Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-49351 State: PUBLISHED Published: 2024-11-26T03:11:52.593Z Last Updated: 2024-11-26T15:42:29.302Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Workload Scheduler Problem Types: CWE-256 Description: IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177061
CVE ID: CVE-2024-49352 State: PUBLISHED Published: 2025-02-05T10:58:33.935Z Last Updated: 2025-02-22T21:00:55.875Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-611 Description: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7181480
CVE ID: CVE-2024-49353 State: PUBLISHED Published: 2024-11-26T03:23:32.676Z Last Updated: 2024-11-26T15:41:18.160Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Watson Speech Services Cartridge for IBM Cloud Pak for Data Problem Types: CWE-362 Description: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.0 through 5.0.2 does not properly check inputs to resources that are used concurrently, which might lead to unexpected states, possibly resulting in a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177065
CVE ID: CVE-2024-49354 State: PUBLISHED Published: 2025-01-18T15:17:06.309Z Last Updated: 2025-01-21T20:57:25.694Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-213 Description: IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174120
CVE ID: CVE-2024-49355 State: PUBLISHED Published: 2025-02-20T03:40:05.396Z Last Updated: 2025-08-15T14:50:58.257Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-117 Description: IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183541
CVE ID: CVE-2024-49357 State: PUBLISHED Published: 2024-10-24T21:21:45.700Z Last Updated: 2024-10-25T17:30:21.420Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IceWhaleTech Products: ZimaOS Problem Types: CWE-200 Description: ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/app_order.json` and `http://<Server-IP>/v1/users/image?path=/var/lib/casaos/1/system.json`, expose sensitive data like installed applications and system information without requiring any authentication or aut
n`, expose sensitive data like installed applications and system information without requiring any authentication or authorization. This sensitive data leak can be exploited by attackers to gain detailed knowledge about the system setup, installed applications, and other critical information. As of time of publication, no known patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-hg2h-q5h6-r5c4 - https://youtu.be/H_WoqzM-9Cc
CVE ID: CVE-2024-49358 State: PUBLISHED Published: 2024-10-24T21:25:57.320Z Last Updated: 2024-10-25T17:28:49.916Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IceWhaleTech Products: ZimaOS Problem Types: CWE-203 Description: ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Server-IP>/v1/users/login` in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can be exploited for username enumeration, allowing attackers to determine whether a user exists in the system or not. Attackers can
ited for username enumeration, allowing attackers to determine whether a user exists in the system or not. Attackers can leverage this information in further attacks, such as credential stuffing or targeted password brute-forcing. As of time of publication, no known patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-3f6g-8r88-3mx5 - https://youtu.be/BClx2u8DMfM
CVE ID: CVE-2024-49359 State: PUBLISHED Published: 2024-10-24T21:33:07.687Z Last Updated: 2024-10-25T17:27:38.317Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IceWhaleTech Products: ZimaOS Problem Types: CWE-552 Description: ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Zima_Server_IP:PORT>/v2_1/file` in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on the server. By manipulating the path parameter, attackers can access sensitive system directories such as `/etc`, pote
n the server. By manipulating the path parameter, attackers can access sensitive system directories such as `/etc`, potentially exposing critical configuration files and increasing the risk of further attacks. As of time of publication, no known patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-mwpw-fhrm-728x - https://youtu.be/IuaEH09ot9s
CVE ID: CVE-2024-49360 State: PUBLISHED Published: 2024-11-29T18:11:58.261Z Last Updated: 2024-12-02T20:32:39.725Z Severity: CRITICAL (CVSS 9.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: sandboxie-plus Products: Sandboxie Problem Types: CWE-22 Description: Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users' files in `C:\Sandbox\xxx`. By default in
can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users' files in `C:\Sandbox\xxx`. By default in Windows 7+, the `C:\Users\UserA` folder is not readable by **UserB**. All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\Users are safe. If `UserB` runs a cmd in a sandbox, he will be able to access `C:\Sandox\UserA`. In addition, if **UserB** create a folder `C:\Sandbox\UserA` with malicious ACLs, when **UserA** will user the sandbox, Sandboxie doesn't reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie. Additional Analyst Notes: - CISA ADP Vulnrichment:
. Users are advised to limit access to their systems using Sandboxie. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-4chj-3c28-gvmp
CVE ID: CVE-2024-49361 State: PUBLISHED Published: 2024-10-18T18:55:42.604Z Last Updated: 2024-10-18T20:41:16.532Z Vendors: torinriley Products: ACON Problem Types: CWE-20 Description: ACON is a widely-used library of tools for machine learning that focuses on adaptive correlation optimization. A potential vulnerability has been identified in the input validation process, which could lead to arbitrary code execution if exploited. This issue could allow an attacker to submit malicious input data, bypassing input validation, resulting in remote code execution in certain machine learning applications using the ACON library. All users utilizing ACON’s input-handling functions are potentially at
ne learning applications using the ACON library. All users utilizing ACON’s input-handling functions are potentially at risk. Specifically, machine learning models or applications that ingest user-generated data without proper sanitization are the most vulnerable. Users running ACON on production servers are at heightened risk, as the vulnerability could be exploited remotely. As of time of publication, it is unclear whether a fix is available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/torinriley/ACON/security/advisories/GHSA-345g-6rmp-3cv9
CVE ID: CVE-2024-49362 State: PUBLISHED Published: 2024-11-14T17:37:09.700Z Last Updated: 2024-11-14T21:39:43.794Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L) Vendors: laurent22 Products: joplin Problem Types: CWE-94 Description: Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling ar
s the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7
CVE ID: CVE-2024-49363 State: PUBLISHED Published: 2024-12-18T19:24:34.399Z Last Updated: 2024-12-19T16:46:26.503Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: misskey-dev Products: misskey Problem Types: CWE-405, CWE-674 Description: Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or earlier did not detect proxy loops, which allows remote actors to execute a self-propagating reflected/amplified distributed denial-of-service via a maliciously crafted note. FileServerService.prototype.proxyHandler did not check incoming requests are not coming from an
aliciously crafted note. FileServerService.prototype.proxyHandler did not check incoming requests are not coming from another proxy server. An attacker can execute an amplified denial-of-service by sending a nested proxy request to the server and end the request with a malicious redirect back to another nested proxy request. Leading to unbounded recursion until the original request is timed out. This issue has been addressed in version 2024.11.0-alpha.3. Users are advised to upgrade. Users unable to upgrade may configure the reverse proxy to block requests to the proxy with an empty User-Agent header or one containing Misskey/. An attacker can not effectively modify the User-Agent header wit
an empty User-Agent header or one containing Misskey/. An attacker can not effectively modify the User-Agent header without making another request to the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v236
CVE ID: CVE-2024-49364 State: PUBLISHED Published: 2025-07-01T02:07:06.631Z Last Updated: 2025-07-01T13:16:57.518Z Vendors: bitcoinjs Products: tiny-secp256k1 Problem Types: CWE-522 Description: tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. The Buffer.isBuffer check can be bypassed, resulting in k reuse for different messages, leading to private key extraction over a single invalid message (and a second one for which any message/signature could be taken, e.g.
vate key extraction over a single invalid message (and a second one for which any message/signature could be taken, e.g. previously known valid one). This issue has been patched in version 1.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bitcoinjs/tiny-secp256k1/security/advisories/GHSA-7mc2-6phr-23xc - https://github.com/bitcoinjs/tiny-secp256k1/pull/140
CVE ID: CVE-2024-49365 State: PUBLISHED Published: 2025-07-01T02:07:02.922Z Last Updated: 2025-07-01T13:18:55.447Z Vendors: bitcoinjs Products: tiny-secp256k1 Problem Types: CWE-347 Description: tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. Buffer.isBuffer check can be bypassed, resulting in strange objects being accepted as a message, and those messages could trick verify() into returning false-positive true values. This issue has been patched in version 1.1.7. Addit
ages could trick verify() into returning false-positive true values. This issue has been patched in version 1.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bitcoinjs/tiny-secp256k1/security/advisories/GHSA-5vhg-9xg4-cv9m - https://github.com/bitcoinjs/tiny-secp256k1/pull/140
CVE ID: CVE-2024-49366 State: PUBLISHED Published: 2024-10-21T16:12:00.495Z Last Updated: 2024-10-21T16:42:19.269Z Vendors: 0xJacky Products: nginx-ui Problem Types: CWE-22 Description: Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-prv4-rx44-f7jr - https://github.com/0xJacky/nginx-ui/
es: - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-prv4-rx44-f7jr - https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36
CVE ID: CVE-2024-49367 State: PUBLISHED Published: 2024-10-21T16:24:56.701Z Last Updated: 2024-10-21T16:42:33.926Z Vendors: 0xJacky Products: nginx-ui Problem Types: CWE-862 Description: Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gr34-jgw4-7j4m - https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36
CVE ID: CVE-2024-49368 State: PUBLISHED Published: 2024-10-21T17:04:43.652Z Last Updated: 2024-11-01T03:55:22.893Z Vendors: 0xJacky Products: nginx-ui Problem Types: CWE-20 Description: Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-66m6-27r9-77vm - https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36
CVE ID: CVE-2024-49369 State: PUBLISHED Published: 2024-11-12T16:44:01.713Z Last Updated: 2025-11-03T22:22:15.314Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Icinga Products: icinga2 Problem Types: CWE-295 Description: Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This
API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Icinga/icinga2/security/advisories/GHSA-j7wq-r9mg-9wpv - https://github.com/Icinga/icinga2/commit/0419a2c36de408e9a703aec0962061ec9a285d3c - https://github.com/Icinga/icinga2/commit/2febc5e18ae0c93d989e64ebc2a9fd90e7205ad8 - https://github.com/Icinga/icinga2/commit/3504fc7ed688c10d86988e2029a65efc311393fe - https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6 - htt
88c10d86988e2029a65efc311393fe - https://github.com/Icinga/icinga2/commit/869a7d6f0fe38c748e67bacc1fbdd42c933030f6 - https://github.com/Icinga/icinga2/commit/8fed6608912c752b337d977f730547875a820831 - https://icinga.com/blog/2024/11/12/critical-icinga-2-security-releases-2-14-3
CVE ID: CVE-2024-49370 State: PUBLISHED Published: 2024-10-23T15:10:34.393Z Last Updated: 2024-10-23T17:29:27.020Z Vendors: pimcore Products: pimcore Problem Types: CWE-256 Description: Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is set to true, the change password function in Portal Profile sets the new password. Prior to Pimcore portal engine versions 4.1.7 and 3.1.16, the password is then set without hashing so it can be read by everyone. Everyone who combines PortalUser to PimcoreUsers and change passwords via profile settings could be affected. Versions 4.1.7 and 3.1.16 of the
PortalUser to PimcoreUsers and change passwords via profile settings could be affected. Versions 4.1.7 and 3.1.16 of the Pimcore portal engine fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-74p5-77rq-gfqc
CVE ID: CVE-2024-49373 State: PUBLISHED Published: 2024-10-22T15:58:37.360Z Last Updated: 2024-10-22T17:13:39.706Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: nofusscomputing Products: centurion_erp Problem Types: CWE-653 Description: No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects within organizations they are not apart of. Version 1.2.1 fixes the problem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-5qmx-pr2f-qhj5 - https://github.com/nofusscomputing/cen
ithub.com/nofusscomputing/centurion_erp/security/advisories/GHSA-5qmx-pr2f-qhj5 - https://github.com/nofusscomputing/centurion_erp/pull/358 - https://github.com/nofusscomputing/centurion_erp/commit/c3a4685200faa060167d4fde86e806dc91eddcae
CVE ID: CVE-2024-49375 State: PUBLISHED Published: 2025-01-14T18:59:53.181Z Last Updated: 2025-01-15T15:17:13.557Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: RasaHQ Products: rasa-pro-security-advisories Problem Types: CWE-94, CWE-502 Description: Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution. The prerequisites for this are: 1. The HTTP API must be enabled on the Rasa instance eg with `--enable-api`. This is not the default configuration. 2. For unauthenticated RCE to be e
d on the Rasa instance eg with `--enable-api`. This is not the default configuration. 2. For unauthenticated RCE to be exploitable, the user must not have configured any authentication or other security controls recommended in our documentation. 3. For authenticated RCE, the attacker must posses a valid authentication token or JWT to interact with the Rasa API. This issue has been addressed in rasa version 3.6.21 and all users are advised to upgrade. Users unable to upgrade should ensure that they require authentication and that only trusted users are given access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RasaHQ/rasa-pro-security-advisories/security
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RasaHQ/rasa-pro-security-advisories/security/advisories/GHSA-cpv4-ggrr-7j9v
CVE ID: CVE-2024-49376 State: PUBLISHED Published: 2024-10-25T12:50:33.130Z Last Updated: 2024-10-25T15:05:44.274Z Vendors: autolab Products: Autolab Problem Types: CWE-287 Description: Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm - h
s: - CISA ADP Vulnrichment: References: - https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm - https://github.com/autolab/Autolab/commit/301689ab5c5e39d13bab47b71eaf8998d04bcc9b
CVE ID: CVE-2024-49377 State: PUBLISHED Published: 2024-11-05T18:20:27.173Z Last Updated: 2024-11-05T19:01:22.444Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: OctoPrint Products: OctoPrint Problem Types: CWE-79, CWE-80 Description: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with speci
crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog have been patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will h