Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-3737 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T03:42:53.453Z Vendors: HackerOne Products: sshpk node module Problem Types: CWE-770 Description: sshpk is vulnerable to ReDoS when parsing crafted invalid public keys. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/319593
CVE ID: CVE-2018-3738 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-16T23:46:56.890Z Vendors: HackerOne Products: protobufjs node module Problem Types: CWE-770 Description: protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/319576
CVE ID: CVE-2018-3739 State: PUBLISHED Published: 2018-06-07T02:00:00Z Last Updated: 2024-09-17T04:25:44.584Z Vendors: HackerOne Products: https-proxy-agent node module Problem Types: CWE-400 Description: https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON). Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/319532
CVE ID: CVE-2018-3740 State: PUBLISHED Published: 2018-03-30T19:00:00 Last Updated: 2024-08-05T04:50:30.616Z Vendors: Ryan Grove Products: sanitize (ruby gem) Problem Types: CWE-79 Description: A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4358 - https://github.com/rgrove/sanitize/issues/176 - https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/ - https://github.com/rgrove/sanitize/commit/01629a162e448a83d901456d0ba8b65f3b03d46e
CVE ID: CVE-2018-3741 State: PUBLISHED Published: 2018-03-30T19:00:00 Last Updated: 2024-08-05T04:50:30.644Z Vendors: Rails Products: rails-html-sanitizer Problem Types: CWE-79 Description: There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately. Additional Analyst Notes: - CVE Program Container: Referenc
ld either upgrade or use one of the workarounds immediately. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rails/rails-html-sanitizer/commit/f3ba1a839a35f2ba7f941c15e239a1cb379d56ae
CVE ID: CVE-2018-3742 State: REJECTED Published: 2018-06-01T17:00:00 Last Updated: 2018-06-01T16:57:01 Description: No description available.
CVE ID: CVE-2018-3743 State: PUBLISHED Published: 2018-06-01T17:00:00 Last Updated: 2024-08-05T04:50:30.450Z Vendors: HackerOne Products: hekto Problem Types: CWE-601 Description: Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/320693
CVE ID: CVE-2018-3744 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-16T22:55:33.316Z Vendors: HackerOne Products: html-pages node module Problem Types: CWE-35 Description: The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/306607 - https://github.com/danielcardoso/html-pages/issues/2
CVE ID: CVE-2018-3745 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-17T03:59:23.153Z Vendors: HackerOne Products: atob node module Problem Types: CWE-125 Description: atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/321686 - https://security.netapp.com/advisory/ntap-20230622-0009/
CVE ID: CVE-2018-3746 State: PUBLISHED Published: 2018-06-01T17:00:00 Last Updated: 2024-08-05T04:50:30.717Z Vendors: HackerOne Products: pdfinfojs Problem Types: CWE-77 Description: The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/330957
CVE ID: CVE-2018-3747 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-17T02:02:42.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/316346
CVE ID: CVE-2018-3748 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-17T02:27:36.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in <a> element) allows to execute JavaScript code against any user who opens a directory listing containing such crafted file name. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/310133
CVE ID: CVE-2018-3749 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-16T19:57:31.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/310446
CVE ID: CVE-2018-3750 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-17T02:05:32.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/311333
CVE ID: CVE-2018-3751 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-17T03:38:17.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/311337
CVE ID: CVE-2018-3752 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-16T16:27:49.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/311336
CVE ID: CVE-2018-3753 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-17T04:28:57.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/310706
CVE ID: CVE-2018-3754 State: PUBLISHED Published: 2018-07-03T21:00:00Z Last Updated: 2024-09-16T18:29:31.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user input sanitization. This may allow an attacker to run arbitrary SQL queries when fetching data from database. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/311244
CVE ID: CVE-2018-3755 State: PUBLISHED Published: 2018-06-01T17:00:00 Last Updated: 2024-08-05T04:50:30.615Z Vendors: HackerOne Products: sexstatic Problem Types: CWE-79 Description: XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/328210
CVE ID: CVE-2018-3756 State: PUBLISHED Published: 2018-06-01T19:00:00Z Last Updated: 2024-09-17T03:34:16.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block validator allowing a single node to sign a transaction and/or block multiple times, each with a random nonce, and have other validating nodes accept them as separate valid signatures. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hyperledger/iroha/releases/tag/v1.0.0_beta-2
CVE ID: CVE-2018-3757 State: PUBLISHED Published: 2018-06-01T19:00:00Z Last Updated: 2024-09-16T22:44:55.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/340208 - https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83
CVE ID: CVE-2018-3758 State: PUBLISHED Published: 2018-06-07T21:00:00Z Last Updated: 2024-09-17T02:11:59.627Z Vendors: HackerOne Products: express-cart Problem Types: CWE-22 Description: Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/343726
CVE ID: CVE-2018-3759 State: PUBLISHED Published: 2018-06-13T15:00:00Z Last Updated: 2024-09-16T20:26:38.707Z Vendors: HackerOne Products: private_address_check ruby gem Problem Types: CWE-362 Description: private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147
CVE ID: CVE-2018-3760 State: PUBLISHED Published: 2018-06-26T19:00:00Z Last Updated: 2024-09-16T18:39:20.968Z Vendors: HackerOne Products: Sprockets Problem Types: CWE-22 Description: There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rails/sproc
ork arounds immediately. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5 - https://access.redhat.com/errata/RHSA-2018:2745 - https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ - https://access.redhat.com/errata/RHSA-2018:2244 - https://access.redhat.com/errata/RHSA-2018:2561 - https://access.redhat.com/errata/RHSA-2018:2245 - https://www.debian.org/security/2018/dsa-4242
CVE ID: CVE-2018-3761 State: PUBLISHED Published: 2018-07-05T16:00:00 Last Updated: 2024-08-05T04:50:30.619Z Vendors: Nextcloud Products: Nextcloud Server Problem Types: CWE-287 Description: Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/343111 - https://nextcloud.com/security/advisory/?id=nc-sa-2018-003
CVE ID: CVE-2018-3762 State: PUBLISHED Published: 2018-07-05T16:00:00 Last Updated: 2024-08-05T04:50:30.641Z Vendors: Nextcloud Products: Nextcloud Server Problem Types: CWE-284 Description: Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=nc-sa-2018-002 - https://hackerone.com/reports/358339
CVE ID: CVE-2018-3763 State: PUBLISHED Published: 2018-07-05T16:00:00 Last Updated: 2024-08-05T04:50:30.832Z Vendors: Nextcloud Products: Nextcloud Calendar application Problem Types: CWE-79 Description: In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=nc-sa-2018-004
CVE ID: CVE-2018-3764 State: PUBLISHED Published: 2018-07-05T16:00:00 Last Updated: 2024-08-05T04:50:30.571Z Vendors: Nextcloud Products: Nextcloud Contacts application Problem Types: CWE-79 Description: In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=nc-sa-2018-005
CVE ID: CVE-2018-3766 State: PUBLISHED Published: 2018-07-05T16:00:00 Last Updated: 2024-08-05T04:50:30.741Z Vendors: https://github.com/jtrussell Products: buttle Problem Types: CWE-22 Description: Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/358112
CVE ID: CVE-2018-3767 State: PUBLISHED Published: 2018-07-05T16:00:00 Last Updated: 2024-08-05T04:50:30.651Z Vendors: https://github.com/memcachier Products: memjs Problem Types: CWE-400 Description: `memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/319809
CVE ID: CVE-2018-3768 State: REJECTED Published: 2018-07-05T16:00:00 Last Updated: 2018-07-05T15:57:01 Description: No description available.
CVE ID: CVE-2018-3769 State: PUBLISHED Published: 2018-07-05T16:00:00 Last Updated: 2024-08-05T04:50:30.727Z Vendors: Ruby Grape Products: ruby-grape ruby gem Problem Types: CWE-79 Description: ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ruby-grape/grape/commit/6876b71efc7b03f7ce1be3f075eaa4e7e6de19af - https://github.com/ruby-grape/grape/issues/1762 - https://github.com/ruby-grape/grape/pull/1763
CVE ID: CVE-2018-3770 State: PUBLISHED Published: 2018-07-20T22:00:00Z Last Updated: 2024-09-16T16:42:35.385Z Vendors: HackerOne Products: markdown-pdf Problem Types: CWE-22 Description: A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/360727
CVE ID: CVE-2018-3771 State: PUBLISHED Published: 2018-07-20T22:00:00Z Last Updated: 2024-09-16T17:03:15.839Z Vendors: HackerOne Products: statics-server Problem Types: CWE-79 Description: An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/355458
CVE ID: CVE-2018-3772 State: PUBLISHED Published: 2018-07-30T18:00:00Z Last Updated: 2024-09-17T02:26:55.080Z Vendors: https://github.com/vvo Products: whereis Problem Types: CWE-77 Description: Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/319476
CVE ID: CVE-2018-3773 State: PUBLISHED Published: 2018-07-30T18:00:00Z Last Updated: 2024-09-16T16:07:38.059Z Vendors: https://github.com/microlinkhq Products: metascraper Problem Types: CWE-79 Description: There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/309367
CVE ID: CVE-2018-3774 State: PUBLISHED Published: 2018-08-12T22:00:00 Last Updated: 2024-08-05T04:50:30.463Z Vendors: HackerOne Products: url-parse Problem Types: CWE-425 Description: Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/unshiftio/url-parse/commit/d7b582ec1243e8024e60ac0b62d2569c939ef5de - https://hackerone.com/reports/384029 - https://github.com/unshiftio/url-parse/commit/53b1794e54d0711ceb52505e0f74145270570d5a
CVE ID: CVE-2018-3775 State: PUBLISHED Published: 2018-08-12T22:00:00 Last Updated: 2024-08-05T04:50:30.743Z Vendors: HackerOne Products: Nextcloud Server Problem Types: CWE-287 Description: Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=NC-SA-2018-007 - https://hackerone.com/reports/248656
CVE ID: CVE-2018-3776 State: PUBLISHED Published: 2018-08-12T22:00:00 Last Updated: 2024-08-05T04:50:30.811Z Vendors: HackerOne Products: Nextcloud Server Problem Types: CWE-20 Description: Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/232347 - https://nextcloud.com/security/advisory/?id=NC-SA-2018-006
CVE ID: CVE-2018-3777 State: PUBLISHED Published: 2018-08-03T20:00:00Z Last Updated: 2024-09-17T03:07:25.089Z Vendors: https://github.com/restforce Products: restforce ruby gem Problem Types: CWE-20 Description: Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/restforce/restforce/pull/392
CVE ID: CVE-2018-3778 State: PUBLISHED Published: 2018-08-08T20:00:00Z Last Updated: 2024-09-16T18:18:21.081Z Vendors: HackerOne Products: aedes Problem Types: CWE-285 Description: Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json - https://github.com/mcollina/aedes/issues/212 - https://github.com/mcollina/aedes/issues/211
CVE ID: CVE-2018-3779 State: PUBLISHED Published: 2018-08-10T21:00:00 Last Updated: 2024-08-05T04:50:30.831Z Vendors: HackerOne Products: active-support ruby gem Problem Types: CWE-77 Description: active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/392311
CVE ID: CVE-2018-3780 State: PUBLISHED Published: 2018-08-13T19:00:00 Last Updated: 2024-08-05T04:50:30.460Z Vendors: NextCloud Products: nextcloud/server Problem Types: CWE-79 Description: A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://nextcloud.com/security/advisory/?id=NC-SA-2018-008 - https://hackerone.com/reports/383117
CVE ID: CVE-2018-3781 State: PUBLISHED Published: 2018-08-13T19:00:00 Last Updated: 2024-08-05T04:50:30.649Z Vendors: NextCloud Products: nextcloud/talk Problem Types: CWE-79 Description: A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/383117 - https://nextcloud.com/security/advisory/?id=NC-SA-2018-009
CVE ID: CVE-2018-3782 State: REJECTED Published: 2018-08-13T19:00:00 Last Updated: 2018-08-13T18:57:01 Description: No description available.
CVE ID: CVE-2018-3783 State: PUBLISHED Published: 2018-08-17T13:00:00 Last Updated: 2024-08-05T04:50:30.738Z Vendors: https://github.com/JasonEtco Products: flintcms Problem Types: Privilege Escalation (CAPEC-233) Description: A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/386807
CVE ID: CVE-2018-3784 State: PUBLISHED Published: 2018-08-17T13:00:00 Last Updated: 2024-08-05T04:50:30.738Z Vendors: https://github.com/hunterloftis Products: cryo Problem Types: CWE-94 Description: A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/350418