RoseHacks/Vulnerability.Research

RoseHacks/Vulnerability.Research

Releases0

Stars1

This repository contains information on the CVEs I found.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-27580 ↗	Apr 24, 2025Thursday, 24 April 2025, 00:15	7.5 HIGH	—
NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.
CVE-2025-27581 ↗	Apr 24, 2025Thursday, 24 April 2025, 00:15	4.3 MEDIUM	—
NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.