Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rt when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openMF/mifos-mobile/security/advisories/GHSA-9657-33wf-rmvx - https://openmf.github.io/mobileapps.github.io/ - https://github.com/openMF/mifos-mobile/commit/e505f62b92b19292bfdabd6e996ab76abfeaa90d
CVE ID: CVE-2021-21386 State: PUBLISHED Published: 2021-03-24T20:55:14 Last Updated: 2024-08-03T18:09:16.063Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: dwisiswant0 Products: apkleaks Problem Types: CWE-88, CWE-78 Description: APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The prob
sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x - https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382
CVE ID: CVE-2021-21387 State: PUBLISHED Published: 2021-03-19T15:25:12 Last Updated: 2024-08-03T18:09:15.979Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: parabirb Products: wrongthink Problem Types: CWE-319, CWE-326, CWE-358 Description: Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connection. Additionally, the safety number was improperly calculated. It was computed using part of one of the public identity keys inste
onally, the safety number was improperly calculated. It was computed using part of one of the public identity keys instead of being derived from both public identity keys. This caused issues in computing safety numbers which would potentially be exploitable in the real world. Additionally there was inadequate encryption strength due to use of 1024-bit DSA keys. These issues are all fixed in version 2.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/parabirb/wrongthink/security/advisories/GHSA-5jxh-6378-rg7v
CVE ID: CVE-2021-21388 State: PUBLISHED Published: 2021-04-29T17:20:20 Last Updated: 2024-08-03T18:09:16.086Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H) Vendors: sebhildebrandt Products: systeminformation Problem Types: CWE-20, CWE-78 Description: systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services
de, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/systeminformation - https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476 - https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524 - https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46 - https://github.com/sebhildebrandt/systeminformatio
t/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46 - https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f
CVE ID: CVE-2021-21389 State: PUBLISHED Published: 2021-03-26T20:15:14 Last Updated: 2024-08-03T18:09:15.798Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: buddypress Products: BuddyPress Problem Types: CWE-863 Description: BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue. Additional Analyst Notes: - CVE Pr
installations of the plugin should be updated to this version to mitigate the issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3 - https://buddypress.org/2021/03/buddypress-7-2-1-security-release/ - https://codex.buddypress.org/releases/version-7-2-1/
CVE ID: CVE-2021-21390 State: PUBLISHED Published: 2021-03-19T16:00:17 Last Updated: 2024-08-03T18:09:16.085Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: minio Products: minio Problem Types: CWE-924 Description: MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z, there is a vulnerability which enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. In a PUT request using aws-chunked encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skippe
request using aws-chunked encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skipped if the client sends a false chunk size that is much greater than the actual data sent: the server accepts and completes the request without ever reaching the end of the chunk + thereby without ever checking the chunk signature. This is fixed in version RELEASE.2021-03-17T02-33-02Z. As a workaround one can avoid using "aws-chunked" encoding-based chunk signature upload requests instead use TLS. MinIO SDKs automatically disable chunked encoding signature when the server endpoint is configured with TLS. Additional Analyst Notes: - CVE Program Container: References: - https:/
hen the server endpoint is configured with TLS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp - https://github.com/minio/minio/pull/11801 - https://github.com/minio/minio/commit/e197800f9055489415b53cf137e31e194aaf7ba0
CVE ID: CVE-2021-21391 State: PUBLISHED Published: 2021-04-29T00:20:19 Last Updated: 2024-08-03T18:09:15.938Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: ckeditor Products: ckeditor5 Problem Types: CWE-400 Description: CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particu
ce (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0. The problem has been recognized and patched. The fix will be available in version 27.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/%40ckeditor/ckeditor5-markdown-gfm - https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-3rh3-wfr4-76mj - https://www.npmjs.com/package/%40ckeditor/ckeditor5-engine - https://www.npmjs.com/
ity/advisories/GHSA-3rh3-wfr4-76mj - https://www.npmjs.com/package/%40ckeditor/ckeditor5-engine - https://www.npmjs.com/package/%40ckeditor/ckeditor5-font - https://www.npmjs.com/package/%40ckeditor/ckeditor5-image - https://www.npmjs.com/package/%40ckeditor/ckeditor5-list - https://www.npmjs.com/package/%40ckeditor/ckeditor5-media-embed - https://www.npmjs.com/package/%40ckeditor/ckeditor5-paste-from-office - https://www.npmjs.com/package/%40ckeditor/ckeditor5-widget
CVE ID: CVE-2021-21392 State: PUBLISHED Published: 2021-04-12T21:50:14 Last Updated: 2024-08-03T18:09:15.930Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: matrix-org Products: synapse Problem Types: CWE-601 Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending pus
d requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. See referenced GitHub security advisory for details and workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/matrix-synapse/ - https://github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78 - https://github.com/matrix-org/synapse/pull/9240 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4Q
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
CVE ID: CVE-2021-21393 State: PUBLISHED Published: 2021-04-12T21:35:14 Last Updated: 2024-08-03T18:09:15.986Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: matrix-org Products: synapse Problem Types: CWE-20 Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix s
ve use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/matrix-synapse/ - https://github.com/matrix-org/synapse/pull/9321 - https://github.com/matrix-org/synapse/pull/9393 - https://github.com/matrix-org/synapse/security/advisories/GHSA-jrh7-mhhx-6h88 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZN
h7-mhhx-6h88 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
CVE ID: CVE-2021-21394 State: PUBLISHED Published: 2021-04-12T20:45:18 Last Updated: 2024-08-03T18:09:16.108Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: matrix-org Products: synapse Problem Types: CWE-20 Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix s
ve use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. Refer to referenced GitHub security advisory for additional details including workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362 - https://pypi.org/project/matrix-synapse/ - https://github.com/matrix-org/synapse/pull/9321 - https://github.com/matrix-org/synapse/pull/9393 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZN
se/pull/9393 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY/
CVE ID: CVE-2021-21395 State: PUBLISHED Published: 2023-01-27T15:03:32.104Z Last Updated: 2025-03-10T21:18:49.551Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: OpenMage Products: magento-lts Problem Types: CWE-352 Description: Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds. Additional Analyst Notes: - CVE Prog
d. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-r3c9-9j5q-pwv4 - https://hackerone.com/reports/1086752 - https://packagist.org/packages/openmage/magento-lts
CVE ID: CVE-2021-21396 State: PUBLISHED Published: 2021-03-26T21:40:15 Last Updated: 2024-08-03T18:09:16.005Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: wireapp Products: wire-server Problem Types: CWE-200 Description: wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the `GET /users/list-clients` endpoint. The endpoint could be used by any logged in user who could request client details of any other user (no connection required) as far as they can find their User ID. The exposed metadata included id, clas
of any other user (no connection required) as far as they can find their User ID. The exposed metadata included id, class, type, location, time, and cookie. A user on a Wire backend could use this endpoint to find registration time and location for each device for a given list of users. As a workaround, remove `/list-clients` from nginx config. This has been fixed in version 2021-03-02. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wireapp/wire-server/security/advisories/GHSA-qx8q-rhq2-rg4j - https://github.com/wireapp/wire-server/releases/tag/v2021-03-02 - https://github.com/wireapp/wire-server/commit/7ba2bf4140282557cf215e0b2c354d4d08cd3421
CVE ID: CVE-2021-21398 State: PUBLISHED Published: 2021-03-30T15:25:13 Last Updated: 2024-08-03T18:09:16.051Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-79 Description: PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fhhq-4x46-qx77 - https://github.com/PrestaShop/PrestaShop/commit/aaaba8177f3b3c510461b5e3249e30e
ecurity/advisories/GHSA-fhhq-4x46-qx77 - https://github.com/PrestaShop/PrestaShop/commit/aaaba8177f3b3c510461b5e3249e30e60f900205 - https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.3
CVE ID: CVE-2021-21399 State: PUBLISHED Published: 2021-04-13T17:50:13 Last Updated: 2024-08-03T18:09:15.871Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ampache Products: ampache Problem Types: CWE-284 Description: Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and workaround guidance see the referenced GitHub security advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com
referenced GitHub security advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ampache/ampache/security/advisories/GHSA-p9pm-j95j-5mjf
CVE ID: CVE-2021-21400 State: PUBLISHED Published: 2021-04-02T14:50:13 Last Updated: 2024-08-03T18:09:16.057Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: wireapp Products: wire-webapp Problem Types: CWE-200 Description: wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat when the user does not actively give focus to the input field. Input element focus is enforced programatically in version 2021-03-15-production.0. Additional Analyst Notes: - CVE Progra
put element focus is enforced programatically in version 2021-03-15-production.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wireapp/wire-webapp/security/advisories/GHSA-cxwr-f2j3-q8hp - https://github.com/wireapp/wire-webapp/pull/10704 - https://github.com/wireapp/wire-webapp/releases/tag/2021-03-15-production.0 - https://github.com/wireapp/wire-webapp/commit/281f2a9d795f68abe423c116d5da4e1e73a60062
CVE ID: CVE-2021-21401 State: PUBLISHED Published: 2021-03-23T17:45:19 Last Updated: 2024-08-03T18:09:16.087Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: nanopb Products: nanopb Problem Types: CWE-763 Description: Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field i
If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nanopb/nanopb/security/advisories/GHSA-7mv5-5mxh-qg88 - https://github.com/nanopb/nanopb/issues/647 - https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261 - https://github.com/na
pb/issues/647 - https://github.com/nanopb/nanopb/commit/e2f0ccf939d9f82931d085acb6df8e9a182a4261 - https://github.com/nanopb/nanopb/blob/c9124132a604047d0ef97a09c0e99cd9bed2c818/CHANGELOG.txt#L1
CVE ID: CVE-2021-21402 State: PUBLISHED Published: 2021-03-23T19:35:13 Last Updated: 2024-08-03T18:09:16.077Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: jellyfin Products: jellyfin Problem Types: CWE-22 Description: Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict secu
sk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wg4c-c9g9-rxhx - https://github.com/jellyfin/jellyfin/commit/0183ef8e89195f420c48d2600bc0b72f6d3a7fd7 - https://github.com/jellyfin/jellyfin/releases/tag/v10.7.1
CVE ID: CVE-2021-21403 State: PUBLISHED Published: 2021-03-26T17:15:15 Last Updated: 2024-08-03T18:09:15.870Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: kongchuanhujiao Products: server Problem Types: CWE-305 Description: In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is fixed in version 1.3.21. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kongchuanhujiao/server/security/advisories/GHSA-8wrg-m8vm-5fvj - https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1
CVE ID: CVE-2021-21404 State: PUBLISHED Published: 2021-04-06T20:00:15 Last Updated: 2024-08-03T18:09:16.158Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: syncthing Products: syncthing Problem Types: CWE-20 Description: Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Synct
er when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h - https://pkg.go.dev/github.com/syncthing/syncthing - https://github.com/syncthing/syncthing/commit/fb4fdaf4c0a79c22cad000c42ac1394e3ccb6a97 - https://github.com/syncthing/syncthing/releases/tag/v1.15.0