Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ctron context and perform privileged actions. This issue is only exploitable if an API exposed to the main world via `contextBridge` can return an object or array that contains a javascript object which cannot be serialized, for instance, a canvas rendering context. This would normally result in an exception being thrown `Error: object could not be cloned`. The app side workaround is to ensure that such a case is not possible. Ensure all values returned from a function exposed over the context bridge are supported. This issue has been fixed in versions `25.0.0-alpha.2`, `24.0.1`, `23.2.3`, and `22.3.6`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
.0.1`, `23.2.3`, and `22.3.6`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/electron/electron/security/advisories/GHSA-p7v2-p9m8-qqg7 - https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-support
CVE ID: CVE-2023-29199 State: PUBLISHED Published: 2023-04-14T18:37:03.847Z Last Updated: 2025-02-06T18:45:07.573Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: patriksimek Products: vm2 Problem Types: CWE-913 Description: There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched i
ndbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985 - https://github.com/patriksimek/vm2/issues/516 - https://github.com/patriksimek/vm2/commit/24c724daa7c09f003e556d7cd1c7a8381cb985d7 - https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c - https://github.com/patriksimek/vm2/releases/tag/3.9.16
CVE ID: CVE-2023-29200 State: PUBLISHED Published: 2023-04-25T17:00:29.537Z Last Updated: 2025-02-03T19:37:13.854Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: contao Products: contao Problem Types: CWE-22 Description: Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
eceive a patch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contao/contao/security/advisories/GHSA-fp7q-xhhw-6rj3 - https://github.com/contao/contao/commit/6f3e705f4ff23f4419563d09d8485793569f31df - https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager
CVE ID: CVE-2023-29201 State: PUBLISHED Published: 2023-04-15T14:24:59.250Z Last Updated: 2025-02-06T19:58:35.107Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-commons Problem Types: CWE-79 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `<script>` and `<style>`-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like `<iframe>`. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injecti
<iframe>`. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode. There are no known workarounds apart from upgrading to a version including the fix. A
hat is enabled in restricted mode. There are no known workarounds apart from upgrading to a version including the fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m3jr-cvhj-f35j - https://github.com/xwiki/xwiki-commons/commit/4a185e0594d90cd4916d60aa60bb4333dc5623b2 - https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182 - https://jira.xwiki.org/browse/XCOMMONS-1680 - https://jira.xwiki.org/browse/XCOMMONS-2426 - https://jira.xwiki.org/browse/XWIKI-9118
CVE ID: CVE-2023-29202 State: PUBLISHED Published: 2023-04-15T14:28:44.147Z Last Updated: 2025-02-06T19:58:03.434Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter `content` was set to `true`. This allowed arbitrary HTML and in particular also JavaScript injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of
injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of a user with programming rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content and sabotaging the wiki. The issue has been patched in XWiki 14.6 RC1, the content of the feed is now properly cleaned before being displayed. As a workaround, if the RSS macro isn't used in the wiki, the macro can be uninstalled by deleting `WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar`, where `XX` is XWiki's version, in the web application's directory. Additional
iki-platform-rendering-macro-rss-XX.jar`, where `XX` is XWiki's version, in the web application's directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c885-89fw-55qr - https://github.com/xwiki/xwiki-platform/commit/5c7ebe47c2897e92d8f04fe2e15027e84dc3ec03 - https://jira.xwiki.org/browse/XWIKI-19671
CVE ID: CVE-2023-29203 State: PUBLISHED Published: 2023-04-15T15:17:46.895Z Last Updated: 2025-02-06T19:10:15.998Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-359 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with `uorgsuggest.vm`. This issue only concerns hidden users from main wiki. Note that the disclosed information are the username and the first and last name of users, no other information is leaked. The problem
disclosed information are the username and the first and last name of users, no other information is leaked. The problem has been patched on XWiki 13.10.8, 14.4.3 and 14.7RC1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vvp7-r422-rx83 - https://github.com/xwiki/xwiki-platform/pull/1883 - https://jira.xwiki.org/browse/XWIKI-20007
CVE ID: CVE-2023-29204 State: PUBLISHED Published: 2023-04-15T15:24:22.093Z Last Updated: 2025-02-06T17:06:49.667Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-601 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1. Additional Analyst Notes: - CVE Pro
:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-xwph-x6xj-wggv - https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf - https://jira.xwiki.org/browse/XWIKI-10309 - https://jira.xwiki.org/browse/XWIKI-19994
CVE ID: CVE-2023-29205 State: PUBLISHED Published: 2023-04-15T15:27:05.815Z Last Updated: 2025-02-06T17:11:19.200Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be particularly dangerous since in a standard wiki, any user is able to use the html macro directly in their own user profile page. The problem
s since in a standard wiki, any user is able to use the html macro directly in their own user profile page. The problem has been patched in XWiki 14.8RC1. The patch involves the HTML macros and are systematically cleaned up whenever the user does not have the script correct. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vxf7-mx22-jr24 - https://jira.xwiki.org/browse/XWIKI-18568
CVE ID: CVE-2023-29206 State: PUBLISHED Published: 2023-04-15T15:41:56.041Z Last Updated: 2025-02-06T17:10:25.784Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script allowing to perform some operations when executing by a user with appropriate rights. This has been patched in XWiki 14.9-rc-1 by only
rform some operations when executing by a user with appropriate rights. This has been patched in XWiki 14.9-rc-1 by only executing the script if the author of it has Script rights. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cmvg-w72j-7phx - https://github.com/xwiki/xwiki-platform/commit/fe65bc35d5672dd2505b7ac4ec42aec57d500fbb - https://jira.xwiki.org/browse/XWIKI-19514 - https://jira.xwiki.org/browse/XWIKI-19583 - https://jira.xwiki.org/browse/XWIKI-9119
CVE ID: CVE-2023-29207 State: PUBLISHED Published: 2023-04-15T15:48:05.169Z Last Updated: 2025-02-06T17:09:20.011Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing column names, thus allowing the insertion of raw HTML code including JavaScript. This vulnerability was also exploitable via the Documents Macro that is included since XWiki 3.5M1 and doesn't require script rights, this can be demonstrated with the syntax `{{documents id="example" count="5" actions="fal
doesn't require script rights, this can be demonstrated with the syntax `{{documents id="example" count="5" actions="false" columns="doc.title, before<script>alert(1)</script>after"/}}`. Therefore, this can also be exploited by users without script right and in comments. With the interaction of a user with more rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content. This has been patched in XWiki 14.9, 14.4.6, and 13.10.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories
VE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6vgh-9r3c-2cxp - https://github.com/xwiki/xwiki-platform/commit/65ca06c51e7a1d5a579344c7272b2cc9a9a21126 - https://jira.xwiki.org/browse/XWIKI-15205
CVE ID: CVE-2023-29208 State: PUBLISHED Published: 2023-04-15T15:52:47.431Z Last Updated: 2025-02-06T17:08:49.510Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-668 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked. The problem has been patched in XWiki 14.10 by checking the rights of current user: only
document are properly checked. The problem has been patched in XWiki 14.10 by checking the rights of current user: only admin and deleter of the document are allowed to view it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8g-fq6x-jqrr - https://github.com/xwiki/xwiki-platform/commit/d9e947559077e947315bf700c5703dfc7dd8a8d7 - https://jira.xwiki.org/browse/XWIKI-16285
CVE ID: CVE-2023-29209 State: PUBLISHED Published: 2023-04-15T16:06:44.752Z Last Updated: 2025-02-06T17:06:24.027Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the legacy notification activity macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the macro parameters of the legacy notification activity macro. This macro is installed
t cause is improper escaping of the macro parameters of the legacy notification activity macro. This macro is installed by default in XWiki. The vulnerability can be exploited via every wiki page that is editable including the user's profile, but also with just view rights using the HTMLConverter that is part of the CKEditor integration which is bundled with XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9pc2-x9qf-7j2q - https://github.com/xwiki/xwiki-platform/commit/94392490884635c028199275db059a4f471e57bc
dvisories/GHSA-9pc2-x9qf-7j2q - https://github.com/xwiki/xwiki-platform/commit/94392490884635c028199275db059a4f471e57bc - https://jira.xwiki.org/browse/XWIKI-20258
CVE ID: CVE-2023-29210 State: PUBLISHED Published: 2023-04-15T16:20:29.342Z Last Updated: 2025-02-06T17:04:48.251Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provide the notification filters. These macros are use
ause is improper escaping of the user parameter of the macro that provide the notification filters. These macros are used in the user profiles and thus installed by default in XWiki. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-p9mj-v5mf-m82x - https://github.com/xwiki/xwiki-platform/commit/cebf9167e4fd64a8777781fc56461e9abbe0b32a - https://jira.xwiki.org/browse/XWIKI-20259
CVE ID: CVE-2023-29211 State: PUBLISHED Published: 2023-04-16T06:34:27.926Z Last Updated: 2025-02-06T17:05:23.638Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10. Additional Analyst Notes: - CVE Program Container:
r. The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4 - https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64 - https://jira.xwiki.org/browse/XWIKI-20297
CVE ID: CVE-2023-29212 State: PUBLISHED Published: 2023-04-16T06:39:52.119Z Last Updated: 2025-02-06T17:03:47.993Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel. The problem has been patched on XWiki 14.4.7, and 14.10. Additional Analyst Notes: - CVE Program Container: - CIS
panel. The problem has been patched on XWiki 14.4.7, and 14.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5f4-p5wv-2475 - https://github.com/xwiki/xwiki-platform/commit/22f249a0eb9f2a64214628217e812a994419b69f#diff-a51a252f0190274464027342b4e3eafc4ae32de4d9c17ef166e54fc5454c5689R214-R217 - https://jira.xwiki.org/browse/XWIKI-20293
CVE ID: CVE-2023-29213 State: PUBLISHED Published: 2023-04-17T21:21:40.977Z Last Updated: 2025-02-05T20:40:19.480Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-74 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.platform:xwiki-platform-logging-ui` it is possible to trick a user with programming rights into visiting a constructed url where e.g., by embedding an image with this URL in a document that is viewed by a user with programming rights which will evaluate an expression in the constructed url and
document that is viewed by a user with programming rights which will evaluate an expression in the constructed url and execute it. This issue has been addressed in versions 13.10.11, 14.4.7, and 14.10. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4655-wh7v-3vmg - https://github.com/xwiki/xwiki-platform/commit/49fdfd633ddfa346c522d2fe71754dc72c9496ca - https://jira.xwiki.org/browse/XWIKI-20291
CVE ID: CVE-2023-29214 State: PUBLISHED Published: 2023-04-16T06:45:57.295Z Last Updated: 2025-02-06T17:02:46.163Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the IncludedDocuments panel. The problem has been patched on XWiki 14.4.7, and 14.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP
The problem has been patched on XWiki 14.4.7, and 14.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qx9h-c5v6-ghqh - https://github.com/xwiki/xwiki-platform/commit/50b4d91418b4150933f0317eb4a94ceaf5b69f67 - https://jira.xwiki.org/browse/XWIKI-20306
CVE ID: CVE-2023-29215 State: PUBLISHED Published: 2023-04-10T07:35:23.690Z Last Updated: 2025-02-13T16:49:02.260Z Vendors: Apache Software Foundation Products: Apache Linkis Problem Types: CWE-502 Description: In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2. Additional Analyst Notes: - CVE Program Cont
ffected. We recommend users upgrade the version of Linkis to version 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/o682wz1ggq491ybvjwokxvcdtnzo76ls - http://www.openwall.com/lists/oss-security/2023/04/10/4
CVE ID: CVE-2023-29216 State: PUBLISHED Published: 2023-04-10T07:37:29.383Z Last Updated: 2025-02-13T16:49:02.797Z Vendors: Apache Software Foundation Products: Apache Linkis Problem Types: CWE-502 Description: In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.a
version 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/18vv0m32oy51nzk8tbz13qdl5569y55l - http://www.openwall.com/lists/oss-security/2023/04/10/5