Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38686 State: PUBLISHED Published: 2023-08-04T15:57:15.760Z Last Updated: 2024-10-08T17:50:55.903Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: matrix-org Products: sydent Problem Types: CWE-295 Description: Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails. This is patched in Sydent 2.5.6. When patching,
network can intercept room invitations and address confirmation emails. This is patched in Sydent 2.5.6. When patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. Those who use self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of your operating system. As a workaround, one can ensure Sydent's emails fail to send by setting the configured SMTP server to a loopback or non-routable address under one's control which does not have a listening SMTP server. Additional Analyst N
a loopback or non-routable address under one's control which does not have a listening SMTP server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g - https://github.com/python/cpython/issues/91826 - https://github.com/matrix-org/sydent/pull/574 - https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261 - https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations - https://github.com/matrix-org/sydent/releases/tag/v2.5.6 - https://peps.python.org/pep-0476/
CVE ID: CVE-2023-38687 State: PUBLISHED Published: 2023-08-14T20:21:17.694Z Last Updated: 2024-10-02T20:30:26.774Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: mskocik Products: svelecte Problem Types: CWE-79 Description: Svelecte is a flexible autocomplete/select component written in Svelte. Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScript whenever a Svelecte dropdown is opened. Item names given to Svelecte appear to be directly rendered as HTML by the default item renderer. This means that any HTML tags in the name
Svelecte appear to be directly rendered as HTML by the default item renderer. This means that any HTML tags in the name are rendered as HTML elements not as text. Note that the custom item renderer shown in https://mskocik.github.io/svelecte/#item-rendering is also vulnerable to the same exploit. Any site that uses Svelecte with dynamically created items either from an external source or from user-created content could be vulnerable to an XSS attack (execution of untrusted JavaScript), clickjacking or any other attack that can be performed with arbitrary HTML injection. The actual impact of this vulnerability for a specific application depends on how trustworthy the sources that provide Svel
actual impact of this vulnerability for a specific application depends on how trustworthy the sources that provide Svelecte items are and the steps that the application has taken to mitigate XSS attacks. XSS attacks using this vulnerability are mostly mitigated by a Content Security Policy that blocks inline JavaScript. This issue has been addressed in version 3.16.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mskocik/svelecte/security/advisories/GHSA-7h45-grc5-89wq
CVE ID: CVE-2023-38688 State: PUBLISHED Published: 2023-08-04T16:18:15.288Z Last Updated: 2024-10-09T16:26:21.732Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Xithrius Products: twitch-tui Problem Types: CWE-311 Description: twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
ffed. Version 2.4.1 has a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx - https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a - https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23
CVE ID: CVE-2023-38689 State: PUBLISHED Published: 2023-08-04T16:21:24.289Z Last Updated: 2024-10-10T15:59:28.911Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RS485 Products: LogisticsPipes Problem Types: CWE-502 Description: Logistics Pipes is a modification (a.k.a. mod) for the computer game Minecraft Java Edition. The mod used Java's `ObjectInputStream#readObject` on untrusted data coming from clients or servers over the network resulting in possible remote code execution when sending specifically crafted network packets after connecting. The affected versions were released between 2013 and 2016 and the issue (back then unknown) was fixed in 2016 by a r
ng. The affected versions were released between 2013 and 2016 and the issue (back then unknown) was fixed in 2016 by a refactoring of the network IO code. The issue is present in all Logistics Pipes versions ranged from 0.7.0.91 prior to 0.10.0.71, which were downloaded from different platforms summing up to multi-million downloads. For Minecraft version 1.7.10 the issue was fixed in build 0.10.0.71. Everybody on Minecraft 1.7.10 should check their version number of Logistics Pipes in their modlist and update, if the version number is smaller than 0.10.0.71. Any newer supported Minecraft version (like 1.12.2) never had a Logistics Pipes version with vulnerable code. The best available workar
rted Minecraft version (like 1.12.2) never had a Logistics Pipes version with vulnerable code. The best available workaround for vulnerable versions is to play in singleplayer only or update to newer Minecraft versions and modpacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RS485/LogisticsPipes/security/advisories/GHSA-mcp7-xf3v-25x3 - https://github.com/RS485/LogisticsPipes/commit/39a90b8f2d1a2bcc512ec68c3e139f1dac07aa56 - https://github.com/RS485/LogisticsPipes/commit/527c4f4fb028e9afab29d4e639935010ad7be9e7
CVE ID: CVE-2023-38690 State: PUBLISHED Published: 2023-08-04T16:31:41.840Z Last Updated: 2024-10-08T17:47:24.259Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: matrix-org Products: matrix-appservice-irc Problem Types: CWE-20, CWE-77 Description: matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0.1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to d
1 and above are patched. There are no robust workarounds to the bug. One may disable dynamic channels in the config to disable the most common execution method but others may exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-3pmj-jqqp-2mj3 - https://github.com/matrix-org/matrix-appservice-irc/commit/0afb064635d37e039067b5b3d6423448b93026d3 - https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1
CVE ID: CVE-2023-38691 State: PUBLISHED Published: 2023-08-04T16:34:54.312Z Last Updated: 2024-10-07T13:01:29.642Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: matrix-org Products: matrix-appservice-bridge Problem Types: CWE-287 Description: matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the the same as the se
t check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests. Versions 8.1.2 and 9.0.1 contain a patch. As a workaround, disable the provisioning API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-vc7j-h8xg-fv5x - https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65c
ecurity/advisories/GHSA-vc7j-h8xg-fv5x - https://github.com/matrix-org/matrix-appservice-bridge/commit/4c6723a5e7beda65cdf1ae5dbb882e8beaac8552
CVE ID: CVE-2023-38692 State: PUBLISHED Published: 2023-08-04T17:22:39.567Z Last Updated: 2024-10-10T15:53:49.644Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CloudExplorer-Dev Products: CloudExplorer-Lite Problem Types: CWE-78 Description: CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management. The vulnerability has been fixed in v1.3.1. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CloudExplorer-Dev/C
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-7wrc-f42m-9v5w - https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/blob/v1.3.0/framework/management-center/backend/src/main/java/com/fit2cloud/controller/ModuleManageController.java - https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/releases/tag/v1.3.1
CVE ID: CVE-2023-38693 State: PUBLISHED Published: 2025-03-05T15:37:55.847Z Last Updated: 2025-03-06T21:58:44.944Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: lucee Products: Lucee Problem Types: CWE-611 Description: Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lucee/Lucee/security/advisories/GHSA-vwjx-mmwm-pwrf
CVE ID: CVE-2023-38694 State: PUBLISHED Published: 2023-12-12T17:09:08.237Z Last Updated: 2024-08-02T17:46:56.603Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-79 Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.1.0, a user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Versions 8.18.10, 10.7.0, and 12.1.0 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security/advis
. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-xxc6-35r7-796w
CVE ID: CVE-2023-38695 State: PUBLISHED Published: 2023-08-04T17:25:18.810Z Last Updated: 2024-10-04T19:39:48.430Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: simonsmith Products: cypress-image-snapshot Problem Types: CWE-22 Description: cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in version 8.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/simons
0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/simonsmith/cypress-image-snapshot/security/advisories/GHSA-vxjg-hchx-cc4g - https://github.com/simonsmith/cypress-image-snapshot/issues/15 - https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4 - https://github.com/simonsmith/cypress-image-snapshot/releases/tag/8.0.2
CVE ID: CVE-2023-38696 State: REJECTED Published: N/A Last Updated: 2023-08-04T19:51:54.807Z Description: No description available.
CVE ID: CVE-2023-38697 State: PUBLISHED Published: 2023-08-04T17:32:51.164Z Last Updated: 2024-10-04T19:39:00.470Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: socketry Products: protocol-http1 Problem Types: CWE-444 Description: protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a string of hex digits and should split from chunk data using CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors wh
sing CRLF, and the chunk extension shouldn't contain any invisible character. However, Falcon has following behaviors while disobey the corresponding RFCs: accepting Content-Length header values that have `+` prefix, accepting Content-Length header values that written in hexadecimal with `0x` prefix, accepting `0x` and `+` prefixed chunk size, and accepting LF in chunk extension. This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. This issue is fixed in `protocol-http1` v0.15.1. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/socketry/protocol-http1/security/advisories/GHSA-6jwc-qr2q-7xwj - https://github.com/socketry/protocol-http1/pull/20 - https://github.com/socketry/protocol-http1/commit/e11fc164fd2b36f7b7e785e69fa8859eb06bcedd - https://www.rfc-editor.org/rfc/rfc9112#name-chunked-transfer-coding
CVE ID: CVE-2023-38698 State: PUBLISHED Published: 2023-08-04T17:41:14.426Z Last Updated: 2024-10-03T18:13:44.326Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: ensdomains Products: ens-contracts Problem Types: CWE-190 Description: Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the
ting domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerability resides `@ensdomains/ens-contracts` prior to version 0.0.22. If successfully exploited, this vulnerability would enable attackers to force the expiration of any ENS record, ultimately allowing them to claim the affected domains for themselves. Currently, it would require a malicious DAO to exploit it. Nevertheless, any vulnerability present in the controllers could potentially render this issue exploitable in the future. An additional concern is the possibility of renewal
llers could potentially render this issue exploitable in the future. An additional concern is the possibility of renewal discounts. Should ENS decide to implement a system that offers unlimited .eth domains for a fixed fee in the future, the vulnerability could become exploitable by any user due to the reduced attack cost. Version 0.0.22 contains a patch for this issue. As long as registration cost remains linear or superlinear based on registration duration, or limited to a reasonable maximum (eg, 1 million years), this vulnerability could only be exploited by a malicious DAO. The interim workaround is thus to take no action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
DAO. The interim workaround is thus to take no action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ensdomains/ens-contracts/security/advisories/GHSA-rrxv-q8m4-wch3 - https://github.com/ensdomains/ens-contracts/commit/e6b136e979084de3761c125142620304173990ca - https://github.com/ensdomains/ens-contracts/blob/master/contracts/ethregistrar/BaseRegistrarImplementation.sol#L171
CVE ID: CVE-2023-38699 State: PUBLISHED Published: 2023-08-04T17:53:30.604Z Last Updated: 2024-10-03T18:11:45.928Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: mindsdb Products: mindsdb Problem Types: CWE-311 Description: MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
e validated by default, which is the desired behavior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw - https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b - https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0
CVE ID: CVE-2023-38700 State: PUBLISHED Published: 2023-08-04T18:05:43.187Z Last Updated: 2024-10-03T18:08:51.929Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: matrix-org Products: matrix-appservice-irc Problem Types: CWE-200 Description: matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target. Version 1.0.1n fixes this issue. As a workaround, set the `matrixHandler.eventCacheSize` config value to `0`. This workaround may impact performance. Additional Analyst Notes: - CVE
rixHandler.eventCacheSize` config value to `0`. This workaround may impact performance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c7hh-3v6c-fj4q - https://github.com/matrix-org/matrix-appservice-irc/commit/8bbd2b69a16cbcbeffdd9b5c973fd89d61498d75 - https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1
CVE ID: CVE-2023-38701 State: PUBLISHED Published: 2023-10-04T18:48:52.709Z Last Updated: 2024-09-19T19:05:41.988Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: input-output-hk Products: hydra Problem Types: CWE-20 Description: Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `commit` validator, where they remain until they are either collected into the `head` validator or the protocol initialisation is aborted and the value in the committed UTxOs is returned to the users who committed them. Prior to version 0.12.0, the `commit` validator contains
he committed UTxOs is returned to the users who committed them. Prior to version 0.12.0, the `commit` validator contains a flawed check when the `ViaAbort` redeemer is used, which allows any user to spend any UTxO which is at the validator arbitrarily, meaning an attacker can steal the funds that users are trying to commit into the head validator. The intended behavior is that the funds must be returned to the user which committed the funds and can only be performed by a participant of the head. The `initial` validator also is similarly affected as the same flawed check is performed for the `ViaAbort` redeemer. Due to this issue, an attacker can steal any funds that user's try to commit into
performed for the `ViaAbort` redeemer. Due to this issue, an attacker can steal any funds that user's try to commit into a Hydra head. Also, an attacker can prevent any Hydra head from being successfully opened. It does not allow an attacker to take funds which have been successfully collected into and currently reside in the `head` validator. Version 0.12.0 contains a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/input-output-hk/hydra/security/advisories/GHSA-6x9v-7x5r-w8w6 - https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0120---2023-08-18 - https://github.com/input-output-hk/hydra/blob/mas
com/input-output-hk/hydra/blob/master/CHANGELOG.md#0120---2023-08-18 - https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Commit.hs#L94-L97 - https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Util.hs#L32-L42
CVE ID: CVE-2023-38702 State: PUBLISHED Published: 2023-08-04T18:10:28.899Z Last Updated: 2024-10-08T17:39:16.743Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: KnowageLabs Products: Knowage-Server Problem Types: CWE-22 Description: Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need any authorization to be reached. When the JSP file is uploaded, the attacker just needs to connect to `/knowageqbeengine/foo.jsp` to gain code executi
d. When the JSP file is uploaded, the attacker just needs to connect to `/knowageqbeengine/foo.jsp` to gain code execution on the server. By exploiting this vulnerability, an attacker with low privileges can upload a JSP file to the `knowageqbeengine` directory and gain code execution capability on the server. This issue has been patched in Knowage version 8.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-7mjh-73q3-c3fc