Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-47870 State: PUBLISHED Published: 2025-08-21T08:02:44.934Z Last Updated: 2025-08-21T13:53:10.862Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-306 Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-47871 State: PUBLISHED Published: 2025-06-30T16:51:13.979Z Last Updated: 2025-06-30T20:48:41.938Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive information about linked private channels including channel name, display name, and participant count through the run metadata API endpoint. Ad
d private channels including channel name, display name, and participant count through the run metadata API endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-47872 State: PUBLISHED Published: 2025-08-08T16:14:18.901Z Last Updated: 2025-08-08T19:13:18.978Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: EG4 Electronics Products: EG4 12kPV, EG4 18kPV, EG4 Flex 21, EG4 Flex 18, EG4 6000XP, EG4 12000XP, EG4 GridBoss Problem Types: CWE-203 Description: The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registered, or does not exist in the database. Combined with the fact that serial numbers are sequentially assigned, this allows an attacker to gain information on the product registration status of differ
bers are sequentially assigned, this allows an attacker to gain information on the product registration status of different S/Ns. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07 - https://eg4electronics.com/contact/
CVE ID: CVE-2025-47884 State: PUBLISHED Published: 2025-05-14T20:35:54.646Z Last Updated: 2025-05-15T13:35:32.601Z Vendors: Jenkins Project Products: Jenkins OpenID Connect Provider Plugin Description: In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a trusted job, potentially gaining unauthorized access to external services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3574
CVE ID: CVE-2025-47885 State: PUBLISHED Published: 2025-05-14T20:35:55.364Z Last Updated: 2025-05-20T14:24:40.222Z Vendors: Jenkins Project Products: Jenkins Health Advisor by CloudBees Plugin Description: Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3559
CVE ID: CVE-2025-47886 State: PUBLISHED Published: 2025-05-14T20:35:56.297Z Last Updated: 2025-05-15T13:28:44.778Z Vendors: Jenkins Project Products: Jenkins Cadence vManager Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3548
CVE ID: CVE-2025-47887 State: PUBLISHED Published: 2025-05-14T20:35:56.876Z Last Updated: 2025-05-15T13:26:54.921Z Vendors: Jenkins Project Products: Jenkins Cadence vManager Plugin Description: Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3548
CVE ID: CVE-2025-47888 State: PUBLISHED Published: 2025-05-14T20:35:57.422Z Last Updated: 2025-05-15T13:24:31.285Z Vendors: Jenkins Project Products: Jenkins DingTalk Plugin Description: Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3353
CVE ID: CVE-2025-47889 State: PUBLISHED Published: 2025-05-14T20:35:58.095Z Last Updated: 2025-05-19T15:25:14.896Z Vendors: Jenkins Project Products: Jenkins WSO2 Oauth Plugin Description: In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log in to controllers using this security realm using any username and any password, including usernames that do not exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3481
CVE ID: CVE-2025-47890 State: PUBLISHED Published: 2025-10-14T15:22:50.356Z Last Updated: 2025-10-16T17:27:36.986Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-601 Description: An URL Redirection to Untrusted Site vulnerabilities [CWE-601] in FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions; FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnric
ated attacker to perform an open redirect attack via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-542
CVE ID: CVE-2025-47891 State: REJECTED Published: N/A Last Updated: 2025-05-14T02:55:08.556Z Description: No description available.
CVE ID: CVE-2025-47892 State: REJECTED Published: N/A Last Updated: 2025-05-14T02:55:08.126Z Description: No description available.
CVE ID: CVE-2025-47893 State: REJECTED Published: N/A Last Updated: 2025-05-14T02:55:07.699Z Description: No description available.
CVE ID: CVE-2025-47894 State: REJECTED Published: N/A Last Updated: 2025-05-14T02:55:07.272Z Description: No description available.
CVE ID: CVE-2025-47895 State: REJECTED Published: N/A Last Updated: 2025-05-14T02:55:06.831Z Description: No description available.
CVE ID: CVE-2025-47896 State: REJECTED Published: N/A Last Updated: 2025-05-14T02:55:06.375Z Description: No description available.
CVE ID: CVE-2025-47897 State: REJECTED Published: N/A Last Updated: 2025-05-14T02:55:05.925Z Description: No description available.
CVE ID: CVE-2025-47898 State: REJECTED Published: N/A Last Updated: 2025-05-14T02:55:05.477Z Description: No description available.
CVE ID: CVE-2025-47899 State: REJECTED Published: N/A Last Updated: 2025-05-14T02:55:04.942Z Description: No description available.
CVE ID: CVE-2025-47900 State: PUBLISHED Published: 2025-10-20T17:43:33.890Z Last Updated: 2025-10-20T18:02:36.954Z Vendors: Microchip Products: Time Provider 4100 Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-command-execution
CVE ID: CVE-2025-47901 State: PUBLISHED Published: 2025-10-20T17:48:20.775Z Last Updated: 2025-10-21T15:38:55.864Z Vendors: Microchip Products: Time Provider 4100 Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-command-execution-47901
CVE ID: CVE-2025-47902 State: PUBLISHED Published: 2025-10-20T17:52:52.844Z Last Updated: 2025-10-21T15:38:03.210Z Vendors: Microchip Products: Time Provider 4100 Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-remote-sql-command-injection-47902
CVE ID: CVE-2025-47905 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-29T09:03:18.582Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: varnish-software Products: Varnish Cache Problem Types: CWE-444 Description: Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://varnish-cache.org/security/VSV00016.html
CVE ID: CVE-2025-47906 State: PUBLISHED Published: 2025-09-18T18:41:11.847Z Last Updated: 2025-11-04T21:10:54.782Z Vendors: Go standard library Products: os/exec Problem Types: CWE-115: Misinterpretation of Input Description: If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/691775 - https://go.dev/issue/74466 - https://groups.google.com/g/golang-announce/c/x5MKroML2yM - https://pkg.go.dev/vuln/GO-2025-39
ps://go.dev/issue/74466 - https://groups.google.com/g/golang-announce/c/x5MKroML2yM - https://pkg.go.dev/vuln/GO-2025-3956
CVE ID: CVE-2025-47907 State: PUBLISHED Published: 2025-08-07T15:25:30.704Z Last Updated: 2025-11-04T21:10:56.083Z Vendors: Go standard library Products: database/sql Problem Types: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Description: Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other quer
ed results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/cl/693735 - https://go.dev/issue/74831 - https://groups.google.com/g/golang-announce/c/x5MKroML2yM - https://pkg.go.dev/vuln/GO-2025-3849
CVE ID: CVE-2025-47908 State: PUBLISHED Published: 2025-08-06T20:41:31.311Z Last Updated: 2025-08-07T13:47:15.232Z Vendors: github.com/rs/cors Products: github.com/rs/cors Problem Types: CWE-1325: Improperly Controlled Sequential Memory Allocation Description: Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rs/cors/pull/171 - https:
f service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rs/cors/pull/171 - https://github.com/rs/cors/issues/170 - https://pkg.go.dev/vuln/GO-2024-2883
CVE ID: CVE-2025-47909 State: PUBLISHED Published: 2025-08-29T15:55:08.936Z Last Updated: 2025-08-29T18:23:11.763Z Vendors: github.com/gorilla/csrf Products: github.com/gorilla/csrf Problem Types: CWE-346: Origin Validation Error Description: Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, becau
t a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla. Additional Analyst Notes: - CISA ADP Vulnrichmen
he github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/golang/vulndb/issues/3884 - https://pkg.go.dev/vuln/GO-2025-3884
CVE ID: CVE-2025-47910 State: PUBLISHED Published: 2025-09-22T21:01:55.440Z Last Updated: 2025-09-24T13:29:45.405Z Vendors: Go standard library Products: net/http Problem Types: CWE-284: Improper Access Control Description: When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.dev/cl/699275 - https://go.dev/issue/75054 - https://groups.google.com/g/golang-announce/c/PtW9VW21NP
nces: - https://go.dev/cl/699275 - https://go.dev/issue/75054 - https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ - https://pkg.go.dev/vuln/GO-2025-3955
CVE ID: CVE-2025-47912 State: PUBLISHED Published: 2025-10-29T22:10:13.435Z Last Updated: 2025-11-04T21:10:57.384Z Vendors: Go standard library Products: net/url Problem Types: CWE-1286: Improper Validation of Syntactic Correctness of Input Description: The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
brackets. Parse did not enforce this requirement. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://go.dev/issue/75678 - https://go.dev/cl/709857 - https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI - https://pkg.go.dev/vuln/GO-2025-4010
CVE ID: CVE-2025-47913 State: PUBLISHED Published: 2025-11-13T21:29:39.907Z Last Updated: 2025-11-13T21:47:50.864Z Vendors: golang.org/x/crypto Products: golang.org/x/crypto/ssh/agent Problem Types: CWE-703: Improper Handling of Exceptional Conditions Description: SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://go.dev/cl/700295 - https://go.dev/issue/75178 - https://github.com/advisories/GHSA-hcg3-q754-cr77 - https://pkg.go.dev/vuln/GO-2025-4116
CVE ID: CVE-2025-47914 State: PUBLISHED Published: 2025-11-19T20:33:43.126Z Last Updated: 2025-11-20T17:15:00.344Z Vendors: golang.org/x/crypto Products: golang.org/x/crypto/ssh/agent Problem Types: CWE-237 Description: SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA - https://go.dev/cl/721960 - https://go.dev/issue/76364 - https://pkg.go.dev/vuln/GO-2025-4135
CVE ID: CVE-2025-47916 State: PUBLISHED Published: 2025-05-16T00:00:00.000Z Last Updated: 2025-05-17T05:03:09.924Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: invisioncommunity Products: Invision Power Board Problem Types: CWE-1336 Description: Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence
nticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://invisioncommunity.com/release-notes-v5/507-r41/ - https://karmainsecurity.com/KIS-2025-02
CVE ID: CVE-2025-47917 State: PUBLISHED Published: 2025-07-20T00:00:00.000Z Last Updated: 2025-11-03T20:04:39.638Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: Mbed Products: mbedtls Problem Types: CWE-416 Description: Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a
however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/ - https://github.com/Mbed-TLS/mbedtls-docs/blob/
s://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/ - https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-7.md
CVE ID: CVE-2025-47928 State: PUBLISHED Published: 2025-05-15T20:09:48.326Z Last Updated: 2025-05-15T20:18:00.369Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: spotipy-dev Products: spotipy Problem Types: CWE-488 Description: Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `.github/workflows/integration_tests.yml` followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and
ll access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate `GITHUB_TOKEN` and secrets `SPOTIPY_CLIENT_ID`, `SPOTIPY_CLIENT_SECRET`. In particular `GITHUB_TOKEN` which can be used to completely overtake the repo since the token has content write privileges. The `pull_request_target` in GitHub Actions is a major security concern—especially in public repositories—because it executes untrusted code from a PR, but with the context of the base repository, including access to its secrets. Commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f reverted the change that caused the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.
erted the change that caused the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-h25v-8c87-rvm8 - https://github.com/spotipy-dev/spotipy/commit/4f5759dbfb4506c7b6280572a4db1aabc1ac778d - https://github.com/spotipy-dev/spotipy/commit/9dfb7177b8d7bb98a5a6014f8e6436812a47576f
CVE ID: CVE-2025-47929 State: PUBLISHED Published: 2025-05-15T20:11:55.892Z Last Updated: 2025-05-28T19:55:21.103Z Vendors: DumbWareio Products: DumbDrop Problem Types: CWE-79 Description: DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file with a malicious payload. Commit db27b25372eb9071e63583d8faed2111a2b79f1b fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DumbWareio/DumbDrop/security/advisories/GHSA-gj32-5mgw-
Notes: - CISA ADP Vulnrichment: References: - https://github.com/DumbWareio/DumbDrop/security/advisories/GHSA-gj32-5mgw-2w27 - https://github.com/DumbWareio/DumbDrop/commit/db27b25372eb9071e63583d8faed2111a2b79f1b