CVE-2025-1997

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1

is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-19985.5IBM UrbanCode Deploy (UCD) through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 t CVE-2025-20009.8A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising CVE-2025-200016.5An out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially crafted font file can trigger this vulnerabili CVE-2025-200025.3After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure CVE-2025-200038.2Improper link resolution before file access ('Link Following') for some Intel(R) Graphics Driver software installers may allow an authentica CVE-2025-200047.2Insufficient control flow management in the Alias Checking Trusted Module for some Intel(R) Xeon(R) 6 processor E-Cores firmware may allow a CVE-2025-200055.7Improper buffer restrictions in some UEFI firmware for some Intel(R) reference platforms may allow an escalation of privilege. System softwa CVE-2025-200067.4Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potent CVE-2025-200087.7Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow a privileged user to pot CVE-2025-200094.1Improper input validation in the UEFI firmware GenerationSetup module for the Intel(R) Server D50DNP and M50FCP boards may allow a privilege CVE-2025-200107.8Use of unmaintained third party components for some Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Appl CVE-2025-200115.5in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.