Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-36436 State: PUBLISHED Published: 2023-10-10T17:08:14.714Z Last Updated: 2025-04-14T22:46:46.834Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi
08 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Windows MSHTML Platform Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36436
CVE ID: CVE-2023-36437 State: PUBLISHED Published: 2023-11-14T20:17:41.638Z Last Updated: 2025-10-08T23:59:35.107Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Pipelines Agent Problem Types: CWE-94 Description: Azure DevOps Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36437
CVE ID: CVE-2023-36438 State: PUBLISHED Published: 2023-10-10T17:08:03.086Z Last Updated: 2025-04-14T22:46:34.851Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi
08 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Information Disclosure Description: Windows TCP/IP Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36438
CVE ID: CVE-2023-36439 State: PUBLISHED Published: 2023-11-14T17:57:17.367Z Last Updated: 2025-10-08T23:59:29.919Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 13, Microsoft Exchange Server 2019 Cumulative Update 12 Problem Types: CWE-502 Description: Microsoft Exchange Server Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36439
CVE ID: CVE-2023-36456 State: PUBLISHED Published: 2023-07-06T18:24:03.308Z Last Updated: 2024-11-14T14:10:35.658Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: goauthentik Products: authentik Problem Types: CWE-436 Description: authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy are susceptible to this. Possible spoofing of IP addresses in logs, downstream applications proxied by (built in) outpost, IP bypassing in cu
is. Possible spoofing of IP addresses in logs, downstream applications proxied by (built in) outpost, IP bypassing in custom flows if used. This poses a possible security risk when someone has flows or policies that check the user's IP address, e.g. when they want to ignore the user's 2 factor authentication when the user is connected to the company network. A second security risk is that the IP addresses in the logfiles and user sessions are not reliable anymore. Anybody can spoof this address and one cannot verify that the user has logged in from the IP address that is in their account's log. A third risk is that this header is passed on to the proxied application behind an outpost. The ap
their account's log. A third risk is that this header is passed on to the proxied application behind an outpost. The application may do any kind of verification, logging, blocking or rate limiting based on the IP address, and this IP address can be overridden by anybody that want to. Versions 2023.4.3 and 2023.5.5 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-cmxp-jcw7-jjjv - https://github.com/goauthentik/authentik/commit/15026748d19d490eb2baf9a9566ead4f805f7dff - https://github.com/goauthentik/authentik/commit/c07a48a3eccbd7b23026f72136d3392bbc6f795
9d490eb2baf9a9566ead4f805f7dff - https://github.com/goauthentik/authentik/commit/c07a48a3eccbd7b23026f72136d3392bbc6f795a - https://goauthentik.io/docs/releases/2023.4#fixed-in-202343 - https://goauthentik.io/docs/releases/2023.5#fixed-in-202355
CVE ID: CVE-2023-36457 State: PUBLISHED Published: 2023-07-05T20:57:23.640Z Last Updated: 2024-10-18T19:33:33.395Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-77 Description: 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8x -
: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8x - https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6
CVE ID: CVE-2023-36458 State: PUBLISHED Published: 2023-07-05T20:57:19.130Z Last Updated: 2024-10-18T19:36:17.850Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-77 Description: 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. The vulnerability has been fixed in v1.3.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7x2c-fgx6-xf9h
ner: - CISA ADP Vulnrichment: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7x2c-fgx6-xf9h - https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6
CVE ID: CVE-2023-36459 State: PUBLISHED Published: 2023-07-06T18:29:07.669Z Last Updated: 2025-02-13T16:56:17.330Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: mastodon Products: mastodon Problem Types: CWE-79 Description: Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a ma
a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hp - https://github.com/mastodon/mastodon/commit/6d8e0fae3e96f3cf4febe03fa7fcf5b95ff761b2 - https://github.com/mastodon/mastodon/releases/tag/v3.5.9 - https://github.com/mastodon/mastodon/releases/tag/v4.0.5 - https://github.com/mastodon/mastodon/releases/tag/v4.1.3 - http://www.openwall.com/lists/oss-security/2023/0
ag/v4.0.5 - https://github.com/mastodon/mastodon/releases/tag/v4.1.3 - http://www.openwall.com/lists/oss-security/2023/07/06/5
CVE ID: CVE-2023-36460 State: PUBLISHED Published: 2023-07-06T18:39:09.825Z Last Updated: 2025-02-13T16:56:17.936Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: mastodon Products: mastodon Problem Types: CWE-22 Description: Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. This allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9,
erwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-9928-3cp5-93fm - https://github.com/mastodon/mastodon/commit/dc8f1fbd976ae544720a4e07120d9a91b2722440 - https://github.com/mastodon/mastodon/releases/tag/v3.5.9 - https://github.com/mastodon/mastodon/releases/tag/v4.0.5 - https://github.com/mastodon/mastodon/releases/tag/v4.1.3 - http://www.openwall.com/lists/oss-security/2023/07/06/4
CVE ID: CVE-2023-36461 State: PUBLISHED Published: 2023-07-06T18:57:59.160Z Last Updated: 2025-02-13T16:56:18.466Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: mastodon Products: mastodon Problem Types: CWE-770 Description: Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server bec
vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-9pxv-6qvf-pjwc - https://github.com/mastodon/mastodon/commit/c5929798bf7e56cc2c79b15bed0c4692ded3dcb6 - https://github.com/mastodon/mastodon/releases/tag/v3.5.9 - https://github.com/mastodon/mastodon/releases/tag/v4.0.5 - https://github.com/mastodon/mastodon/releases/tag/v4.1.3 - http://www.openwall.com/lists/oss-security/2023/07/06/7
CVE ID: CVE-2023-36462 State: PUBLISHED Published: 2023-07-06T19:16:37.617Z Last Updated: 2024-10-24T14:25:32.031Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: mastodon Products: mastodon Problem Types: CWE-20 Description: Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing,
. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-55j9-c3mp-6fcq - https://github.com/mastodon/mastodon/commit/610731b03dfcadd887078cb0399f4e514aa1931c - https://github.com/mastodon/mastodon/releases/tag/v3.5.9 - https://github.com/mastodon/mastodon/releases/tag/v4.0.5 - https://github.com/mastodon/mastodon/releases/tag/v4.1.3
CVE ID: CVE-2023-36463 State: PUBLISHED Published: 2023-06-27T19:36:12.701Z Last Updated: 2024-12-03T14:54:16.502Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: jucktnich Products: meldekarten-generator Problem Types: CWE-79 Description: Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connection, to create, store and print registration cards for volunteers. All text fields on the webpage are vulnerable to XSS attacks. The user input isn't (fully) sanitized after submission. This issue has been addressed in commit `77e04f4af` which is included in the `1.0.0b1.1.2` release.
d after submission. This issue has been addressed in commit `77e04f4af` which is included in the `1.0.0b1.1.2` release. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jucktnich/meldekarten-generator/security/advisories/GHSA-f2gp-85cr-vgj7 - https://github.com/jucktnich/meldekarten-generator/commit/77e04f4af85a6d0b08e616d40eaa81877a108c96
CVE ID: CVE-2023-36464 State: PUBLISHED Published: 2023-06-27T21:24:30.685Z Last Updated: 2024-12-03T16:56:06.186Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: py-pdf Products: pypdf Problem Types: CWE-835 Description: pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `p
1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8 - https://github.com/py-pdf/pypdf/pull/1828 - https://github.com/py-pdf/pypdf/pull/969
CVE ID: CVE-2023-36465 State: PUBLISHED Published: 2023-10-06T11:56:46.825Z Last Updated: 2024-09-19T18:48:00.313Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) Vendors: decidim Products: decidim Problem Types: CWE-284 Description: Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patc
nel. An attacker could use this vulnerability to change, create or delete templates of surveys. This issue has been patched in version 0.26.8 and 0.27.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/decidim/decidim/security/advisories/GHSA-639h-86hw-qcjq - https://github.com/decidim/decidim/releases/tag/v0.26.8 - https://github.com/decidim/decidim/releases/tag/v0.27.4
CVE ID: CVE-2023-36466 State: PUBLISHED Published: 2023-07-14T21:14:01.476Z Last Updated: 2024-10-22T13:58:48.183Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: discourse Products: discourse Problem Types: CWE-20 Description: Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/d
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-4hjh-wg43-p932
CVE ID: CVE-2023-36467 State: PUBLISHED Published: 2023-06-28T13:55:06.163Z Last Updated: 2024-11-06T17:17:18.002Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: awslabs Products: aws-dataall Problem Types: CWE-94 Description: AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue can only be triggered by authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work
authenticated users. A fix for this issue is available in data.all version 1.5.2 and later. There is no recommended work around. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/awslabs/aws-dataall/security/advisories/GHSA-m922-chh7-8qcr - https://github.com/awslabs/aws-dataall/pull/472 - https://github.com/awslabs/aws-dataall/releases/tag/v1.5.2 - https://github.com/awslabs/aws-dataall/releases/tag/v1.5.4
CVE ID: CVE-2023-36468 State: PUBLISHED Published: 2023-06-29T20:44:33.894Z Last Updated: 2024-11-26T19:13:33.447Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-459 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the vulnerability that was fixed in the new version. The severity of this depends on the fixed vulnerability, for the purpose of this advisory
was fixed in the new version. The severity of this depends on the fixed vulnerability, for the purpose of this advisory take CVE-2022-36100/GHSA-2g5c-228j-p52x as example - it is easily exploitable with just view rights and critical. When XWiki is upgraded from a version before the fix for it (e.g., 14.3) to a version including the fix (e.g., 14.4), the vulnerability can still be reproduced by adding `rev=1.1` to the URL used in the reproduction steps so remote code execution is possible even after upgrading. Therefore, this affects the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability also affects manually added script macros that contained sec
ability of the whole XWiki installation. This vulnerability also affects manually added script macros that contained security vulnerabilities that were later fixed by changing the script macro without deleting the versions with the security vulnerability from the history. This vulnerability doesn't affect freshly installed versions of XWiki. Further, this vulnerability doesn't affect content that is only loaded from the current version of a document like the code of wiki macros or UI extensions. This vulnerability has been patched in XWiki 14.10.7 and 15.2RC1 by forcing old revisions to be executed in a restricted mode that disables all script macros. As a workaround, admins can manually del
revisions to be executed in a restricted mode that disables all script macros. As a workaround, admins can manually delete old revisions of affected documents. A script could be used to identify all installed documents and delete the history for them. However, also manually added and later corrected code may be affected by this vulnerability so it is easy to miss documents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8q9q-r9v2-644m - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2g5c-228j-p52x - https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f3
-platform/security/advisories/GHSA-2g5c-228j-p52x - https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59 - https://jira.xwiki.org/browse/XWIKI-20594
CVE ID: CVE-2023-36469 State: PUBLISHED Published: 2023-06-29T20:38:52.760Z Last Updated: 2024-11-26T19:14:16.578Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-74 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.6 and 15.2RC1. Users are advised to update. As a wor
e access to all wiki contents. This has been patched in XWiki 14.10.6 and 15.2RC1. Users are advised to update. As a workaround the main security fix can be manually applied by patching the affected document `XWiki.Notifications.Code.NotificationRSSService`. This will break the link to the differences, though as this requires additional changes to Velocity templates as shown in the patch. While the default template is available in the instance and can be easily patched, the template for mentions is contained in a `.jar`-file and thus cannot be fixed without replacing that jar. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/x
ar. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-94pf-92hw-2hjc - https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c - https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-7221a548809fa2ba34348556f4b5bd436463c559ebdf691197932ee7ce4478ca - https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-b261c6eac3108c3e6e734054c28a78f59d3439ab72fe8582dadf87670a0d15a4 - https://jira.xwiki.org/browse/XWIKI-20610