Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-22885 State: PUBLISHED Published: 2021-05-27T11:15:32 Last Updated: 2024-08-03T18:58:24.813Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-209 Description: A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1106652 - https://www.debian.org/security/2021/dsa-4929 - https://security.netapp.com/advisory/ntap-20210805-0009/
CVE ID: CVE-2021-22886 State: PUBLISHED Published: 2021-03-26T18:15:54 Last Updated: 2024-08-03T18:58:24.679Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-79 Description: Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app. Additional Analyst Notes: - CVE Program Container: References: - https://docs.rocket.chat/guides/security/security-updates - https://hackerone.com/reports/1014459 - https://github.com/RocketChat/Rocket.Chat/pull/20430
CVE ID: CVE-2021-22887 State: PUBLISHED Published: 2021-03-16T15:04:37 Last Updated: 2024-08-03T18:58:24.684Z Vendors: n/a Products: PSA5000, PSA7000 Problem Types: CWE-506 Description: A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44712 - https://www.supermicro.com/en/support/security/Trickbot
CVE ID: CVE-2021-22888 State: PUBLISHED Published: 2021-03-25T19:40:41 Last Updated: 2024-08-03T18:58:25.459Z Vendors: n/a Products: https://github.com/revive-adserver/revive-adserver Problem Types: CWE-79 Description: Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1097979 - https://www.revive-adserver.com/security/revive-sa-2021-003/ - https
ferences: - https://hackerone.com/reports/1097979 - https://www.revive-adserver.com/security/revive-sa-2021-003/ - https://github.com/revive-adserver/revive-adserver/commit/f472d890
CVE ID: CVE-2021-22889 State: PUBLISHED Published: 2021-03-25T19:40:55 Last Updated: 2024-08-03T18:58:24.797Z Vendors: n/a Products: https://github.com/revive-adserver/revive-adserver Problem Types: CWE-79 Description: Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://
mbination to execute injected JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://www.revive-adserver.com/security/revive-sa-2021-003/ - https://hackerone.com/reports/1097217 - https://github.com/revive-adserver/revive-adserver/commit/2f868414
CVE ID: CVE-2021-22890 State: PUBLISHED Published: 2021-04-01T17:46:17.000Z Last Updated: 2025-06-09T15:11:58.900Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-300 Description: curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circu
using the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1129529 - https://curl.se/docs/CVE-2021-22890.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVG
21-22890.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/ - https://security.gentoo.org/glsa/202105-36 - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210521-0007/ - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-22891 State: PUBLISHED Published: 2021-05-27T11:15:16 Last Updated: 2024-08-03T18:58:26.072Z Vendors: n/a Products: Citrix ShareFile Storage Zones Controller Problem Types: CWE-862 Description: A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1 and 5.11.18 may allow unauthenticated remote compromise of the Storage Zones Controller. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX310780
CVE ID: CVE-2021-22892 State: PUBLISHED Published: 2021-05-27T11:14:43 Last Updated: 2024-08-03T18:58:25.414Z Vendors: n/a Products: Rocket.Chat server Problem Types: CWE-200 Description: An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1089116
CVE ID: CVE-2021-22893 State: PUBLISHED Published: 2021-04-23T16:29:43.000Z Last Updated: 2025-10-21T23:25:48.614Z Vendors: n/a Products: Pulse Connect Secure Problem Types: CWE-287 Description: Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.pulsesecure.net/articles/Pul
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/ - https://blog.pulsesecure.net/pulse-connect-secure-security-update/ - https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html - https://kb.cert.org/vuls/id/213092
CVE ID: CVE-2021-22894 State: PUBLISHED Published: 2021-05-27T11:15:11.000Z Last Updated: 2025-10-21T23:25:44.830Z Vendors: n/a Products: Pulse Connect Secure Problem Types: CWE-94 Description: A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY
CVE ID: CVE-2021-22895 State: PUBLISHED Published: 2021-06-11T15:49:38 Last Updated: 2024-08-03T18:58:25.644Z Vendors: n/a Products: Nextcloud Desktop Client Problem Types: CWE-295 Description: Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/903424 - https://github.com/nextcloud/desktop/pull/2926 - https://github.com/nextcloud/desktop/releases/tag/v3.1.3 - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpgp-vf4p-wcw5 - https://www.debian.org/s
.3 - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpgp-vf4p-wcw5 - https://www.debian.org/security/2021/dsa-4974
CVE ID: CVE-2021-22896 State: PUBLISHED Published: 2021-06-11T15:49:38 Last Updated: 2024-08-03T18:58:25.923Z Vendors: n/a Products: Nextcloud Mail Problem Types: CWE-862 Description: Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1129996 - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jmgp-77jq-fjp3 - https://github.com/nextcloud/mail/pull/4864 - https://github.com/nextcloud/mail/releases/tag/v1.9.5
CVE ID: CVE-2021-22897 State: PUBLISHED Published: 2021-06-11T15:49:38 Last Updated: 2024-08-03T18:58:24.782Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-840 Description: curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weake
one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1172857 - https://curl.se/docs/CVE-2021-22897.html - https://github.com/curl/curl/commit/bbb71507b7bab52002f9b1e0880bed6a32834511 - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210727-0007/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
CVE ID: CVE-2021-22898 State: PUBLISHED Published: 2021-06-11T15:49:37 Last Updated: 2024-08-03T18:58:25.359Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-200 Description: curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol. Additional Analyst Notes:
ly revealing sensitive internal information to the server using a clear-text network protocol. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1176461 - https://curl.se/docs/CVE-2021-22898.html - https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde - https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - http://www.openwall.com/lists/oss-security/2021/07/21/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q
ists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/ - https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - https://www.debian.org/security/2022/dsa-5197 - https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
CVE ID: CVE-2021-22899 State: PUBLISHED Published: 2021-05-27T11:15:22.000Z Last Updated: 2025-10-21T23:25:44.693Z Vendors: n/a Products: Pulse Connect Secure Problem Types: CWE-77 Description: A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY
CVE ID: CVE-2021-22900 State: PUBLISHED Published: 2021-05-27T11:15:27.000Z Last Updated: 2025-10-21T23:25:44.296Z Vendors: n/a Products: Pulse Secure Secure Problem Types: CWE-94 Description: A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY
CVE ID: CVE-2021-22901 State: PUBLISHED Published: 2021-06-11T15:49:38 Last Updated: 2024-08-03T18:58:25.389Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-416 Description: curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If
using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory. Additional Analyst Notes: - CVE Program Container: References:
crafted memory content into the correct place in memory. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1180380 - https://curl.se/docs/CVE-2021-22901.html - https://github.com/curl/curl/commit/7f4a9a9b2a49547eae24d2e19bc5c346e9026479 - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210723-0001/ - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210727-0007/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-732250.p
://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf
CVE ID: CVE-2021-22902 State: PUBLISHED Published: 2021-06-11T15:49:38 Last Updated: 2024-08-03T18:58:25.713Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-400 Description: The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1138654 - https://discuss.rubyonrails.org
st Notes: - CVE Program Container: References: - https://hackerone.com/reports/1138654 - https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866
CVE ID: CVE-2021-22903 State: PUBLISHED Published: 2021-06-11T15:49:38 Last Updated: 2024-08-03T18:58:25.786Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-601 Description: The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a
o regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1148025 - https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867
CVE ID: CVE-2021-22904 State: PUBLISHED Published: 2021-06-11T15:49:38 Last Updated: 2024-08-03T18:58:25.438Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-400 Description: The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1101125 - https://discuss.rubyonrails.org/t/cve-2021-22904-poss
m Container: References: - https://hackerone.com/reports/1101125 - https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869 - https://security.netapp.com/advisory/ntap-20210805-0009/
CVE ID: CVE-2021-22905 State: PUBLISHED Published: 2021-06-11T15:49:39 Last Updated: 2024-08-03T18:58:26.359Z Vendors: n/a Products: Nextcloud Android App (com.nextcloud.client) Problem Types: CWE-200 Description: Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud server unless a global search has been explicitly chosen by the user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-22v9-q3r6-x7cj - https://hackerone.com/reports/1167916
CVE ID: CVE-2021-22906 State: PUBLISHED Published: 2021-06-11T15:49:39 Last Updated: 2024-08-03T18:58:25.587Z Vendors: n/a Products: Nextcloud End-to-End Encryption Problem Types: CWE-400 Description: Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock files of other users. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1189174 - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3829-45wm-ww36
CVE ID: CVE-2021-22907 State: PUBLISHED Published: 2021-05-27T11:14:17 Last Updated: 2024-08-03T18:58:25.707Z Vendors: n/a Products: Citrix Workspace App for Windows Problem Types: CWE-284 Description: An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions prior to 2105 and 1912 LTSR prior to CU4. Additional Analyst Notes: - CVE Program Container: References: - https://support.citrix.com/article/CTX307794
CVE ID: CVE-2021-22908 State: PUBLISHED Published: 2021-05-27T11:14:24 Last Updated: 2024-08-03T18:58:25.474Z Vendors: n/a Products: Pulse Connect Secure Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44800/
CVE ID: CVE-2021-22909 State: PUBLISHED Published: 2021-05-27T11:14:32 Last Updated: 2024-08-03T18:58:26.151Z Vendors: n/a Products: EdgeMAX EdgeRouter Problem Types: CWE-300 Description: A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later. Additional Analyst Notes: - CVE Program Container: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-018-018/cfa1566b-4bf8-427b-8cc7-8cffba3a93a4
CVE ID: CVE-2021-22910 State: PUBLISHED Published: 2021-08-09T12:27:46 Last Updated: 2024-08-03T18:58:26.282Z Vendors: n/a Products: Rocket.Chat server Problem Types: CWE-75 Description: A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1130874 - https://blog.sonarsource.com/nosql-injections-in-rocket-chat/
CVE ID: CVE-2021-22911 State: PUBLISHED Published: 2021-05-27T11:14:39 Last Updated: 2024-08-03T18:58:25.847Z Vendors: n/a Products: Rocket.Chat server Problem Types: CWE-75 Description: A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1130721 - http://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html - http://packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html - https://blog.sonarsource.com/nosq
tormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html - https://blog.sonarsource.com/nosql-injections-in-rocket-chat