Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-31053 State: PUBLISHED Published: 2022-06-13T19:35:10.000Z Last Updated: 2025-04-22T17:54:16.990Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: biscuit-auth Products: biscuit Problem Types: CWE-347 Description: Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The
pecification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/biscuit-auth/biscuit/security/advisories/GHSA-75rw-34q6-72cr - https://eprint.iacr.org/2020/1484
CVE ID: CVE-2022-31054 State: PUBLISHED Published: 2022-06-13T19:40:12.000Z Last Updated: 2025-04-23T18:16:35.943Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: argoproj Products: argo-events Problem Types: CWE-400 Description: Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1. A
o crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57 - https://github.com/argoproj/argo-events/issues/1946 - https://github.com/argoproj/argo-events/pull/1966 - https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35
CVE ID: CVE-2022-31055 State: PUBLISHED Published: 2022-06-13T15:40:10.000Z Last Updated: 2025-04-23T18:16:41.999Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: google Products: kctf Problem Types: CWE-284 Description: kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark them as `public: false` and use `kctf chal debug port-forward` to connect. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
`kctf chal debug port-forward` to connect. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/google/kctf/security/advisories/GHSA-4g2v-6qc6-6jv5 - https://github.com/google/kctf/pull/371 - https://github.com/google/kctf/commit/8cf050be974fcc2fd8aa136701f9a66f2b2a5202
CVE ID: CVE-2022-31056 State: PUBLISHED Published: 2022-06-28T00:00:00.000Z Last Updated: 2025-04-23T18:06:03.824Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-9q9x-7xxh-w4cg - http://packetstormsecurity.com/files/171656/GLPI-10.0.2-SQL-Injection-Remote-Code-Execution.html
CVE ID: CVE-2022-31057 State: PUBLISHED Published: 2022-06-27T19:30:26.000Z Last Updated: 2025-04-23T18:07:50.536Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: shopware Products: shopware Problem Types: CWE-79 Description: Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj - https://github.com/sh
ment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj - https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f - https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022 - https://packagist.org/packages/shopware/shopware
CVE ID: CVE-2022-31058 State: PUBLISHED Published: 2022-06-29T17:55:24.000Z Last Updated: 2025-04-23T18:05:22.399Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Enalean Products: tuleap Problem Types: CWE-89 Description: Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize properly user inputs when constructing the SQL query to retrieve data for the tracker reports. An attacker with the capability to create a new tracker can execute arbitrary SQL queries. Users are advised to upgrade. There is no known workaround for this issue. Additional Analyst Notes
bitrary SQL queries. Users are advised to upgrade. There is no known workaround for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-4v2p-rwq9-3vjf - https://github.com/Enalean/tuleap/commit/b91bcd57c8344ec2a4c1833629e400cef4dd901a - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b91bcd57c8344ec2a4c1833629e400cef4dd901a - https://tuleap.net/plugins/tracker/?aid=27172
CVE ID: CVE-2022-31059 State: PUBLISHED Published: 2022-06-14T19:55:10.000Z Last Updated: 2025-04-23T18:16:11.818Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: discourse Products: discourse-calendar Problem Types: CWE-79 Description: Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Cont
y Policy. This issue is patched in version 1.0.1 of the Discourse Calendar plugin. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-calendar/security/advisories/GHSA-c783-x9vm-xxp5 - https://github.com/discourse/discourse-calendar/pull/280 - https://github.com/discourse/discourse-calendar/commit/2719b9e81994e961bf8c4e12b4556dc9777dd62f
CVE ID: CVE-2022-31060 State: PUBLISHED Published: 2022-06-14T20:15:17.000Z Last Updated: 2025-04-23T18:16:04.855Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable banners. Additional Analyst Notes: - CVE P
a` and `tests-passed` branches of Discourse. As a workaround, one may disable banners. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-5f4f-35fx-gqhq - https://github.com/discourse/discourse/pull/17071 - https://github.com/discourse/discourse/commit/ae6a9079436fb9b20fd051d25fb6d8027f0ec59a
CVE ID: CVE-2022-31061 State: PUBLISHED Published: 2022-06-28T17:55:11.000Z Last Updated: 2025-04-23T18:05:44.059Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Con
upgrade as soon as possible. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-w2gc-v2gm-q7wq - https://github.com/glpi-project/glpi/commit/21ae07d00d0b3230f6235386e98388cfc5bb0514
CVE ID: CVE-2022-31062 State: PUBLISHED Published: 2022-06-20T00:00:00.000Z Last Updated: 2025-04-23T18:09:19.439Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: glpi-project Products: glpi-inventory-plugin Problem Types: CWE-22 Description: ### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.php` file can be deleted if deploy feature is not used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q33f-jcjf-p4v9 - http://packetstormsecurity.com/f
github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q33f-jcjf-p4v9 - http://packetstormsecurity.com/files/171654/GLPI-Glpiinventory-1.0.1-Local-File-Inclusion.html
CVE ID: CVE-2022-31063 State: PUBLISHED Published: 2022-06-29T17:55:12.000Z Last Updated: 2025-04-23T18:05:28.807Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Enalean Products: tuleap Problem Types: CWE-79 Description: Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious user with the capability to create a document could force victim to execute uncontrolled code. Users are advised to upgrade. There are no known w
to create a document could force victim to execute uncontrolled code. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-4fx8-4ff3-96jf - https://github.com/Enalean/tuleap/commit/c947975a4f1ff7bbfd7d5cd24a2e16bf12bd96d4 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=c947975a4f1ff7bbfd7d5cd24a2e16bf12bd96d4 - https://tuleap.net/plugins/tracker/?aid=27173
CVE ID: CVE-2022-31064 State: PUBLISHED Published: 2022-06-27T19:50:14.000Z Last Updated: 2025-04-22T17:53:58.466Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-79 Description: BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue. Additional Analyst Notes
e has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/pull/15090 - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-hwv2-5pf5-hr87 - https://github.com/bigbluebutton/bigbluebutton/pull/15067 - https://pentests.nl/pentest-blog/stored-xss-in-bigbluebutton/ - http://seclists.org/fulldisclosure/2022/Jun/52 - http://packetstormsecurity.com/files/167682/BigBlueButton-2.3-2.4.7-Cross-Site-Scripting.html
CVE ID: CVE-2022-31065 State: PUBLISHED Published: 2022-06-27T19:45:21.000Z Last Updated: 2025-04-23T18:07:44.554Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-79 Description: BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker (whose username contains malicious JavaScript), the script gets executed. Additionally when the victim receives a notification that the attacker has left the session. This issue has been patched in ve
onally when the victim receives a notification that the attacker has left the session. This issue has been patched in version 2.4.8 and 2.5.0. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8m2p-7qv3-qff7 - https://github.com/bigbluebutton/bigbluebutton/pull/15087 - https://github.com/bigbluebutton/bigbluebutton/pull/15090
CVE ID: CVE-2022-31066 State: PUBLISHED Published: 2022-06-14T21:55:11.000Z Last Updated: 2025-04-23T18:15:12.447Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: edgexfoundry Products: edgex-go Problem Types: CWE-200 Description: EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, the /api/v2/config endpoint exposes message bus credentials to local unauthenticated users. In security-enabled mode, message bus credentials are supposed to be kept in the EdgeX secret store and require authentication to access. This vulnerability bypasses the access controls on message bus cr
geX secret store and require authentication to access. This vulnerability bypasses the access controls on message bus credentials when running in security-enabled mode. (No credentials are required when running in security-disabled mode.) As a result, attackers could intercept data or inject fake data into the EdgeX message bus. Users should upgrade to EdgeXFoundry Kamakura release (2.2.0) or to the June 2022 EdgeXFoundry LTS Jakarta release (2.1.1) to receive a patch. More information about which go modules, docker containers, and snaps contain patches is available in the GitHub Security Advisory. There are currently no known workarounds for this issue. Additional Analyst Notes: - CVE Progr
GitHub Security Advisory. There are currently no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/edgexfoundry/edgex-go/security/advisories/GHSA-g63h-q855-vp3q - https://github.com/edgexfoundry/device-sdk-go/pull/1161 - https://github.com/edgexfoundry/edgex-go/pull/4016
CVE ID: CVE-2022-31068 State: PUBLISHED Published: 2022-06-28T17:50:11.000Z Last Updated: 2025-04-23T18:05:50.048Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-200 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade. Additional Analyst Notes: - CVE Program Contai
ddressed in version 10.0.2 and all affected users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-g4hm-6vfr-q3wg - https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5
CVE ID: CVE-2022-31069 State: PUBLISHED Published: 2022-06-15T19:00:17.000Z Last Updated: 2025-04-23T18:14:09.745Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Finastra Products: finastra-nodejs-libs Problem Types: CWE-200 Description: NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them. A new
rmation such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them. A new feature has been introduced in the patched version of nestjs-proxy that allows application developers to opt out of forwarding the Authorization headers on a per service basis using the `forwardToken` config setting. Developers are advised to review the README for this library on Github or NPM for further details on how this configuration can be applied. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users shou
re advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Finastra/finastra-nodejs-libs/security/advisories/GHSA-j562-c3cw-3p5g - https://github.com/Finastra/finastra-nodejs-libs/pull/231
CVE ID: CVE-2022-31070 State: PUBLISHED Published: 2022-06-15T19:05:12.000Z Last Updated: 2025-04-23T18:13:56.114Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Finastra Products: finastra-nodejs-libs Problem Types: CWE-200 Description: NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application developer. This could have led to sensitive cookies being inadvertently exposed to such services that should not see them. The patched version now blocks cookies from being forw
inadvertently exposed to such services that should not see them. The patched version now blocks cookies from being forwarded by default. However developers can configure an allow-list of cookie names by using the `allowedCookies` config setting. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Finastra/finastra-nodejs-libs/security/advisor
gram Container: - CISA ADP Vulnrichment: References: - https://github.com/Finastra/finastra-nodejs-libs/security/advisories/GHSA-77mv-4rg7-r8qv - https://github.com/Finastra/finastra-nodejs-libs/pull/232
CVE ID: CVE-2022-31071 State: PUBLISHED Published: 2022-06-15T22:35:15.000Z Last Updated: 2025-04-23T18:11:19.222Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: octokit Products: octopoller.rb Problem Types: CWE-276 Description: Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files f
up and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octopoller 0.3.0. Two workarounds are available. Users can use the previous version of the gem, v0.1.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/octokit/octopoller.rb/security/advisories/GHSA-26qj-cr27-r5c4 - https://github.com/octokit/octopoller.rb/commit/abed2b8d05abe2cc3eb6bdfb34e53d465e7c7874
CVE ID: CVE-2022-31072 State: PUBLISHED Published: 2022-06-15T22:35:10.000Z Last Updated: 2025-04-23T18:11:25.606Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: octokit Products: octokit.rb Problem Types: CWE-276 Description: Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files
roup and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/octokit/octokit.rb/security/advisories/GHSA-g28x-pgr3-qqx6 - https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55
CVE ID: CVE-2022-31073 State: PUBLISHED Published: 2022-07-11T20:05:13.000Z Last Updated: 2025-04-22T17:49:21.445Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: kubeedge Products: kubeedge Problem Types: CWE-400 Description: KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the ServiceBus server on the edge side may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to it. It is possible for the node to be exhausted of memory. The consequence of the exhaustion is that other services on the node, e.g. o