Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
affect memory usage. This issue has been addressed in PR 808 and versions from 1.27.9 include this fix. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw - https://github.com/py-pdf/pypdf/issues/582 - https://github.com/py-pdf/pypdf/pull/808 - https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html
CVE ID: CVE-2023-36811 State: PUBLISHED Published: 2023-08-30T17:32:06.215Z Last Updated: 2025-02-13T16:56:25.432Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: borgbackup Products: borg Problem Types: CWE-347 Description: borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the repository. This vulnerability does
sert files (with no additional headers) into backups and 2. gain write access to the repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as documented in the change log. Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any "borg check --repair" and before "borg prune".
ing the archives (timestamp and contents valid and as expected) after any "borg check --repair" and before "borg prune". There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/borgbackup/borg/security/advisories/GHSA-8fjr-hghr-4m99 - https://github.com/borgbackup/borg/commit/3eb070191da10c2d3f7bc6484cf3d51c3045f884 - https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZUCQSMAWOJBCRGF6XPKEZ2TPGAPNKIWV/ - https://lists
ect.org/archives/list/package-announce@lists.fedoraproject.org/message/ZUCQSMAWOJBCRGF6XPKEZ2TPGAPNKIWV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5Q3OHXERTU547SEQ3YREZXHOCYNLVD63/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOZDFIYEBIOKSIEAXUJJJFUJTAJ7TF3C/
CVE ID: CVE-2023-36812 State: PUBLISHED Published: 2023-06-30T22:58:33.603Z Last Updated: 2025-02-13T16:56:26.038Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenTSDB Products: opentsdb Problem Types: CWE-74 Description: OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User
er refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenTSDB/opentsdb/security/advisories/GHSA-76f7-9v52-v2fw - https://github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9 - https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba - http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-In
b5369f9fb73da384fab0b23e246309ba - http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html
CVE ID: CVE-2023-36813 State: PUBLISHED Published: 2023-07-05T21:05:53.347Z Last Updated: 2025-02-13T16:56:26.598Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-89 Description: Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue. Additional Analyst Notes: - CVE Program
to update/insert new information. Version 1.2.31 contains a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-9gvq-78jp-jxcx - https://github.com/kanboard/kanboard/commit/25b93343baeaf8ad018dcd87b094e47a5c6a3e0a - https://github.com/kanboard/kanboard/releases/tag/v1.2.31 - https://www.debian.org/security/2023/dsa-5454
CVE ID: CVE-2023-36814 State: PUBLISHED Published: 2023-07-03T16:48:36.149Z Last Updated: 2024-11-22T16:42:47.644Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: zopefoundation Products: Products.CMFCore Problem Types: CWE-770 Description: Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has bee
all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87 - https://github.com/zopefoundation/Products.CMFCore/commit/40f03f43a60f28ca9485c8ef429efef729be54e5
CVE ID: CVE-2023-36815 State: PUBLISHED Published: 2023-07-03T17:44:28.932Z Last Updated: 2024-11-06T17:01:26.967Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: labring Products: sealos Problem Types: CWE-862 Description: Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account `sealos[.] io/v1/Payment`, resulting in the ability to recharge any amount of 1 renminbi (RMB). The charging interface may expose resource information. The namespace of this custom resource would be user's control a
The charging interface may expose resource information. The namespace of this custom resource would be user's control and may have permission to correct it. It is not clear whether a fix exists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/labring/sealos/security/advisories/GHSA-vpxf-q44g-w34w
CVE ID: CVE-2023-36816 State: PUBLISHED Published: 2023-07-03T16:12:17.141Z Last Updated: 2024-11-22T16:44:28.484Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) Vendors: Bubka Products: 2FAuth Problem Types: CWE-79 Description: 2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q
ontainer: - CISA ADP Vulnrichment: References: - https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q - https://github.com/Bubka/2FAuth/releases/tag/v4.0.3
CVE ID: CVE-2023-36817 State: PUBLISHED Published: 2023-07-03T17:54:35.894Z Last Updated: 2024-11-06T16:55:02.330Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: tktchurch Products: website Problem Types: CWE-200, CWE-798 Description: `tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently exposed in the codebase. If an unauthorized party gains access to this key, they could potentially carry out transactions on behalf of the organization, leading to financial loss
cess to this key, they could potentially carry out transactions on behalf of the organization, leading to financial losses. Additionally, they could access sensitive customer information, leading to privacy violations and potential legal implications. The affected component is the codebase of our project, specifically the file(s) where the Stripe API key is embedded. The key should have been stored securely, and not committed to the codebase. The maintainers plan to revoke the leaked Stripe API key immediately, generate a new one, and not commit the key to the codebase. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tktchurch/webs
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tktchurch/website/security/advisories/GHSA-x3m6-5hmf-5x3w
CVE ID: CVE-2023-36818 State: PUBLISHED Published: 2023-07-14T21:16:14.912Z Last Updated: 2024-10-18T17:39:21.316Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-400 Description: Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit `52b003d915`. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisori
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-gxqx-3q2p-37gm - https://github.com/discourse/discourse/commit/52b003d915761f1581ae2d105f3cbe76df7bf1ff
CVE ID: CVE-2023-36819 State: PUBLISHED Published: 2023-07-03T18:21:35.990Z Last Updated: 2024-11-22T16:42:06.308Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: KnowageLabs Products: Knowage-Server Problem Types: CWE-22 Description: Knowage is the professional open source suite for modern business analytics over traditional sources and big data systems. The endpoint `_/knowage/restful-services/dossier/importTemplateFile_` allows authenticated users to download template hosted on the server. However, starting in the 6.x.x branch and prior to version 8.1.8, the application does not sanitize the `_templateName_ `parameter allowing an attacker to use `*../*` i
to version 8.1.8, the application does not sanitize the `_templateName_ `parameter allowing an attacker to use `*../*` in it, and escaping the directory the template are normally placed and download any file from the system. This vulnerability allows a low privileged attacker to exfiltrate sensitive configuration file. This issue has been patched in Knowage version 8.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-jw99-hxxj-75g2
CVE ID: CVE-2023-36820 State: PUBLISHED Published: 2023-10-09T13:30:26.387Z Last Updated: 2024-09-19T14:39:04.617Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: micronaut-projects Products: micronaut-security Problem Types: CWE-284 Description: Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been
ere multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h - https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980
CVE ID: CVE-2023-36821 State: PUBLISHED Published: 2023-07-05T21:14:44.234Z Last Updated: 2024-10-18T19:20:42.222Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: louislam Products: uptime-kuma Problem Types: CWE-20 Description: Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it's i
e web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it's installed by calling `npm install` in the installation directory of the plugin. Because the plugin is not validated against the official list of plugins or installed with `npm install --ignore-scripts`, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution. Version 1.22.1 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-7grx-f945-mj96 - https://github.com/louislam/uptime-kuma/pull/3346 - https://githu
/uptime-kuma/security/advisories/GHSA-7grx-f945-mj96 - https://github.com/louislam/uptime-kuma/pull/3346 - https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.js#L210-L216 - https://github.com/louislam/uptime-kuma/releases/tag/1.22.1
CVE ID: CVE-2023-36822 State: PUBLISHED Published: 2023-07-05T21:18:09.160Z Last Updated: 2024-10-24T18:11:44.833Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: louislam Products: uptime-kuma Problem Types: CWE-22 Description: Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. Before a plugin is downloaded, the plugin installation directory is checked for existence. If it exists, it's r
r login. Before a plugin is downloaded, the plugin installation directory is checked for existence. If it exists, it's removed before the plugin installation. Because the plugin is not validated against the official list of plugins or sanitized, the check for existence and the removal of the plugin installation directory are prone to path traversal. This vulnerability allows an authenticated attacker to delete files from the server Uptime Kuma is running on. Depending on which files are deleted, Uptime Kuma or the whole system may become unavailable due to data loss. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-k
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-vr8x-74pm-6vj7 - https://github.com/louislam/uptime-kuma/pull/3346 - https://github.com/louislam/uptime-kuma/blob/de74efb2e6601dcbcfed32cddefc4078a80fcb0b/server/plugins-manager.js#L75-L80 - https://github.com/louislam/uptime-kuma/releases/tag/1.22.1
CVE ID: CVE-2023-36823 State: PUBLISHED Published: 2023-07-06T15:06:00.509Z Last Updated: 2025-02-13T16:56:27.159Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: rgrove Products: sanitize Problem Types: CWE-79 Description: Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows `style` elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when t
yle` elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. Sanitize 6.0.2 performs additional escaping of CSS in `style` element content, which fixes this issue. Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow `style` elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence `</` as `<\/` in `style` element content. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7 - https://github.co
Container: References: - https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7 - https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb5220 - https://github.com/rgrove/sanitize/releases/tag/v6.0.2 - https://lists.debian.org/debian-lts-announce/2023/11/msg00008.html
CVE ID: CVE-2023-36824 State: PUBLISHED Published: 2023-07-11T16:16:16.432Z Last Updated: 2025-02-13T16:56:27.711Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-122, CWE-131 Description: Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated user
o authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3 - https://github.com/redis/redis/releases/tag/7.0.12 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/ - https://lists.fedoraproject.org/archives/list/packag
lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/ - https://security.netapp.com/advisory/ntap-20230814-0009/
CVE ID: CVE-2023-36825 State: PUBLISHED Published: 2023-07-11T17:49:23.557Z Last Updated: 2024-10-23T15:26:15.129Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: orchidsoftware Products: platform Problem Types: CWE-502 Description: Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their soft
result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/orchidsoftware/platform/security/advisories/GHSA-ph6g-p72v-pc3p - https://github.com/orchidsoftware/platform/releases/tag/14.5.0
CVE ID: CVE-2023-36826 State: PUBLISHED Published: 2023-07-25T18:50:42.350Z Last Updated: 2024-10-03T19:25:30.691Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: getsentry Products: sentry Problem Types: CWE-285, CWE-863 Description: Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on
e permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8 - https://github.com/getsentry/sentry/pull/49680 - https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790
https://github.com/getsentry/sentry/pull/49680 - https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9
CVE ID: CVE-2023-36827 State: PUBLISHED Published: 2023-07-05T21:22:30.715Z Last Updated: 2024-10-24T18:09:21.319Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ethyca Products: fides Problem Types: CWE-22 Description: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. A path traversal (directory traversal) vulnerability affects fides versions lower than version `2.15.1`, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem. The vulnerability is patched in fides `2.15.1`. If the Fid