CVE-2025-25022

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive information in configuration files.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-260

Affected software

No affected versions have been published.

Timeline

Published
Jun 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-250234.9IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.CVE-2025-250255.3IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returnedCVE-2025-250264.3IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check.CVE-2025-250296.5IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input.CVE-2025-25037.1An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file CVE-2025-250327.5IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user toCVE-2025-250349.3A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper valiCVE-2025-250357.3Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XCVE-2025-250366.8Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versionsCVE-2025-250379.3An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0CVE-2025-250389.8An OS command injection vulnerability exists in MiniDVBLinux version 5.4 and earlier. The system’s web-based management interface fails to pCVE-2025-250398.8A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated us