Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-26130 State: PUBLISHED Published: 2023-05-30T05:00:02.254Z Last Updated: 2025-02-13T16:44:51.068Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: n/a Products: yhirose/cpp-httplib Problem Types: CWE-93 Description: Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. **Note:** This issue is present due to an incomplete fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507). Additional Analyst
te fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-5591194 - https://gist.github.com/dellalibera/094aece17a86069a7d27f93c8aba2280 - https://github.com/yhirose/cpp-httplib/releases/tag/v0.12.4 - https://github.com/yhirose/cpp-httplib/commit/5b397d455d25a391ba346863830c1949627b4d08 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JY2E7EIRWQMKH6GY4OZOWWBZBY3Q7CGS/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.
/JY2E7EIRWQMKH6GY4OZOWWBZBY3Q7CGS/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6MO4FSKYNSAJVUXYP7LRY7ARUIGKBFL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2RY6PKBU73I45L6YWNYCUK2XBEXEFX7L/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYODHZECXYFC2BNODZPZXZAXOKGMCYAP/
CVE ID: CVE-2023-26131 State: PUBLISHED Published: 2023-05-31T05:00:01.493Z Last Updated: 2025-01-09T20:38:45.687Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: github.com/xyproto/algernon/engine, github.com/xyproto/algernon/themes Problem Types: CWE-79 Description: All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the themes.NoPage(filename, theme) function due to improper user input sanitization. Exploiting this vulnerability is possible when a file/resource is not found. Additional Analyst Notes: - CVE Program C
. Exploiting this vulnerability is possible when a file/resource is not found. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONENGINE-3312111 - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMXYPROTOALGERNONTHEMES-3312112 - https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go%23L514 - https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/themes/html.go%23L145 - https://github.com/xyproto/algernon/blob/aab484608651852d02a8a93f40baf53ed93e639a/engine/handlers.go%23L512
CVE ID: CVE-2023-26132 State: PUBLISHED Published: 2023-06-10T05:00:01.826Z Last Updated: 2025-01-06T17:05:01.815Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: dottie Problem Types: CWE-1321 Description: Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-DOTTIE-3332763 - https://github.com/mickhansen/dottie.js/blob/b48e22714aae4489ea6276452f22cc61980ba5a4/dottie.js%23L107 - https://git
3 - https://github.com/mickhansen/dottie.js/blob/b48e22714aae4489ea6276452f22cc61980ba5a4/dottie.js%23L107 - https://github.com/mickhansen/dottie.js/commit/7d3aee1c9c3c842720506e131de7e181e5c8db68
CVE ID: CVE-2023-26133 State: PUBLISHED Published: 2023-06-12T05:00:01.545Z Last Updated: 2025-01-06T17:03:38.870Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P) Vendors: n/a Products: progressbar.js Problem Types: CWE-1321 Description: All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152 - https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20 - https://github.com/kimmobrunfeldt/prog
progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L20 - https://github.com/kimmobrunfeldt/progressbar.js/blob/74536b9eeeaaf51144706d918ed5a0a679631d96/src/utils.js%23L18
CVE ID: CVE-2023-26134 State: PUBLISHED Published: 2023-06-28T05:00:01.403Z Last Updated: 2024-11-27T14:44:55.077Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: git-commit-info Problem Types: CWE-78 Description: Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec
the hash content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-GITCOMMITINFO-5740174 - https://github.com/JPeer264/node-git-commit-info/issues/24 - https://github.com/JPeer264/node-git-commit-info/commit/f7c491ede51f886a988af9b266797cb24591d18c
CVE ID: CVE-2023-26135 State: PUBLISHED Published: 2023-06-30T05:00:01.815Z Last Updated: 2024-08-02T11:39:06.648Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: flatnest Problem Types: CWE-1321 Description: All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-FLATNEST-3185149 - https://github.com/brycebaril/node-flatnest/issues/4 - https://github.com/brycebaril/node-flatnest/blob/b7d97ec64a04632378db87fcf3577bd51ac3ee39/nest.js%23L43 - https://github.com/brycebaril
com/brycebaril/node-flatnest/blob/b7d97ec64a04632378db87fcf3577bd51ac3ee39/nest.js%23L43 - https://github.com/brycebaril/node-flatnest/commit/27d569baf9d9d25677640edeaf2d13af165868d6
CVE ID: CVE-2023-26136 State: PUBLISHED Published: 2023-07-01T05:00:01.115Z Last Updated: 2025-08-27T20:32:53.151Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: tough-cookie Problem Types: CWE-1321 Description: Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873 - https://github.com/salesforce/to
Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873 - https://github.com/salesforce/tough-cookie/issues/282 - https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e - https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3 - https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/ - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2023-26137 State: PUBLISHED Published: 2023-07-06T05:00:03.695Z Last Updated: 2024-11-19T18:56:29.683Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: drogonframework/drogon Problem Types: CWE-113 Description: All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securi
icious content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-5665554 - https://gist.github.com/dellalibera/666d67165830ded052a1ede2d2c0b02a
CVE ID: CVE-2023-26138 State: PUBLISHED Published: 2023-07-06T05:00:01.214Z Last Updated: 2024-11-19T18:57:08.451Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: drogonframework/drogon Problem Types: CWE-93 Description: All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader function. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-DROG
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-5665555 - https://gist.github.com/dellalibera/d2abd809f32ec6c61be1f41d80edf61b
CVE ID: CVE-2023-26139 State: PUBLISHED Published: 2023-08-01T05:00:01.066Z Last Updated: 2024-10-17T18:59:07.871Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: underscore-keypath Problem Types: CWE-1321 Description: Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like “__proto__”. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-UNDERSCOREKEYPATH-5416714
ogram Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-UNDERSCOREKEYPATH-5416714 - https://gist.github.com/lelecolacola123/cc0d1e73780127aea9482c05f2ff3252
CVE ID: CVE-2023-26140 State: PUBLISHED Published: 2023-08-16T05:00:01.283Z Last Updated: 2024-10-02T17:46:05.668Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: @excalidraw/excalidraw Problem Types: CWE-79 Description: Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658 - https://github.com/excalidraw/excalidraw/pull/6728 - https://github.com/excalidraw/excal
-EXCALIDRAWEXCALIDRAW-5841658 - https://github.com/excalidraw/excalidraw/pull/6728 - https://github.com/excalidraw/excalidraw/commit/b33fa6d6f64d27adc3a47b25c0aa55711740d0af
CVE ID: CVE-2023-26141 State: PUBLISHED Published: 2023-09-14T05:00:00.986Z Last Updated: 2024-09-25T18:16:01.457Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: sidekiq Problem Types: CWE-400 Description: Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107 - https://gist.github.c
: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107 - https://gist.github.com/keeganparr1/1dffd3c017339b7ed5371ed3d81e6b2a - https://github.com/sidekiq/sidekiq/blob/6-x/web/assets/javascripts/dashboard.js%23L6 - https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89
CVE ID: CVE-2023-26142 State: PUBLISHED Published: 2023-09-12T05:00:01.235Z Last Updated: 2024-09-26T14:23:48.768Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: Crow Problem Types: CWE-113 Description: All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
P response headers and inject malicious content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-CROW-5665556 - https://gist.github.com/dellalibera/9247769cc90ed96c0d72ddbcba88c65c
CVE ID: CVE-2023-26143 State: PUBLISHED Published: 2023-09-19T05:00:01.083Z Last Updated: 2024-09-25T15:25:49.067Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P) Vendors: n/a Products: blamer Problem Types: CWE-88 Description: Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ters (--) to communicate the end of options. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-BLAMER-5731318 - https://gist.github.com/lirantal/14c3686370a86461f555d3f0703e02f9 - https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3
CVE ID: CVE-2023-26144 State: PUBLISHED Published: 2023-09-20T05:00:02.129Z Last Updated: 2024-09-24T20:32:17.400Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: graphql Problem Types: CWE-400 Description: Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. **Note:** It was not proven that this vulnerability can crash the process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
bility can crash the process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181 - https://github.com/graphql/graphql-js/pull/3972 - https://github.com/graphql/graphql-js/issues/3955 - https://github.com/graphql/graphql-js/commit/f94b511386c7e47bd0380dcd56553dc063320226 - https://github.com/graphql/graphql-js/releases/tag/v16.8.1
CVE ID: CVE-2023-26145 State: PUBLISHED Published: 2023-09-28T05:00:01.328Z Last Updated: 2024-09-23T19:02:59.017Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P) Vendors: n/a Products: pydash Problem Types: CWE-78 Description: This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects. **Note:** The pydash.objects.invoke() method is v
s and dict items, to retrieve, modify or invoke nested Python objects. **Note:** The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied: 1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible) 2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method) The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function. Additional Analyst Notes: - CVE Program Container: -
ect control over the argument to be passed to the invoked function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PYTHON-PYDASH-5916518 - https://gist.github.com/CalumHutton/45d33e9ea55bf4953b3b31c84703dfca - https://github.com/dgilland/pydash/commit/6ff0831ad285fff937cafd2a853f20cc9ae92021
CVE ID: CVE-2023-26146 State: PUBLISHED Published: 2023-09-29T05:00:01.401Z Last Updated: 2024-09-23T16:30:04.213Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: ithewei/libhv Problem Types: CWE-79 Description: All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is served by the application, the filename is displayed without proper sanitization when it is rendered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730766 - https://gist.github.c
DP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730766 - https://gist.github.com/dellalibera/c53448135480cbe12257c4b413a90d20
CVE ID: CVE-2023-26147 State: PUBLISHED Published: 2023-09-29T05:00:04.105Z Last Updated: 2024-09-23T18:38:45.605Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P) Vendors: n/a Products: ithewei/libhv Problem Types: CWE-113 Description: All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content, like for example additional headers or new response body, leading to a potential XSS vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA AD
ew response body, leading to a potential XSS vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730768 - https://gist.github.com/dellalibera/2be265b56b7b3b00de1a777b9dec0c7b
CVE ID: CVE-2023-26148 State: PUBLISHED Published: 2023-09-29T05:00:03.203Z Last Updated: 2024-09-23T18:39:31.832Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: ithewei/libhv Problem Types: CWE-93 Description: All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769 - https://gist.github.com/d
ulnrichment: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769 - https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e
CVE ID: CVE-2023-26149 State: PUBLISHED Published: 2023-09-28T05:00:02.741Z Last Updated: 2024-09-23T19:01:41.735Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: quill-mention Problem Types: CWE-79 Description: Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. **Note:** If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection attack when a Quill user hits @. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-QUIL
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-QUILLMENTION-5921549 - https://github.com/quill-mention/quill-mention/blob/0aa9847719257496b14ac5401872c4e2ffcbc3d1/src/quill.mention.js%23L391 - https://codepen.io/ALiangLiang/pen/mdQMJXK - https://github.com/quill-mention/quill-mention/issues/255 - https://github.com/quill-mention/quill-mention/pull/341 - https://github.com/quill-mention/quill-mention/commit/e85262ddced0a7f0b6fc8350d236a68bd1e28385
CVE ID: CVE-2023-26150 State: PUBLISHED Published: 2023-10-03T05:00:02.176Z Last Updated: 2024-09-20T14:15:27.187Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: asyncua Problem Types: CWE-287 Description: Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. **Note:** This issue is a result of missing checks for services that require an active session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673435 - https://gist.github
: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673435 - https://gist.github.com/artfire52/84f7279a4119d6f90381ac49d7121121 - https://github.com/FreeOpcUa/opcua-asyncio/issues/1014 - https://github.com/FreeOpcUa/opcua-asyncio/pull/1015 - https://github.com/FreeOpcUa/opcua-asyncio/commit/2be7ce80df05de8d6c6ae1ebce6fa2bb7147844a - https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96 - https://github.com/FreeOpcUa/opcua-asyncio/commit/b4106dfd5037423c9d1810b48a97296b59cde513
CVE ID: CVE-2023-26151 State: PUBLISHED Published: 2023-10-03T05:00:01.093Z Last Updated: 2024-09-20T14:16:00.651Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: asyncua Problem Types: CWE-400 Description: Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709 - https://gist.github.com/artfire52/1540b234350795e0ecb4d672608d
tps://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709 - https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8 - https://github.com/FreeOpcUa/opcua-asyncio/issues/1013 - https://github.com/FreeOpcUa/opcua-asyncio/pull/1039 - https://github.com/FreeOpcUa/opcua-asyncio/commit/f6603daa34a93a658f0e176cb0b9ee5a6643b262 - https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96