CVE-2025-0418

MediumCVSS 5.2/10Last modified Jun 17, 2026

Description

Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords.

Metrics

CVSS 4.0 5.2/10CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:D/RE:L/U:Green

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-04194.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies CVE-2025-04204.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allowsCVE-2025-04214.7Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. TCVE-2025-04228.6An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote CCVE-2025-04235.3In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site CVE-2025-04245.1In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site scCVE-2025-04258.5Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed SerCVE-2025-04266.2A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet readCVE-2025-04277.8Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture KCVE-2025-04287.2The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via desCVE-2025-04297.2The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via desCVE-2025-04307.5Belledonne Communications Linphone-Desktop is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to creat