE-2025-27486
Description:Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
published:2025-04-08T18:15:59.450


Instruction: Please provide detailed information about CVE-2025-27487

CVE:CVE-2025-27487
Description:Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network.
published:2025-04-08T18:15:59.620


Instruction: Please provide detailed information about CVE-2025-27489

CVE:CVE-2025-27489
Description:Improper input validation in Azure Local allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:59.787


Instruction: Please provide detailed information about CVE-2025-27490

CVE:CVE-2025-27490
Description:Heap-based buffer overflow in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:15:59.953


Instruction: Please provide detailed information about CVE-2025-27491

CVE:CVE-2025-27491
Description:Use after free in Windows Hyper-V allows an authorized attacker to execute code over a network.
published:2025-04-08T18:16:00.140


Instruction: Please provide detailed information about CVE-2025-27492

CVE:CVE-2025-27492
Description:Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:00.313


Instruction: Please provide detailed information about CVE-2025-27727

CVE:CVE-2025-27727
Description:Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:00.477


Instruction: Please provide detailed information about CVE-2025-27728

CVE:CVE-2025-27728
Description:Out-of-bounds read in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:00.653


Instruction: Please provide detailed information about CVE-2025-27729

CVE:CVE-2025-27729
Description:Use after free in Windows Shell allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:00.813


Instruction: Please provide detailed information about CVE-2025-27730

CVE:CVE-2025-27730
Description:Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:00.990


Instruction: Please provide detailed information about CVE-2025-27731

CVE:CVE-2025-27731
Description:Improper input validation in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:01.163


Instruction: Please provide detailed information about CVE-2025-27732

CVE:CVE-2025-27732
Description:Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:01.333


Instruction: Please provide detailed information about CVE-2025-27733

CVE:CVE-2025-27733
Description:Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
published:2025-04-08T18:16:01.517


Instruction: Please provide detailed information about CVE-2025-27735

CVE:CVE-2025-27735
Description:Insufficient verification of data authenticity in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
published:2025-04-08T18:16:01.697


Instruction: Please provide detailed information about CVE-2025-27736

CVE:CVE-2025-27736
Description:Exposure of sensitive information to an unauthorized actor in Windows Power Dependency Coordinator allows an authorized attacker to disclose information locally.
published:2025-04-08T18:16:01.913


Instruction: Please provide detailed information about CVE-2025-27737

CVE:CVE-2025-27737
Description:Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally.
published:2025-04-08T18:16:02.097


Instruction: Please provide detailed information about CVE-2025-27738

CVE:CVE-2025-27738
Description:Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network.
published:2025-04-08T18:16:02.280


Instruction: Please provide detailed information about CVE-2025-27739

CVE:CVE-2025-27739
Description:Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:02.470


Instruction: Please provide detailed information about CVE-2025-27740

CVE:CVE-2025-27740
Description:Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network.
published:2025-04-08T18:16:02.653


Instruction: Please provide detailed information about CVE-2025-27741

CVE:CVE-2025-27741
Description:Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.
published:2025-04-08T18:16:02.833


Instruction: Please provide detailed information about CVE-2025-27742

CVE:CVE-2025-27742
Description:Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
published:2025-04-08T18:16:03.040


Instruction: Please provide detailed information about CVE-2025-27743

CVE:CVE-2025-27743
Description:Untrusted search path in System Center allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:03.260


Instruction: Please provide detailed information about CVE-2025-27744

CVE:CVE-2025-27744
Description:Improper access control in Microsoft Office allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:03.497


Instruction: Please provide detailed information about CVE-2025-27745

CVE:CVE-2025-27745
Description:Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:03.670


Instruction: Please provide detailed information about CVE-2025-27746

CVE:CVE-2025-27746
Description:Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:03.877


Instruction: Please provide detailed information about CVE-2025-27747

CVE:CVE-2025-27747
Description:Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:04.047


Instruction: Please provide detailed information about CVE-2025-27748

CVE:CVE-2025-27748
Description:Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:04.213


Instruction: Please provide detailed information about CVE-2025-27749

CVE:CVE-2025-27749
Description:Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:04.370


Instruction: Please provide detailed information about CVE-2025-27750

CVE:CVE-2025-27750
Description:Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:04.520


Instruction: Please provide detailed information about CVE-2025-27751

CVE:CVE-2025-27751
Description:Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:04.680


Instruction: Please provide detailed information about CVE-2025-27752

CVE:CVE-2025-27752
Description:Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:04.840


Instruction: Please provide detailed information about CVE-2025-29791

CVE:CVE-2025-29791
Description:Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:05.003


Instruction: Please provide detailed information about CVE-2025-29792

CVE:CVE-2025-29792
Description:Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:05.160


Instruction: Please provide detailed information about CVE-2025-29793

CVE:CVE-2025-29793
Description:Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
published:2025-04-08T18:16:05.320


Instruction: Please provide detailed information about CVE-2025-29794

CVE:CVE-2025-29794
Description:Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
published:2025-04-08T18:16:05.467


Instruction: Please provide detailed information about CVE-2025-29800

CVE:CVE-2025-29800
Description:Improper privilege management in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:05.680


Instruction: Please provide detailed information about CVE-2025-29801

CVE:CVE-2025-29801
Description:Incorrect default permissions in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:05.840


Instruction: Please provide detailed information about CVE-2025-29802

CVE:CVE-2025-29802
Description:Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:06.017


Instruction: Please provide detailed information about CVE-2025-29804

CVE:CVE-2025-29804
Description:Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:06.180


Instruction: Please provide detailed information about CVE-2025-29805

CVE:CVE-2025-29805
Description:Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network.
published:2025-04-08T18:16:06.330


Instruction: Please provide detailed information about CVE-2025-29808

CVE:CVE-2025-29808
Description:Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
published:2025-04-08T18:16:06.483


Instruction: Please provide detailed information about CVE-2025-29809

CVE:CVE-2025-29809
Description:Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.
published:2025-04-08T18:16:06.633


Instruction: Please provide detailed information about CVE-2025-29810

CVE:CVE-2025-29810
Description:Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
published:2025-04-08T18:16:06.797


Instruction: Please provide detailed information about CVE-2025-29811

CVE:CVE-2025-29811
Description:Improper input validation in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:06.977


Instruction: Please provide detailed information about CVE-2025-29812

CVE:CVE-2025-29812
Description:Untrusted pointer dereference in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:07.160


Instruction: Please provide detailed information about CVE-2025-29816

CVE:CVE-2025-29816
Description:Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.
published:2025-04-08T18:16:07.370


Instruction: Please provide detailed information about CVE-2025-29819

CVE:CVE-2025-29819
Description:External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.
published:2025-04-08T18:16:07.520


Instruction: Please provide detailed information about CVE-2025-29820

CVE:CVE-2025-29820
Description:Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:07.683


Instruction: Please provide detailed information about CVE-2025-29821

CVE:CVE-2025-29821
Description:Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
published:2025-04-08T18:16:07.867


Instruction: Please provide detailed information about CVE-2025-29822

CVE:CVE-2025-29822
Description:Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.
published:2025-04-08T18:16:08.023


Instruction: Please provide detailed information about CVE-2025-29823

CVE:CVE-2025-29823
Description:Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
published:2025-04-08T18:16:08.190


Instruction: Please provide detailed information about CVE-2025-29824

CVE:CVE-2025-29824
Description:Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
published:2025-04-08T18:16:08.340


Instruction: Please provide detailed information about CVE-2025-32035

CVE:CVE-2025-32035
Description:DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This means that it's possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security vulnerability. This vulnerability is fixed in 9.13.2.
published:2025-04-08T18:16:08.597


Instruction: Please provide detailed information about CVE-2025-32036

CVE:CVE-2025-32036
Description:DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. The algorithm used to generate the captcha image shows the least complexity of the desired image. For this reason, the created image can be easily read by OCR tools, and the intruder can send automatic requests by building a robot and using this tool. This vulnerability is fixed in 9.13.8.
published:2025-04-08T18:16:08.750


Instruction: Please provide detailed information about CVE-2025-30295

CVE:CVE-2025-30295
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:49.453


Instruction: Please provide detailed information about CVE-2025-30296

CVE:CVE-2025-30296
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:49.613


Instruction: Please provide detailed information about CVE-2025-30297

CVE:CVE-2025-30297
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:49.770


Instruction: Please provide detailed information about CVE-2025-30298

CVE:CVE-2025-30298
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:49.923


Instruction: Please provide detailed information about CVE-2025-30299

CVE:CVE-2025-30299
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:50.083


Instruction: Please provide detailed information about CVE-2025-30300

CVE:CVE-2025-30300
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:50.240


Instruction: Please provide detailed information about CVE-2025-30301

CVE:CVE-2025-30301
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:50.390


Instruction: Please provide detailed information about CVE-2025-30302

CVE:CVE-2025-30302
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:50.537


Instruction: Please provide detailed information about CVE-2025-30303

CVE:CVE-2025-30303
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:50.693


Instruction: Please provide detailed information about CVE-2025-30304

CVE:CVE-2025-30304
Description:Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:50.863


Instruction: Please provide detailed information about CVE-2025-30305

CVE:CVE-2025-30305
Description:XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:51.027


Instruction: Please provide detailed information about CVE-2025-30306

CVE:CVE-2025-30306
Description:XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:51.197


Instruction: Please provide detailed information about CVE-2025-30307

CVE:CVE-2025-30307
Description:XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:51.353


Instruction: Please provide detailed information about CVE-2025-30308

CVE:CVE-2025-30308
Description:XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:51.513


Instruction: Please provide detailed information about CVE-2025-30309

CVE:CVE-2025-30309
Description:XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T19:15:51.670


Instruction: Please provide detailed information about CVE-2025-3416

CVE:CVE-2025-3416
Description:A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.
published:2025-04-08T19:15:53.717


Instruction: Please provide detailed information about CVE-2025-22871

CVE:CVE-2025-22871
Description:The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
published:2025-04-08T20:15:20.183


Instruction: Please provide detailed information about CVE-2025-24446

CVE:CVE-2025-24446
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T20:15:20.417


Instruction: Please provide detailed information about CVE-2025-24447

CVE:CVE-2025-24447
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T20:15:20.573


Instruction: Please provide detailed information about CVE-2025-30281

CVE:CVE-2025-30281
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does not require user interaction.
published:2025-04-08T20:15:25.670


Instruction: Please provide detailed information about CVE-2025-30282

CVE:CVE-2025-30282
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass authentication mechanisms and execute code with the privileges of the authenticated user. Exploitation of this issue requires user interaction in that a victim must be coerced into performing actions within the application.
published:2025-04-08T20:15:25.820


Instruction: Please provide detailed information about CVE-2025-30284

CVE:CVE-2025-30284
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T20:15:25.980


Instruction: Please provide detailed information about CVE-2025-30285

CVE:CVE-2025-30285
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T20:15:26.127


Instruction: Please provide detailed information about CVE-2025-30286

CVE:CVE-2025-30286
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
published:2025-04-08T20:15:26.273


Instruction: Please provide detailed information about CVE-2025-30287

CVE:CVE-2025-30287
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass authentication mechanisms and execute code with the privileges of the authenticated user. Exploitation of this issue requires user interaction in that a victim must be coerced into performing actions within the application.
published:2025-04-08T20:15:26.430


Instruction: Please provide detailed information about CVE-2025-30288

CVE:CVE-2025-30288
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-04-08T20:15:26.583


Instruction: Please provide detailed information about CVE-2025-30289

CVE:CVE-2025-30289
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.
published:2025-04-08T20:15:26.737


Instruction: Please provide detailed information about CVE-2025-30290

CVE:CVE-2025-30290
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An attacker could exploit this vulnerability to access files and directories that are stored outside the intended restricted directory. Exploitation of this issue requires user interaction.
published:2025-04-08T20:15:26.883


Instruction: Please provide detailed information about CVE-2025-30291

CVE:CVE-2025-30291
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to gain access to sensitive information which could be used to further compromise the system or bypass security mechanisms. Exploitation of this issue does not require user interaction.
published:2025-04-08T20:15:27.057


Instruction: Please provide detailed information about CVE-2025-30292

CVE:CVE-2025-30292
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
published:2025-04-08T20:15:27.210


Instruction: Please provide detailed information about CVE-2025-30293

CVE:CVE-2025-30293
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T20:15:27.363


Instruction: Please provide detailed information about CVE-2025-30294

CVE:CVE-2025-30294
Description:ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
published:2025-04-08T20:15:27.527


Instruction: Please provide detailed information about CVE-2025-27188

CVE:CVE-2025-27188
Description:Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-04-08T21:15:50.393


Instruction: Please provide detailed information about CVE-2025-27189

CVE:CVE-2025-27189
Description:Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could be exploited to cause a denial-of-service condition. An attacker could trick a logged-in user into submitting a forged request to the vulnerable application, which may disrupt service availability. Exploitation of this issue requires user interaction, typically in the form of clicking a malicious link or visiting an attacker-controlled website.
published:2025-04-08T21:15:50.567


Instruction: Please provide detailed information about CVE-2025-27190

CVE:CVE-2025-27190
Description:Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-04-08T21:15:50.727


Instruction: Please provide detailed information about CVE-2025-27191

CVE:CVE-2025-27191
Description:Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
published:2025-04-08T21:15:50.883


Instruction: Please provide detailed information about CVE-2025-27192

CVE:CVE-2025-27192
Description:Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to gain unauthorized access to protected resources by obtaining sensitive credential information. Exploitation of this issue does not require user interaction.
published:2025-04-08T21:15:51.040


Instruction: Please provide detailed information about CVE-2025-25013

CVE:CVE-2025-25013
Description:Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack.
published:2025-04-08T23:15:45.540


Instruction: Please provide detailed information about CVE-2025-32460

CVE:CVE-2025-32460
Description:GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.
published:2025-04-09T02:15:15.137


Instruction: Please provide detailed information about CVE-2025-32461

CVE:CVE-2025-32461
Description:wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.
published:2025-04-09T02:15:16.253


Instruction: Please provide detailed information about CVE-2025-29988

CVE:CVE-2025-29988
Description:Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
published:2025-04-09T03:15:15.737


Instruction: Please provide detailed information about CVE-2025-32464

CVE:CVE-2025-32464
Description:HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one.
published:2025-04-09T03:15:16.847


Instruction: Please provide detailed information about CVE-2025-3100

CVE:CVE-2025-3100
Description:The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
published:2025-04-09T05:15:43.253


Instruction: Please provide detailed information about CVE-2025-3442

CVE:CVE-2025-3442
Description:This vulnerability exists in TP-Link Tapo H200 V1  IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device.
published:2025-04-09T07:15:41.210


Instruction: Please provide detailed information about CVE-2025-20952

CVE:CVE-2025-20952
Description:Improper access control in Mdecservice prior to SMR Apr-2025 Release 1 allows local attackers to access arbitrary files with system privilege.
published:2025-04-09T08:15:16.153


Instruction: Please provide detailed information about CVE-2025-23407

CVE:CVE-2025-23407
Description:Incorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote attacker who can log in to the product may alter the settings without appropriate privileges.
published:2025-04-09T09:15:15.963


Instruction: Please provide detailed information about CVE-2025-25053

CVE:CVE-2025-25053
Description:OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product.
published:2025-04-09T09:15:16.213


Instruction: Please provide detailed information about CVE-2025-25056

CVE:CVE-2025-25056
Description:Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views a malicious page while logged in, unintended operations may be performed.
published:2025-04-09T09:15:16.423


Instruction: Please provide detailed information about CVE-2025-25213

CVE:CVE-2025-25213
Description:Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malicious page while logged in, unintended operations may be performed.
published:2025-04-09T09:15:16.610


Instruction: Please provide detailed information about CVE-2025-27722

CVE:CVE-2025-27722
Description:Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attack may allow a remote unauthenticated attacker to eavesdrop the communication and obtain the authentication information.
published:2025-04-09T09:15:16.790


Instruction: Please provide detailed information about CVE-2025-27797

CVE:CVE-2025-27797
Description:OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product.
published:2025-04-09T09:15:16.977


Instruction: Please provide detailed information about CVE-2025-27934

CVE:CVE-2025-27934
Description:Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product authentication information.
published:2025-04-09T09:15:17.153


Instruction: Please provide detailed information about CVE-2025-29870

CVE:CVE-2025-29870
Description:Missing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product configuration information including authentication information.
published:2025-04-09T09:15:17.347


Instruction: Please provide detailed information about CVE-2025-2222

CVE:CVE-2025-2222
Description:CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privilege escalation following man in the middle attack.
published:2025-04-09T11:15:42.063


Instruction: Please provide detailed information about CVE-2025-2223

CVE:CVE-2025-2223
Description:CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a malicious project file is loaded by a user from the local system.
published:2025-04-09T11:15:42.320


Instruction: Please provide detailed information about CVE-2025-2440

CVE:CVE-2025-2440
Description:CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a malicious user, having physical access and advanced information on the file system, sets the radio in factory default mode.
published:2025-04-09T11:15:42.507


Instruction: Please provide detailed information about CVE-2025-2441

CVE:CVE-2025-2441
Description:CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having physical access, sets the radio in factory default mode where the product does not correctly initialize all data.
published:2025-04-09T11:15:42.730


Instruction: Please provide detailed information about CVE-2025-2442

CVE:CVE-2025-2442
Description:CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in the loss of confidentially, integrity and availability when a malicious user, having physical access, sets the radio to the factory default mode.
published:2025-04-09T11:15:42.947


Instruction: Please provide detailed information about CVE-2025-29189

CVE:CVE-2025-29189
Description:Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.
published:2025-04-09T12:15:15.003


Instruction: Please provide detailed information about CVE-2025-30677

CVE:CVE-2025-30677
Description:Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs.   This vulnerability can lead to unintended exposure of credentials in log files, potentially allowing attackers with access to these logs to obtain Apache Kafka credentials. The vulnerability's impact is limited by the fact that an attacker would need access to the application logs to exploit this issue.  This issue affects Apache Pulsar IO's Apache Kafka connectors in all versions before 3.0.11, 3.3.6, and 4.0.4.   3.0.x version users should upgrade to at least 3.0.11.  3.3.x version users should upgrade to at least 3.3.6.  4.0.x version users should upgrade to at least 4.0.4.   Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
published:2025-04-09T12:15:15.363


Instruction: Please provide detailed information about CVE-2025-31672

CVE:CVE-2025-31672
Description:Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry. This issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file. Users are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read  https://poi.apache.org/security.html  for recommendations about how to use the POI libraries securely.
published:2025-04-09T12:15:15.563


Instruction: Please provide detailed information about CVE-2025-1968

CVE:CVE-2025-1968
Description:Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.
published:2025-04-09T14:15:27.950


Instruction: Please provide detailed information about CVE-2025-25023

CVE:CVE-2025-25023
Description:IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.
published:2025-04-09T14:15:28.167


Instruction: Please provide detailed information about CVE-2025-27391

CVE:CVE-2025-27391
Description:Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled.  This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0. It can be mitigated by restricting log access to only trusted users.  Users are recommended to upgrade to version 2.40.0, which fixes the issue.
published:2025-04-09T15:16:02.090


Instruction: Please provide detailed information about CVE-2025-29389

CVE:CVE-2025-29389
Description:PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2.
published:2025-04-09T15:16:02.593


Instruction: Please provide detailed information about CVE-2025-29390

CVE:CVE-2025-29390
Description:jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php.
published:2025-04-09T16:15:24.260


Instruction: Please provide detailed information about CVE-2025-29391

CVE:CVE-2025-29391
Description:horvey Library-Manager v1.0 is vulnerable to SQL Injection in Admin/Controller/BookController.class.php.
published:2025-04-09T16:15:24.390


Instruction: Please provide detailed information about CVE-2025-29394

CVE:CVE-2025-29394
Description:An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type.
published:2025-04-09T16:15:24.523


Instruction: Please provide detailed information about CVE-2025-32016

CVE:CVE-2025-32016
Description:Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform (formerly Azure AD v2.0 endpoint) and AAD B2C. This vulnerability affects confidential client applications, including daemons, web apps, and web APIs. Under specific circumstances, sensitive information such as client secrets or certificate details may be exposed in the service logs of these applications. Service logs are intended to be handled securely. Service logs generated at the information level or credential descriptions containing local file paths with passwords, Base64 encoded values, or Client secret. Additionally, logs of services using Base64 encoded certificates or certificate paths with password credential descriptions are also affected if the certificates are invalid or expired, regardless of the log level. Note that these credentials are not usable due to their invalid or expired status. To mitigate this vulnerability, update to Microsoft.Identity.Web 3.8.2 or Microsoft.Identity.Abstractions 9.0.0.
published:2025-04-09T16:15:24.770


Instruction: Please provide detailed information about CVE-2025-32371

CVE:CVE-2025-32371
Description:DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that the information is legitimate. This vulnerability is fixed in 9.13.4.
published:2025-04-09T16:15:24.933


Instruction: Please provide detailed information about CVE-2025-32372

CVE:CVE-2025-32372
Description:DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.
published:2025-04-09T16:15:25.103


Instruction: Please provide detailed information about CVE-2025-32373

CVE:CVE-2025-32373
Description:DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8.
published:2025-04-09T16:15:25.250


Instruction: Please provide detailed information about CVE-2025-32374

CVE:CVE-2025-32374
Description:DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8.
published:2025-04-09T16:15:25.410


Instruction: Please provide detailed information about CVE-2025-32375

CVE:CVE-2025-32375
Description:BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerability is fixed in 1.4.8.
published:2025-04-09T16:15:25.580


Instruction: Please provide detailed information about CVE-2025-32378

CVE:CVE-2025-32378
Description:Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17.
published:2025-04-09T16:15:25.740


Instruction: Please provide detailed information about CVE-2025-32379

CVE:CVE-2025-32379
Description:Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.
published:2025-04-09T16:15:25.903


Instruction: Please provide detailed information about CVE-2025-32380

CVE:CVE-2025-32380
Description:The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This could lead to excessive resource consumption and denial of service.  Apollo Router's usage of Apollo Compiler has been updated so that validation logic processes each named fragment only once, preventing redundant traversal. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.
published:2025-04-09T16:15:26.053


Instruction: Please provide detailed information about CVE-2025-32381

CVE:CVE-2025-32381
Description:XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can be abused to fill up a host's memory and case a denial of service. For example, sending many small requests to an LLM inference server with unique JSON schemas would eventually cause this denial of service to occur. This vulnerability is fixed in 0.1.18.
published:2025-04-09T16:15:26.210


Instruction: Please provide detailed information about CVE-2025-31002

CVE:CVE-2025-31002
Description:Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Using Malicious Files. This issue affects Squeeze: from n/a through 1.6.
published:2025-04-09T17:15:32.623


Instruction: Please provide detailed information about CVE-2025-31003

CVE:CVE-2025-31003
Description:Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze allows Retrieve Embedded Sensitive Data. This issue affects Squeeze: from n/a through 1.6.
published:2025-04-09T17:15:32.817