Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
known workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8g9c-c9cm-9c56 - https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10ede - https://jira.xwiki.org/browse/XWIKI-16138
CVE ID: CVE-2023-35152 State: PUBLISHED Published: 2023-06-23T16:41:51.268Z Last Updated: 2024-11-27T20:45:47.820Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually. Additional Analyst Notes: - CVE Program Containe
, 14.10.6, and 15.1. As a workaround, one may apply the patch manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfm - https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39 - https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49 - https://jira.xwiki.org/browse/XWIKI-19900 - https://jira.xwiki.org/browse/XWIKI-20611
CVE ID: CVE-2023-35153 State: PUBLISHED Published: 2023-06-23T17:19:59.290Z Last Updated: 2024-11-29T14:27:48.189Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79, CWE-80 Description: XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` class on a page and setting the payload on the page title. Then, any user visiting `/xwiki/bin/view/AppWithinMinutes/ClassEditSheet` executes the payload. The issue has
age title. Then, any user visiting `/xwiki/bin/view/AppWithinMinutes/ClassEditSheet` executes the payload. The issue has been patched in XWiki 14.4.8, 14.10.4, and 15.0. As a workaround, update `AppWithinMinutes.ClassEditSheet` with a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4wc6-hqv9-qc97 - https://github.com/xwiki/xwiki-platform/commit/1b87fec1e5b5ec00b7a8c3c3f94f6c5e22547392#diff-79e725ec7125cced7d302e1a1f955a76745af26ef28a148981b810e85335d302 - https://jira.xwiki.org/browse/XWIKI-20365
CVE ID: CVE-2023-35154 State: PUBLISHED Published: 2023-06-23T20:20:49.978Z Last Updated: 2024-11-07T20:28:36.023Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: KnowageLabs Products: Knowage-Server Problem Types: CWE-287 Description: Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allowing them access to the application as a normal user. This issue has been patched in version 8.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
patched in version 8.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-48hp-jvv8-cf62
CVE ID: CVE-2023-35155 State: PUBLISHED Published: 2023-06-23T18:15:05.289Z Last Updated: 2024-11-27T20:17:59.193Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). For instance, the following URL execute an `alter` on the browser: `<xwiki-host>/xwiki/bin/view/Main/?viewer=share&send=1&target=&target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+
=1&target=&target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Crenniepak%40intigriti.me%3E&includeDocument=inline&message=I+wanted+to+share+this+page+with+you.`, where `<xwiki-host>` is the URL of your XWiki installation. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fwwj-wg89-7h4c - https://jira.xwiki.org/browse/XWIKI-20370
CVE ID: CVE-2023-35156 State: PUBLISHED Published: 2023-06-23T18:19:56.802Z Last Updated: 2024-11-27T20:12:17.092Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-87 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: > xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWi
hemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-834c-x29c-f42c - https://github.com/xwiki/xwiki-platform/commit/13875a6437d4525ac4aeea25918f2d2dffac9ee1 - https://github.com/xwiki/xwiki-platform/commit/24ec12890ac7fa6daec8d0b3435cfcba11362fd5 - https://github.com/xwiki/xwiki-platform/commi
com/xwiki/xwiki-platform/commit/24ec12890ac7fa6daec8d0b3435cfcba11362fd5 - https://github.com/xwiki/xwiki-platform/commit/e80d22d193df364b07bab7925572720f91a8984a - https://jira.xwiki.org/browse/XWIKI-20341 - https://jira.xwiki.org/browse/XWIKI-20583 - https://jira.xwiki.org/browse/XWIKI-20672
CVE ID: CVE-2023-35157 State: PUBLISHED Published: 2023-06-23T18:22:54.954Z Last Updated: 2024-11-27T20:10:32.697Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-80, CWE-79 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XW
the user ignores the warning about the missing CSRF token. The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-phwm-87rg-27qq - https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf - https://jira.xwiki.org/browse/XWIKI-20339
CVE ID: CVE-2023-35158 State: PUBLISHED Published: 2023-06-23T18:26:37.121Z Last Updated: 2024-11-27T20:09:48.049Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-87 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: > /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4
Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mwxj-g7fw-7hc8 - https://github.com/xwiki/xwiki-platform/commit/d5472100606c8355ed44ada273e91df91f682738 - https://jira.xwiki.org/browse/XWIKI-20352 - https://jira.xwiki.org/browse/XWIKI-20583
CVE ID: CVE-2023-35159 State: PUBLISHED Published: 2023-06-23T18:34:17.641Z Last Updated: 2024-11-27T20:08:52.221Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-87 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vul
ace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x234-mg7q-m8g8 - https://github.com/xwiki/xwiki-platform/commit/5c20ff5e3bdea50f1053fe99a27e011b8d0e4b34 - https://jira.xwiki.org/browse/XWIKI-20583 - https://jira.xwiki.org/browse/XWIKI-20612
CVE ID: CVE-2023-35160 State: PUBLISHED Published: 2023-06-23T18:48:18.136Z Last Updated: 2024-11-27T20:07:56.811Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-87 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/XWiki/Main xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain). This vulnerabili
Main xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r8xc-xxh3-q5x3 - https://github.com/xwiki/xwiki-platform/commit/dbc92dcdace33823ffd1e1591617006cb5fc6a7f - https://jira.xwiki.org/browse/XWIKI-20343 - https://jira.xwiki.org/browse/XWIKI-20583
CVE ID: CVE-2023-35161 State: PUBLISHED Published: 2023-06-23T18:51:45.575Z Last Updated: 2024-11-27T20:02:02.038Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-87 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: > xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain). This vulnerabil
ppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4xm7-5q79-3fch - https://github.com/xwiki/xwiki-platform/commit/8f5a889b7cd140770e54f5b4195d88058790e305 - https://jira.xwiki.org/browse/XWIKI-20583 - https://jira.xwiki.org/browse/XWIKI-20614
CVE ID: CVE-2023-35162 State: PUBLISHED Published: 2023-06-23T18:52:19.725Z Last Updated: 2024-11-29T14:25:46.790Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: > <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vul
i/bin/get/FlamingoThemes/Cerulean xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q9hg-9qj2-mxf9 - https://github.com/xwiki/xwiki-platform/commit/9f01166b1a8ee9639666099eb5040302df067e4d - https://jira.xwiki.org/browse/XWIKI-20342 - https://jira.xwiki.org/browse/XWIKI-20583
CVE ID: CVE-2023-35163 State: PUBLISHED Published: 2023-06-23T20:25:16.836Z Last Updated: 2024-11-07T20:17:24.917Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: vegaprotocol Products: vega Problem Types: CWE-20 Description: Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For example, a deposit to the collateral bridge for 100USDT that credits a party’s general account on Vega, can be re-processed 50 times resulting in 5000U
teral bridge for 100USDT that credits a party’s general account on Vega, can be re-processed 50 times resulting in 5000USDT in that party’s general account. This is without depositing any more than the original 100USDT on the bridge. Despite this exploit requiring access to a validator's Vega key, a validator key can be obtained at the small cost of 3000VEGA, the amount needed to announce a new node onto the network. A patch is available in version 0.71.6. No known workarounds are available, however there are mitigations in place should this vulnerability be exploited. There are monitoring alerts for `mainnet1` in place to identify any issues of this nature including this vulnerability being
e are monitoring alerts for `mainnet1` in place to identify any issues of this nature including this vulnerability being exploited. The validators have the ability to stop the bridge thus stopping any withdrawals should this vulnerability be exploited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vegaprotocol/vega/security/advisories/GHSA-8rc9-vxjh-qjf2 - https://github.com/vegaprotocol/vega/commit/56b09bf57af8cd9eca5996252d86f469a3e34c68 - https://github.com/vegaprotocol/vega/releases/tag/v0.71.6
CVE ID: CVE-2023-35164 State: PUBLISHED Published: 2023-06-26T21:17:25.623Z Last Updated: 2024-11-06T17:20:03.844Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: dataease Products: dataease Problem Types: CWE-862 Description: DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions a missing authorization check allows unauthorized users to manipulate a dashboard created by the administrator. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: -
to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-grxm-fc3h-3qgj
CVE ID: CVE-2023-35165 State: PUBLISHED Published: 2023-06-23T20:32:49.392Z Last Updated: 2024-12-05T16:12:52.224Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: aws Products: aws-cdk Problem Types: CWE-863 Description: AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks` 1.57.0 until 1.202.0, `eks.Cluster` and `eks.FargateCluster` constructs create two roles, `CreationRole` and `default MastersRole`, that have an overly permissive trust policy. The first, referred to as t
oles, `CreationRole` and `default MastersRole`, that have an overly permissive trust policy. The first, referred to as the `CreationRole`, is used by lambda handlers to create the cluster and deploy Kubernetes resources (e.g `KubernetesManifest`, `HelmChart`, ...) onto it. Users with CDK version higher or equal to 1.62.0 (including v2 users) may be affected. The second, referred to as the `default MastersRole`, is provisioned only if the `mastersRole` property isn't provided and has permissions to execute `kubectl` commands on the cluster. Users with CDK version higher or equal to 1.57.0 (including v2 users) may be affected. The issue has been fixed in `@aws-cdk/aws-eks` v1.202.0 and `aws-cd
qual to 1.57.0 (including v2 users) may be affected. The issue has been fixed in `@aws-cdk/aws-eks` v1.202.0 and `aws-cdk-lib` v2.80.0. These versions no longer use the account root principal. Instead, they restrict the trust policy to the specific roles of lambda handlers that need it. There is no workaround available for CreationRole. To avoid creating the `default MastersRole`, use the `mastersRole` property to explicitly provide a role. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aws/aws-cdk/security/advisories/GHSA-rx28-r23p-2qc3 - https://github.com/aws/aws-cdk/issues/25674
CVE ID: CVE-2023-35166 State: PUBLISHED Published: 2023-06-20T19:29:51.912Z Last Updated: 2024-12-06T21:35:31.737Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-863 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44v
tainer: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h7cw-44vp-jq7h - https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178 - https://jira.xwiki.org/browse/XWIKI-20281
CVE ID: CVE-2023-35167 State: PUBLISHED Published: 2023-06-23T19:03:54.753Z Last Updated: 2024-11-07T19:04:32.133Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: remult Products: remult Problem Types: CWE-284 Description: Remult is a CRUD framework for full-stack TypeScript. If you used the apiPrefilter option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance is not authorized to access, can gain read, update and delete access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object i
access to it. The issue is fixed in version 0.20.6. As a workaround, set the `apiPrefilter` option to a filter object instead of a function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/remult/remult/security/advisories/GHSA-7hh3-3x64-v2g9 - https://github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5 - https://github.com/remult/remult/releases/tag/v0.20.6
CVE ID: CVE-2023-35168 State: PUBLISHED Published: 2023-06-26T20:11:04.044Z Last Updated: 2024-11-06T17:28:10.193Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: dataease Products: dataease Problem Types: CWE-732 Description: DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for
ne number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-c2r2-68p6-73xv
CVE ID: CVE-2023-35169 State: PUBLISHED Published: 2023-06-23T20:37:28.324Z Last Updated: 2024-11-27T20:22:12.801Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Webklex Products: php-imap Problem Types: CWE-22 Description: PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code execution vulnerability. Every application that stores attachments with `Attachment::save()` without providing a `$filename` or passing unsanitized us
application that stores attachments with `Attachment::save()` without providing a `$filename` or passing unsanitized user input is affected by this attack. An attacker can send an email with a malicious attachment to the inbox, which gets crawled with `webklex/php-imap` or `webklex/laravel-imap`. Prerequisite for the vulnerability is that the script stores the attachments without providing a `$filename`, or providing an unsanitized `$filename`, in `src/Attachment::save(string $path, string $filename = null)`. In this case, where no `$filename` gets passed into the `Attachment::save()` method, the package would use a series of unsanitized and insecure input values from the mail as fallback.