Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t on both integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3434839 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
CVE ID: CVE-2024-27900 State: PUBLISHED Published: 2024-03-12T00:44:15.235Z Last Updated: 2025-04-16T15:40:05.874Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP ABAP Platform Problem Types: CWE-862 Description: Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private. As a result, the selected template would only be accessible to the owner. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3419022 - https://support.sap.com/en/my-support/knowledge-
CVE Program Container: References: - https://me.sap.com/notes/3419022 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
CVE ID: CVE-2024-27901 State: PUBLISHED Published: 2024-04-09T00:55:03.642Z Last Updated: 2024-09-06T18:01:25.580Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP Asset Accounting Problem Types: CWE-35 Description: SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3438234 - https://support.sap.com/en/m
rogram Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3438234 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
CVE ID: CVE-2024-27902 State: PUBLISHED Published: 2024-03-12T00:45:08.794Z Last Updated: 2024-08-02T00:41:55.900Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI) Problem Types: CWE-79 Description: Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system
fy data through their ability to execute code in a user’s browser. There is no impact on the availability of the system Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://me.sap.com/notes/3377979 - https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364
CVE ID: CVE-2024-27903 State: PUBLISHED Published: 2024-07-08T10:27:40.125Z Last Updated: 2024-08-23T03:55:35.767Z Vendors: OpenVPN Products: OpenVPN 2 Problem Types: CWE-283 Description: OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.openvpn.net/openvpn/wiki/CVE-2024-27903 - https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ - https://www.mail-archive.com
n.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ - https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html
CVE ID: CVE-2024-27905 State: PUBLISHED Published: 2024-02-27T14:29:22.497Z Last Updated: 2025-04-22T16:13:10.660Z Vendors: Apache Software Foundation Products: Apache Aurora Problem Types: CWE-200 Description: ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication cookie. Potentially this could be combined with vulnerabilities in other components to achieve remote code execution. As this project is retired, we do not plan to release a version that fixes this issue. User
hieve remote code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/564kbv3wqdzkscmdn2bg4vlk48qymryp - http://www.openwall.com/lists/oss-security/2024/02/27/3
CVE ID: CVE-2024-27906 State: PUBLISHED Published: 2024-02-29T11:02:19.310Z Last Updated: 2025-05-06T13:12:13.352Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-862 Description: Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/airflow/pull/37290 - https://github.com/a
Vulnrichment: - CVE Program Container: References: - https://github.com/apache/airflow/pull/37290 - https://github.com/apache/airflow/pull/37468 - https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5
CVE ID: CVE-2024-27907 State: PUBLISHED Published: 2024-03-12T10:22:10.892Z Last Updated: 2024-08-15T16:46:47.753Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Simcenter Femap Problem Types: CWE-787 Description: A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22051) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
nt process. (ZDI-CAN-22051) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-000072.html
CVE ID: CVE-2024-27908 State: PUBLISHED Published: 2024-04-05T20:46:36.450Z Last Updated: 2024-08-02T00:41:55.790Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: Printers Problem Types: CWE-120 Description: A buffer overflow vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/420425
CVE ID: CVE-2024-27909 State: PUBLISHED Published: 2024-04-05T20:46:46.021Z Last Updated: 2024-08-02T00:41:55.786Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: Printers Problem Types: CWE-20 Description: A denial of service vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in a system reboot. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/420425
CVE ID: CVE-2024-27910 State: PUBLISHED Published: 2024-04-05T20:46:55.352Z Last Updated: 2024-08-20T15:40:35.116Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Lenovo Products: Printers Problem Types: CWE-862 Description: A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/420425
CVE ID: CVE-2024-27911 State: PUBLISHED Published: 2024-04-05T20:47:01.657Z Last Updated: 2024-08-02T00:41:55.827Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: Printers Problem Types: CWE-862 Description: A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/420425
CVE ID: CVE-2024-27912 State: PUBLISHED Published: 2024-04-05T20:47:09.905Z Last Updated: 2024-08-02T00:41:55.749Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: Printers Problem Types: CWE-20 Description: A denial of service vulnerability was reported in some Lenovo Printers that could allow an attacker to cause the device to crash by sending crafted LPD packets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/420425
CVE ID: CVE-2024-27913 State: PUBLISHED Published: 2024-02-28T00:00:00.000Z Last Updated: 2025-03-26T21:12:35.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FRRouting/frr/pull/15431
CVE ID: CVE-2024-27914 State: PUBLISHED Published: 2024-03-18T16:19:00.298Z Last Updated: 2024-08-02T15:25:55.247Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13. Additional Analyst Notes: - CVE Program Con
gates through the debug bar. This issue has been patched in version 10.0.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-rcxj-fqr4-q34r - https://github.com/glpi-project/glpi/commit/69e0dee8de0c0df139b42dbfa1a8997888c2af95 - https://github.com/glpi-project/glpi/releases/tag/10.0.13
CVE ID: CVE-2024-27915 State: PUBLISHED Published: 2024-03-06T19:33:11.798Z Last Updated: 2025-04-16T15:54:40.497Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: sulu Products: sulu Problem Types: CWE-863 Description: Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php`
4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p - https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da
CVE ID: CVE-2024-27916 State: PUBLISHED Published: 2024-03-06T20:21:22.125Z Last Updated: 2024-08-02T19:39:30.349Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: stacklok Products: minder Problem Types: CWE-285 Description: Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByName`, and `GetArtifactByName` to access any repository in the database, irrespective of who owns the repo and any permissions present. The database query checks by repo owner, repo name and provider name (which is always `github`). These query values are not distinct for the particular
po owner, repo name and provider name (which is always `github`). These query values are not distinct for the particular user - as long as the user has valid credentials and a provider, they can set the repo owner/name to any value they want and the server will return information on this repo. Version 0.0.33 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stacklok/minder/security/advisories/GHSA-v627-69v2-xx37 - https://github.com/stacklok/minder/commit/45750b4e9fb2de33365758366e06c19e999bd2eb - https://github.com/stacklok/minder/blob/a115c8524fbd582b2b277eaadce024bebbded508/internal/controlplane/ha
c19e999bd2eb - https://github.com/stacklok/minder/blob/a115c8524fbd582b2b277eaadce024bebbded508/internal/controlplane/handlers_repositories.go#L277-L278 - https://github.com/stacklok/minder/blob/main/internal/controlplane/handlers_repositories.go#L257-L299
CVE ID: CVE-2024-27917 State: PUBLISHED Published: 2024-03-06T19:36:27.357Z Last Updated: 2024-08-05T20:07:41.626Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: shopware Products: shopware Problem Types: CWE-524 Description: Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. Since Shopware 6.5.8.0, the 404 pages are cached to improve the performance of 404 pages. So the cached Response which contains a Session Cookie when the Browser accessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration
ccessing the 404 page, has no cookies yet. The Symfony Session Handler is in use, when no explicit Session configuration has been done. When Redis is in use for Sessions using the PHP Redis extension, this exploiting code is not used. Shopware version 6.5.8.7 contains a patch for this issue. As a workaround, use Redis for Sessions, as this does not trigger the exploit code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-c2f9-4jmm-v45m - https://github.com/shopware/shopware/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3 - https://github.com/shopware/storefront/commit/3477e4a425d3c54b4bfae
re/commit/7d9cb03225efca5f97e69b800d8747598dd15ce3 - https://github.com/shopware/storefront/commit/3477e4a425d3c54b4bfae82d703fe3838dc21d3e - https://github.com/shopware/shopware/releases/tag/v6.5.8.7
CVE ID: CVE-2024-27918 State: PUBLISHED Published: 2024-03-06T20:25:24.601Z Last Updated: 2024-08-05T18:06:33.208Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: coder Products: coder Problem Types: CWE-20 Description: Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the `CODER_OIDC_EMAIL_DOMAIN` verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider. During OIDC registration, the user's
only affected if the OIDC provider allows users to create accounts on the provider. During OIDC registration, the user's email was improperly validated against the allowed `CODER_OIDC_EMAIL_DOMAIN`s. This could allow a user with a domain that only partially matched an allowed domain to successfully login or register. An attacker could register a domain name that exploited this vulnerability and register on a Coder instance with a public OIDC provider. Coder instances with OIDC enabled and protected by the `CODER_OIDC_EMAIL_DOMAIN` configuration are affected. Coder instances using a private OIDC provider are not affected, as arbitrary users cannot register through a private OIDC provider with
using a private OIDC provider are not affected, as arbitrary users cannot register through a private OIDC provider without first having an account on the provider. Public OIDC providers are impacted. GitHub authentication and external authentication are not impacted. This vulnerability is remedied in versions 2.8.4, 2.7.3, and 2.6.1 All versions prior to these patches are affected by the vulnerability.*It is recommended that customers upgrade their deployments as soon as possible if they are utilizing OIDC authentication with the `CODER_OIDC_EMAIL_DOMAIN` setting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/coder/coder/securit
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/coder/coder/security/advisories/GHSA-7cc2-r658-7xpf - https://github.com/coder/coder/commit/1171ce7add017481d28441575024209ac160ecb0 - https://github.com/coder/coder/commit/2ba84911f8b02605e5958d5e4a2fe3979ec50b31 - https://github.com/coder/coder/commit/2d37eb42e7db656e343fe1f36de5ab1a1a62f4fb - https://github.com/coder/coder/commit/4439a920e454a82565e445e4376c669e3b89591c
CVE ID: CVE-2024-27919 State: PUBLISHED Published: 2024-04-04T14:30:11.144Z Last Updated: 2025-11-04T18:30:17.720Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-390 Description: Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. Envoy's HTTP/2 codec does not reset a request when header map limits have been exceeded. This allows an attacker to send an sequence of CONTINUATION frames without the END_HEADERS bit set causing unlimited memory consumption. This can lead to denial of service through
frames without the END_HEADERS bit set causing unlimited memory consumption. This can lead to denial of service through memory exhaustion. Users should upgrade to versions 1.29.2 to mitigate the effects of the CONTINUATION flood. Note that this vulnerability is a regression in Envoy version 1.29.0 and 1.29.1 only. As a workaround, downgrade to version 1.28.1 or earlier or disable HTTP/2 protocol for downstream connections. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-gghf-vfxp-799r - https://github.com/envoyproxy/envoy/commit/57a02565532c18eb9df972a3e8974be3ae59f2d5 - http://www.openwal
ghf-vfxp-799r - https://github.com/envoyproxy/envoy/commit/57a02565532c18eb9df972a3e8974be3ae59f2d5 - http://www.openwall.com/lists/oss-security/2024/04/05/3 - http://www.openwall.com/lists/oss-security/2024/04/03/16
CVE ID: CVE-2024-27920 State: PUBLISHED Published: 2024-03-15T19:25:00.748Z Last Updated: 2024-08-02T00:41:55.794Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: projectdiscovery Products: nuclei Problem Types: CWE-78 Description: projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This advisory outlines the impacted users, provide
tially allowing the execution of malicious code on the user's system. This advisory outlines the impacted users, provides details on the security patch, and suggests mitigation strategies. The vulnerability is addressed in Nuclei v3.2.0. Users are strongly recommended to update to this version to mitigate the security risk. Users should refrain from using custom workflows if unable to upgrade immediately. Only trusted, verified workflows should be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-w5wx-6g2r-r78q - https://github.com/projectdiscovery/nuclei/pull/4822 - https://
scovery/nuclei/security/advisories/GHSA-w5wx-6g2r-r78q - https://github.com/projectdiscovery/nuclei/pull/4822 - https://docs.projectdiscovery.io/templates/protocols/code - https://docs.projectdiscovery.io/templates/reference/template-signing - https://docs.projectdiscovery.io/templates/workflows/overview
CVE ID: CVE-2024-27921 State: PUBLISHED Published: 2024-03-21T21:38:29.938Z Last Updated: 2025-04-10T20:14:03.546Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: getgrav Products: grav Problem Types: CWE-22 Description: Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or
attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc - https://github.com/getgrav/grav/commit/5928411b86bab05afca2b33db4e7386a44858e99
CVE ID: CVE-2024-27922 State: PUBLISHED Published: 2024-03-06T20:33:57.922Z Last Updated: 2024-08-02T19:51:32.534Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tomphttp Products: bare-server-node Problem Types: CWE-444 Description: TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may vary depending on the specific usage of the package but it can potentially affect any system where this package is in use. The problem
on the specific usage of the package but it can potentially affect any system where this package is in use. The problem has been patched in version 2.0.2. As of time of publication, no specific workaround strategies have been disclosed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tomphttp/bare-server-node/security/advisories/GHSA-86fc-f9gr-v533