Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
eported by the server. A malicious server can change the reported UUID tricking the client to treat it as a different server thus accepting a state completely irrelevant to the one previously retrieved from the server. This issue has been patched in version 1.4.1. As a workaround, when initializing an immudb client object a custom state handler can be used to store the state. Providing custom implementation that ignores the server UUID can be used to ensure that even if the server changes the UUID, client will still consider it to be the same server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/codenotary/immudb/security/advisor
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/codenotary/immudb/security/advisories/GHSA-6cqj-6969-p57x - https://github.com/codenotary/immudb/releases/tag/v1.4.1
CVE ID: CVE-2022-39200 State: PUBLISHED Published: 2022-09-12T20:10:09.000Z Last Updated: 2025-04-23T17:12:01.868Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: matrix-org Products: dendrite Problem Types: CWE-347 Description: Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly
at this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/dendrite/security/advisories/GHSA-pfw4-xjgm-267c - https://github.com/matrix-org/dendrite/commit/2792d0490f3771488bad346981b8c26479a872c3
CVE ID: CVE-2022-39201 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-04-23T16:50:44.284Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: grafana Products: grafana Problem Types: CWE-200 Description: Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. Th
lugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grafana/grafana/releases/tag/v9.1.8 - https://github.com/grafana/grafana/security/advisories/GHSA-x744-mm8v-vpgr - https://github.com/grafana/grafana/commit/b571acc1dc130a33f24742c1f93b93216da6cf57 - https://github.com/grafana/grafana/commit/c658816f5229d17f877579250c07799d3bbaebc9
CVE ID: CVE-2022-39202 State: PUBLISHED Published: 2022-09-13T18:10:15.000Z Last Updated: 2025-04-23T17:11:14.546Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: matrix-org Products: matrix-appservice-irc Problem Types: CWE-269 Description: matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by pr
s incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround users should refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-cq7q-5c67-w39w - https://github.com/matrix-org/matrix-appservice-irc/commit/5f87db
pservice-irc/security/advisories/GHSA-cq7q-5c67-w39w - https://github.com/matrix-org/matrix-appservice-irc/commit/5f87dbed87b4b6dc49b7965ff152ee8535719e67 - https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/
CVE ID: CVE-2022-39203 State: PUBLISHED Published: 2022-09-13T18:15:12.000Z Last Updated: 2025-04-23T17:11:08.544Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: matrix-org Products: matrix-appservice-irc Problem Types: CWE-269 Description: matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround operators may disable dynamic channel joining via `dynami
been patched in matrix-appservice-irc 0.35.0. As a workaround operators may disable dynamic channel joining via `dynamicChannels.enabled` to prevent users from joining new channels, which prevents any new channels being bridged outside of what is already bridged, and what is specified in the config. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/ - https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-xvqg-mv25-rwvw
CVE ID: CVE-2022-39205 State: PUBLISHED Published: 2022-09-13T18:30:13.000Z Last Updated: 2025-04-22T17:22:15.569Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: theonedev Products: onedev Problem Types: CWE-287 Description: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the server to check for branch protections during a push event. It is only intended to be accessed from localhost, but the check relies on the X-Forwa
protections during a push event. It is only intended to be accessed from localhost, but the check relies on the X-Forwarded-For header. Invoking this endpoint leads to the execution of one of various git commands. The environment variables of this command execution can be controlled via query parameters. This allows attackers to write to arbitrary files, which can in turn lead to the execution of arbitrary code. Such an attack would be very hard to detect, which increases the potential impact even more. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/theo
issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-4f9h-h82c-4xm2 - https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e - https://github.com/theonedev/onedev/releases/tag/v7.3.0 - https://blog.sonarsource.com/onedev-remote-code-execution/
CVE ID: CVE-2022-39206 State: PUBLISHED Published: 2022-09-13T18:50:14.000Z Last Updated: 2025-04-22T17:21:49.490Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: theonedev Products: onedev Problem Types: CWE-610 Description: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project could use this to control the Docker daemon on the host machine. This is a known dangerous pattern, as it can be used to break out of Docker containers and, in most cases, gain roo
ine. This is a known dangerous pattern, as it can be used to break out of Docker containers and, in most cases, gain root privileges on the host system. This issue allows regular (non-admin) users to potentially take over the build infrastructure of a OneDev instance. Attackers need to have an account (or be able to register one) and need permission to create a project. Since code.onedev.io has the right preconditions for this to be exploited by remote attackers, it could have been used to hijack builds of OneDev itself, e.g. by injecting malware into the docker images that are built and pushed to Docker Hub. The impact is increased by this as described before. Users are advised to upgrade t
are built and pushed to Docker Hub. The impact is increased by this as described before. Users are advised to upgrade to 7.3.0 or higher. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-gjq9-4xx9-cr3q - https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22 - https://blog.sonarsource.com/onedev-remote-code-execution/
CVE ID: CVE-2022-39207 State: PUBLISHED Published: 2022-09-13T18:50:09.000Z Last Updated: 2025-04-22T17:21:56.594Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-79 Description: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They can be accessed through OneDev's web UI after the successful run of a build. These artifact files are served by the webserver in the same context as the UI without any further restrictions. This leads to Cross-Site Scripting (XSS) when a user creates a build artifact that contains H
any further restrictions. This leads to Cross-Site Scripting (XSS) when a user creates a build artifact that contains HTML. When accessing the artifact, the content is rendered by the browser, including any JavaScript that it contains. Since all cookies (except for the rememberMe one) do not set the HttpOnly flag, an attacker could steal the session of a victim and use it to impersonate them. To exploit this issue, attackers need to be able to modify the content of artifacts, which usually means they need to be able to modify a project's build spec. The exploitation requires the victim to click on an attacker's link. It can be used to elevate privileges by targeting admins of a OneDev insta
es the victim to click on an attacker's link. It can be used to elevate privileges by targeting admins of a OneDev instance. In the worst case, this can lead to arbitrary code execution on the server, because admins can create Server Shell Executors and use them to run any command on the server. This issue has been patched in version 7.3.0. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-27fw-gv88-qrpg - https://github.com/theonedev/onedev/commit/adb6e31476621f824fc3227a695232df830d83ab - https://blog.sonarsource.c
-qrpg - https://github.com/theonedev/onedev/commit/adb6e31476621f824fc3227a695232df830d83ab - https://blog.sonarsource.com/onedev-remote-code-execution/
CVE ID: CVE-2022-39208 State: PUBLISHED Published: 2022-09-13T18:42:28.000Z Last Updated: 2025-04-22T17:22:06.338Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-552 Description: Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenticated users. This directory contains all projects, including their bare git repos and build artifacts. This file disclosure vulnerability can be used by unauthenticated attackers to leak all project files of any project. Since project IDs are incremental, an attacker could iterate t
cated attackers to leak all project files of any project. Since project IDs are incremental, an attacker could iterate through them and leak all project data. This issue has been resolved in version 7.3.0 and users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-h427-rv56-c9h2 - https://github.com/theonedev/onedev/commit/8aa94e0daf8447cdf76d4f27bfda0a85a7ea5822 - https://blog.sonarsource.com/onedev-remote-code-execution/
CVE ID: CVE-2022-39209 State: PUBLISHED Published: 2022-09-15T00:00:00.000Z Last Updated: 2025-04-23T17:10:11.051Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: github Products: cmark-gfm Problem Types: CWE-400 Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but re
3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q - https://github.com/github/cmark-gfm/commit/9d57d8a23142b316282bdfc954cb0ecda40a8655 - https://en.wikipedia.org/wiki/Time_complexity - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject
ikipedia.org/wiki/Time_complexity - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMGP65NANDVKPDMXMKYO2ZV2H2HZJY4P/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUCZN3PEKUCT2JQYQTYOVIJG2KSD6G7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEAAAI4OULDYQ2TA3HOXH54PC3DCBFZS/
CVE ID: CVE-2022-39210 State: PUBLISHED Published: 2022-09-16T23:10:15.000Z Last Updated: 2025-04-23T16:58:38.677Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-22, CWE-200 Description: Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitive information in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. There are no known worka
ormation in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw2w-gpcv-v39f - https://github.com/nextcloud/android/pull/10544
CVE ID: CVE-2022-39211 State: PUBLISHED Published: 2022-09-16T23:10:10.000Z Last Updated: 2025-04-23T16:58:46.383Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-918 Description: Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Co
o 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8 - https://github.com/nextcloud/server/pull/32988 - https://github.com/nextcloud/server/pull/33031
CVE ID: CVE-2022-39212 State: PUBLISHED Published: 2022-09-16T23:15:13.000Z Last Updated: 2025-04-23T16:58:31.042Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame of any participant who has video disabled but a camera selected. It is recommended that the Nextcloud Talk app is upgraded to 13.0.8 or 14.0.4. Users unable to upgrade should select "None" as camera before joining the call. Additional Analyst Notes: - CVE Program Conta
unable to upgrade should select "None" as camera before joining the call. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wq3g-2x46-q2gv - https://github.com/nextcloud/spreed/pull/7673
CVE ID: CVE-2022-39213 State: PUBLISHED Published: 2022-09-15T21:45:12.000Z Last Updated: 2025-04-22T17:21:23.908Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pandatix Products: go-cvss Problem Types: CWE-125 Description: go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using `ParseVector`, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag `v0.4.0`, by the commit `d9d478ff0c13b8b09ace030db9262f3c2fe031f4`. Users are advised to upgrade. Users unable to upgrade may avoid this issue by parsing
c13b8b09ace030db9262f3c2fe031f4`. Users are advised to upgrade. Users unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings that do not have all attributes defined (e.g. `AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M`). As stated in [SECURITY.md](https://github.com/pandatix/go-cvss/blob/master/SECURITY.md), the CPE v2.3 to refer to this Go module is `cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*`. The entry has already been requested to the NVD CPE dictionary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx - https://github.com/pa
hment: References: - https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx - https://github.com/pandatix/go-cvss/commit/d9d478ff0c13b8b09ace030db9262f3c2fe031f4 - https://github.com/pandatix/go-cvss/blob/master/SECURITY.md
CVE ID: CVE-2022-39214 State: PUBLISHED Published: 2023-03-14T15:10:47.933Z Last Updated: 2025-02-25T14:57:54.020Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-863 Description: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4 - https://githu
ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-vj96-j84g-jhx4 - https://github.com/Combodo/iTop/commit/4c1df9927d1dc6b0181ee20721f93346def026fd - https://github.com/Combodo/iTop/commit/bdebea62b642622ed71410b26c81e8537e6e58fa
CVE ID: CVE-2022-39215 State: PUBLISHED Published: 2022-09-15T21:35:11.000Z Last Updated: 2025-04-22T17:21:33.273Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: tauri-apps Products: tauri Problem Types: CWE-22 Description: Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now pr
e. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499 - https://github.com/tauri-apps/tauri/issues/4882 - https://github.com/tauri-apps/tauri/pull/5123 - https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c91539032
ps://github.com/tauri-apps/tauri/pull/5123 - https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678
CVE ID: CVE-2022-39216 State: PUBLISHED Published: 2023-03-14T15:10:51.815Z Last Updated: 2025-02-25T14:57:48.211Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-330 Description: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, the reset password token is generated without any randomness parameter. This may lead to account takeover. The issue is fixed in versions 2.7.8 and 3.0.2-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-hggq-48p2-cmhm - https://github
ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-hggq-48p2-cmhm - https://github.com/Combodo/iTop/commit/35a8b501c9e4e767ec4b36c2586f34d4ab66d229 - https://github.com/Combodo/iTop/commit/f10e9c2d64d0304777660a4f70f1e80850ea864b
CVE ID: CVE-2022-39217 State: PUBLISHED Published: 2022-09-16T23:20:10.000Z Last Updated: 2025-04-23T16:58:22.771Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: some-natalie Products: ghas-to-csv Problem Types: CWE-74 Description: some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue ha