Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-26017 State: PUBLISHED Published: 2023-05-03T15:24:38.022Z Last Updated: 2025-02-19T21:31:54.725Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: BlueGlass Products: Jobs for WordPress Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.10.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/job-postings/wordpress-jobs-for-wordpress-plugin-2-5-10-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-26020 State: PUBLISHED Published: 2023-02-17T17:24:45.089Z Last Updated: 2025-03-12T20:05:48.412Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H) Vendors: CrafterCMS Products: CrafterCMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023021
m Container: - CISA ADP Vulnrichment: References: - https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023021701
CVE ID: CVE-2023-26021 State: PUBLISHED Published: 2023-04-28T18:23:40.507Z Last Updated: 2025-02-13T16:44:41.403Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: DB2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause. IBM X-Force ID: 247864. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985681 - https://exchange.xforce.ibmcloud.com/vulnerabilities/
nt: References: - https://www.ibm.com/support/pages/node/6985681 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247864 - https://security.netapp.com/advisory/ntap-20230511-0010/
CVE ID: CVE-2023-26022 State: PUBLISHED Published: 2023-04-28T18:26:55.536Z Last Updated: 2025-02-13T16:44:41.975Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: DB2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when an Out of Memory occurs using the DBMS_OUTPUT module. IBM X-Force ID: 247868. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985669 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247868 - https://sec
tps://www.ibm.com/support/pages/node/6985669 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247868 - https://security.netapp.com/advisory/ntap-20230511-0010/
CVE ID: CVE-2023-26023 State: PUBLISHED Published: 2023-07-19T01:34:32.650Z Last Updated: 2024-10-21T13:04:45.326Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Sterling Connect:Express for UNIX Problem Types: CWE-532 Description: Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6999351 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247896
CVE ID: CVE-2023-26024 State: PUBLISHED Published: 2023-12-01T19:07:57.352Z Last Updated: 2024-09-16T18:39:52.723Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Planning Analytics on Cloud Pak for Data Problem Types: CWE-327 Description: IBM Planning Analytics on Cloud Pak for Data 4.0 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication. IBM X-Force ID: 247898. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.ibm.com/support/pages/node/7082784 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247898
CVE ID: CVE-2023-26026 State: PUBLISHED Published: 2023-07-19T01:36:50.900Z Last Updated: 2024-10-25T17:34:31.868Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Planning Analytics Cartridge for Cloud Pak for Data Problem Types: CWE-200 Description: Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6999351 - https://exchange.xforce.ibmcloud.com/vulnerabilities/2478
References: - https://www.ibm.com/support/pages/node/6999351 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247896
CVE ID: CVE-2023-26031 State: PUBLISHED Published: 2023-11-16T08:15:50.808Z Last Updated: 2025-02-13T16:44:42.474Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: CWE-426 Description: Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges. Hadoop 3.3.0 updated the " YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html " to add a feature for executing user-submitted applications in isolated linux c
n/hadoop-yarn-site/SecureContainer.html " to add a feature for executing user-submitted applications in isolated linux containers. The native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs. The patch " YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable" modified the library loading path for loading .so files from "$ORIGIN/" to ""$ORIGIN/:../lib/native/". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced
./lib/native/". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root. If the YARN cluster is accepting work from remote (authenticated) users, and these users' submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges. The fix for the vulnerability is to revert the change, which is done in YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , "Revert YARN-10495". This patch is i
nge, which is done in YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , "Revert YARN-10495". This patch is in hadoop-3.3.5. To determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path "./lib/native/" then it is at risk $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH) Library runpath: [$ORIGIN/:../lib/native/] If it does not, then it is safe: $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH) Library runpath: [$ORIGIN/] For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the s
[$ORIGIN/] For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set $ ls -laF /opt/hadoop/bin/container-executor ---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor A safe installation lacks the suid bit; ideally is also not owned by root. $ ls -laF /opt/hadoop/bin/container-executor -rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor This configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
tion outside secure containers continue to work. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://issues.apache.org/jira/browse/YARN-11441 - https://hadoop.apache.org/cve_list.html - https://lists.apache.org/thread/q9qpdlv952gb4kphpndd5phvl7fkh71r - https://security.netapp.com/advisory/ntap-20240112-0001/
CVE ID: CVE-2023-26032 State: PUBLISHED Published: 2023-02-25T00:55:28.807Z Last Updated: 2025-03-10T21:05:45.221Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-89 Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL query to load the user. If an attacker could determine the HASH key used by ZoneMinder, they could generate a malicious JWT token and use it t
. If an attacker could determine the HASH key used by ZoneMinder, they could generate a malicious JWT token and use it to execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-6c72-q9mw-mwx9
CVE ID: CVE-2023-26033 State: PUBLISHED Published: 2023-02-24T23:29:36.567Z Last Updated: 2025-03-10T21:06:03.363Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: gentoo Products: soko Problem Types: CWE-89 Description: Gentoo soko is the code that powers packages.gentoo.org. Versions prior to 1.0.1 are vulnerable to SQL Injection, leading to a Denial of Service. If the user selects (in user preferences) the "Recently Visited Packages" view for the index page, the value of the `search_history` cookie is used as a base64 encoded comma separated list of atoms. These are string loaded directly into the SQL query with `atom = '%s'` format string. As a result, any
d list of atoms. These are string loaded directly into the SQL query with `atom = '%s'` format string. As a result, any user can modify the browser's cookie value and inject most SQL queries. A proof of concept malformed cookie was generated that wiped the database or changed it's content. On the database, only public data is stored, so there is no confidentiality issues to site users. If it is known that the database was modified, a full restoration of data is possible by performing a full database wipe and performing full update of all components. This issue is patched with commit id 5ae9ca83b73. Version 1.0.1 contains the patch. If users are unable to upgrade immediately, the following wo
th commit id 5ae9ca83b73. Version 1.0.1 contains the patch. If users are unable to upgrade immediately, the following workarounds may be applied: (1.) Use a proxy to always drop the `search_history` cookie until upgraded. The impact on user experience is low. (2.) Sanitize to the value of `search_history` cookie after base64 decoding it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gentoo/soko/security/advisories/GHSA-gp8g-jfq9-5q2g - https://gitweb.gentoo.org/sites/soko.git/commit/?id=5ae9ca83b735804f2bd405592983a73d7fcc42f4
CVE ID: CVE-2023-26034 State: PUBLISHED Published: 2023-02-25T00:58:47.960Z Last Updated: 2025-03-10T21:05:38.281Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-89 Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are affected by a SQL Injection vulnerability. The (blind) SQL Injection vulnerability is present within the `filter[Query][terms][0][attr]` query string parameter of the `/zm/index.php` endpoint. A user with the View or Edit permissions of Events may execute ar
uery string parameter of the `/zm/index.php` endpoint. A user with the View or Edit permissions of Events may execute arbitrary SQL. The resulting impact can include unauthorized data access (and modification), authentication and/or authorization bypass, and remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-222j-wh8m-xjrx
CVE ID: CVE-2023-26035 State: PUBLISHED Published: 2023-02-25T01:07:01.906Z Last Updated: 2025-02-13T16:44:43.135Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-862 Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up cal
xpects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-72rg-h4vf-29gr - http://packetstormsecurity.com/files/175675/ZoneMinder-Snapshots-Command-Injection.html
CVE ID: CVE-2023-26036 State: PUBLISHED Published: 2023-02-25T01:13:30.477Z Last Updated: 2025-03-10T21:05:32.166Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-426 Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the
be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../". This issue is patched in versions 1.36.33 and 1.37.33. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-h5m9-6jjc-cgmw
CVE ID: CVE-2023-26037 State: PUBLISHED Published: 2023-02-25T01:18:41.988Z Last Updated: 2025-03-10T21:05:25.558Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-89 Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
e is fixed in versions 1.36.33 and 1.37.33. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-65jp-2hj3-3733
CVE ID: CVE-2023-26038 State: PUBLISHED Published: 2023-02-25T01:27:39.450Z Last Updated: 2025-03-10T21:05:18.989Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-426 Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33. Additional Analyst Notes: - CVE Program C
the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-wrx3-r8c4-r24w
CVE ID: CVE-2023-26039 State: PUBLISHED Published: 2023-02-25T01:31:36.622Z Last Updated: 2025-03-10T21:05:12.912Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-78 Description: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33. Additional A
ommand to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-44q8-h2pw-cc9g
CVE ID: CVE-2023-26040 State: PUBLISHED Published: 2023-03-17T14:45:35.889Z Last Updated: 2025-02-25T14:54:32.522Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open-source discussion platform. Between versions 3.1.0.beta2 and 3.1.0.beta3 of the `tests-passed` branch, editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack. This issue is patched in version 3.1.0.beta3 of the `tests-passed` branch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-ccfc-qpmp-gq87 - https://github.com/discourse/discourse/commit/a373bf2a01488c206e7feb28a9d2361b22ce6e70
CVE ID: CVE-2023-26041 State: PUBLISHED Published: 2023-02-27T20:16:09.191Z Last Updated: 2025-03-10T18:48:46.855Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-359 Description: Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to 15.0.3. There are no workaround available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
re no workaround available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j53p-r755-v4jf - https://github.com/nextcloud/spreed/pull/8515 - https://hackerone.com/reports/1784310
CVE ID: CVE-2023-26042 State: PUBLISHED Published: 2023-02-27T14:41:24.145Z Last Updated: 2025-03-10T17:48:28.160Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Part-DB Products: Part-DB-server Problem Types: CWE-79 Description: Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later
ode, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-9pmh-gmxx-rg2x - https://github.com/Part-DB/Part-DB-server/pull/227 - https://github.com/Part-DB/Part-DB-server/commit/5b7f44f4eaacad8a79bcedec32780e00d7347099 - https://github.com/Part-DB/Part-DB-server/releases/tag/v1.0.2
CVE ID: CVE-2023-26043 State: PUBLISHED Published: 2023-02-27T20:37:28.684Z Last Updated: 2025-03-10T18:53:48.331Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GeoNode Products: geonode Problem Types: CWE-611 Description: GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/GeoNode/geonode/security/a
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/GeoNode/geonode/security/advisories/GHSA-mcmc-c59m-pqq8 - https://github.com/GeoNode/geonode/commit/2fdfe919f299b21f1609bf898f9dcfde58770ac0
CVE ID: CVE-2023-26044 State: PUBLISHED Published: 2023-05-17T17:24:25.855Z Last Updated: 2025-01-23T19:52:01.375Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: reactphp Products: http Problem Types: CWE-400 Description: react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the RequestBodyBufferMiddleware with very large settings. This might l
ation, but can be exploited when explicitly using the RequestBodyBufferMiddleware with very large settings. This might lead to consuming large amounts of CPU time for processing requests and significantly delay or slow down the processing of legitimate user requests. This issue has been addressed in release 1.9.0. Users are advised to upgrade. Users unable to upgrade may keep the request body limited using RequestBodyBufferMiddleware with a sensible value which should mitigate the issue. An infrastructure or DevOps workaround could be to place a reverse proxy in front of the ReactPHP HTTP server to filter out any excessive HTTP request bodies. Additional Analyst Notes: - CVE Program Containe