Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
disable signature validation and/or avoid adding `gpg` entries for dependencies that do not have signature files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gradle/gradle/security/advisories/GHSA-j6wc-xfg8-jx2j - https://docs.gradle.org/7.5/release-notes.html
CVE ID: CVE-2022-31157 State: PUBLISHED Published: 2022-07-15T17:15:21.000Z Last Updated: 2025-04-23T17:58:11.075Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: packbackbooks Products: lti-1-3-php-library Problem Types: CWE-327 Description: LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random nonces was not sufficiently cryptographically complex. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/packbac
ds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5
CVE ID: CVE-2022-31158 State: PUBLISHED Published: 2022-07-15T17:15:12.000Z Last Updated: 2025-04-23T17:58:17.098Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: packbackbooks Products: lti-1-3-php-library Problem Types: CWE-294 Description: LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gith
nown workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-5p73-qg2v-383h
CVE ID: CVE-2022-31159 State: PUBLISHED Published: 2022-07-15T17:45:12.000Z Last Updated: 2025-04-22T17:49:09.572Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: aws Products: aws-sdk-java Problem Types: CWE-22 Description: The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the
t S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue’s scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`/tmp/foo`, the actor can cause a download to `/tmp/foo-bar`, but
e destinationDirectory. E.g. for destination directory`/tmp/foo`, the actor can cause a download to `/tmp/foo-bar`, but not `/tmp/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
hod return a string containing the substring `..` . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3
CVE ID: CVE-2022-31160 State: PUBLISHED Published: 2022-07-20T00:00:00.000Z Last Updated: 2025-04-22T17:48:33.457Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jquery Products: jquery-ui Problem Types: CWE-79 Description: jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will mak
el. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9 - https://github.com/jquery/jquery-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9 - https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ - h
ry-ui/commit/8cc5bae1caa1fcf96bf5862c5646c787020ba3f9 - https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/ - https://www.drupal.org/sa-contrib-2022-052 - https://security.netapp.com/advisory/ntap-20220909-0007/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB2FJQXCNHO32VGVOC6DY6IPGVE4VDU6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XBR3G3JR5ZIOJDO4224M3INXDS2VFDD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5LGNTICB5BRFAG3DHVVELS6H3CZSQMO/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00015.html
CVE ID: CVE-2022-31161 State: PUBLISHED Published: 2022-07-15T00:00:00.000Z Last Updated: 2025-04-23T18:01:57.263Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: hap-wi Products: roxy-wi Problem Types: CWE-77, CWE-94 Description: Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483 - https://github.com/hap-wi/roxy-wi/releases/tag/v6.1.1.0 - http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html
CVE ID: CVE-2022-31162 State: PUBLISHED Published: 2022-07-21T13:20:12.000Z Last Updated: 2025-04-23T17:57:53.113Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: abdolence Products: slack-morphism-rust Problem Types: CWE-1258, CWE-200 Description: Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive information in application logs. As a workaround, do not print/output requests and responses for OAuth and client configurati
mation in application logs. As a workaround, do not print/output requests and responses for OAuth and client configurations in logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-99j7-mhfh-w84p - https://github.com/abdolence/slack-morphism-rust/releases/tag/v0.41.0
CVE ID: CVE-2022-31163 State: PUBLISHED Published: 2022-07-21T13:30:16 Last Updated: 2024-09-05T14:09:42.030Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: tzinfo Products: tzinfo Problem Types: CWE-22, CWE-23 Description: TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versi
Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `t
from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx - https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61 - https://github.
tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx - https://github.com/tzinfo/tzinfo/releases/tag/v0.3.61 - https://github.com/tzinfo/tzinfo/releases/tag/v1.2.10 - https://github.com/tzinfo/tzinfo/commit/9eddbb5c0e682736f61d0dd803b6031a5db9eadf - https://github.com/tzinfo/tzinfo/commit/9905ca93abf7bf3e387bd592406e403cd18334c7 - https://lists.debian.org/debian-lts-announce/2022/08/msg00009.html
CVE ID: CVE-2022-31164 State: PUBLISHED Published: 2022-07-21T13:35:11.000Z Last Updated: 2025-04-23T17:57:46.757Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: tovyblox Products: tovy Problem Types: CWE-287 Description: Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged users such as the other of the instance. The problem has been patched in version 0.7.51. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tovyblox/tovy/security/advisories/GHSA-j6f8-wh4v-jc37 - https://github.com/tovyblox/tovy
eferences: - https://github.com/tovyblox/tovy/security/advisories/GHSA-j6f8-wh4v-jc37 - https://github.com/tovyblox/tovy/pull/63
CVE ID: CVE-2022-31166 State: PUBLISHED Published: 2022-09-07T14:10:12.000Z Last Updated: 2025-04-22T17:23:46.933Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-269 Description: XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to exploit a bug in XWikiRights resolution of groups to obtain privilege escalation. More specifically, editing a right with the object editor leads to adding a supplementary empty value to groups which is then resolved as a reference to XWiki.WebHome page. Adding an XWikiGroup xobject
ementary empty value to groups which is then resolved as a reference to XWiki.WebHome page. Adding an XWikiGroup xobject to that page then transforms it to a group, any user put in that group would then obtain the privileges related to the edited right. Note that this security issue is normally mitigated by the fact that XWiki.WebHome (and XWiki space in general) should be protected by default for edit rights. The problem has been patched in XWiki 13.10.4 and 14.2RC1 to not consider anymore empty values in XWikiRights. It's possible to work around the problem by setting appropriate rights on XWiki.WebHome page to prevent users to edit it. Additional Analyst Notes: - CVE Program Container: -
ropriate rights on XWiki.WebHome page to prevent users to edit it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g4h6-qp44-wqvx - https://github.com/xwiki/xwiki-platform/pull/1800 - https://jira.xwiki.org/browse/XWIKI-15776 - https://jira.xwiki.org/browse/XWIKI-18386
CVE ID: CVE-2022-31167 State: PUBLISHED Published: 2022-09-07T13:55:11.000Z Last Updated: 2025-04-22T17:23:53.696Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-285, CWE-862 Description: XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry. That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same na
s that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the new one first so that they end up in the security cache and are used for the other too. The problem has been patched in XWiki 12.10.11, 13.10.1, and 13.4.6. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gg53-wf5x-r3r6 - https://jira.xwiki.org/browse/XWIKI-14075 - https://jira.xwiki.org/browse/XWIKI-18983
CVE ID: CVE-2022-31168 State: PUBLISHED Published: 2022-07-22T13:05:12.000Z Last Updated: 2025-04-23T17:57:19.812Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: zulip Products: zulip Problem Types: CWE-285, CWE-863 Description: Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organiza
and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organization administrator can restrict the `Who can create bots` permission to administrators only, and change the ownership of existing bots. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-c3cp-ggg5-9xw5 - https://github.com/zulip/zulip/commit/751b2a03e565e9eb02ffe923b7c24ac73d604034 - https://github.com/zulip/zulip/releases/tag/5.5
CVE ID: CVE-2022-31169 State: PUBLISHED Published: 2022-07-21T13:50:11.000Z Last Updated: 2025-04-23T17:57:39.563Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: bytecodealliance Products: wasmtime Problem Types: CWE-682 Description: Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether s
ch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether sign or zero-extension should happen which resulted in an incorrect value being placed into a register when a division was encountered. The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry and WebAssembly programs could produce unexpected results. This should not impact hosts executing WebAssembly but does affect the correctness of guest programs. This bug has been patched in Wasmtime version 0.38.2
ting WebAssembly but does affect the correctness of guest programs. This bug has been patched in Wasmtime version 0.38.2 and cranelift-codegen 0.85.2. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4 - https://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41
CVE ID: CVE-2022-31170 State: PUBLISHED Published: 2022-07-21T14:00:18.000Z Last Updated: 2025-04-23T17:57:25.929Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: OpenZeppelin Products: openzeppelin-contracts Problem Types: CWE-20 Description: OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `false`. `ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't imp
rrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected, specifically if it returns a value other than 0 or 1. The contracts that may be affected are those that use `ERC165Checker` to check for support for an interface and then handle the lack of support in a way other than reverting. The issue was patched in version 4.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552 - https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-qh9x-gcfh-pcrw
CVE ID: CVE-2022-31171 State: REJECTED Published: 2022-07-20T21:55:08 Last Updated: 2022-07-20T21:55:08 Description: No description available.
CVE ID: CVE-2022-31172 State: PUBLISHED Published: 2022-07-21T13:55:11.000Z Last Updated: 2025-04-23T17:57:33.239Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: OpenZeppelin Products: openzeppelin-contracts Problem Types: CWE-20 Description: OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected. The contracts that may be affected are those tha
t, given a target contract that doesn't implement EIP-1271 as expected. The contracts that may be affected are those that use `SignatureChecker` to check the validity of a signature and handle invalid signatures in a way other than reverting. The issue was patched in version 4.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4g63-c64m-25w9 - https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552
CVE ID: CVE-2022-31173 State: PUBLISHED Published: 2022-08-01T18:50:12.000Z Last Updated: 2025-04-22T17:46:34.192Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: graphql-rust Products: juniper Problem Types: CWE-400 Description: Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should limit the recursion depth manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/graphql-rust/juniper/security/adviso
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/graphql-rust/juniper/security/advisories/GHSA-4rx6-g5vg-5f3j - https://github.com/graphql-rust/juniper/commit/2b609ee057be950e3454b69fadc431d120e407bb - https://github.com/graphql-rust/juniper/commit/8d28cdba6eb10f53490ba41d1b5cb40506c2de22 - https://github.com/graphql-rust/juniper/blob/juniper-v0.15.10/juniper/CHANGELOG.md#01510-2022-07-28
CVE ID: CVE-2022-31175 State: PUBLISHED Published: 2022-08-03T19:05:13.000Z Last Updated: 2025-04-23T17:54:13.307Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ckeditor Products: ckeditor5 Problem Types: CWE-79 Description: CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are `@ckeditor/ckeditor5-markdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Us
rkdown-gfm`, `@ckeditor/ckeditor5-html-support`, and `@ckeditor/ckeditor5-html-embed`. The specific conditions are 1) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor. 2) Destroying the editor instance and 3) Initializing the editor on an element and using an element other than `<textarea>` as a base. The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that depend
5 data pipeline after destroying the editor. This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed features. The problem has been recognized and patched. The fix is available in version 35.0.1. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-42wq-rch8-6f6j - https://ckeditor.com/docs/ckeditor5/latest/features/general-html-support.html - https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html - https://ckeditor.com/doc
neral-html-support.html - https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html - https://ckeditor.com/docs/ckeditor5/latest/features/markdown.html