Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-32644 State: PUBLISHED Published: 2021-06-22T17:45:11 Last Updated: 2024-08-03T23:25:31.026Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ampache Products: ampache Problem Types: CWE-79 Description: Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. This issue has been resolved in 4.4.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ampache/ampache/security/advi
4.4.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ampache/ampache/security/advisories/GHSA-vqpj-xgw2-r54q - https://github.com/ampache/ampache/commit/c9453841e1b517a1660c3da1efd1fe5d623c93a5
CVE ID: CVE-2021-32645 State: PUBLISHED Published: 2021-05-27T16:50:11 Last Updated: 2024-08-03T23:25:30.930Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: tenancy Products: multi-tenant Problem Types: CWE-601 Description: Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2
cation is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tenancy/multi-tenant/security/advisories/GHSA-4r8q-gv9j-3xx6 - https://github.com/tenancy/multi-tenant/commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164 - https://packagist.org/packages/hyn/multi-tenant - https://webmasters.g
commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164 - https://packagist.org/packages/hyn/multi-tenant - https://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.html
CVE ID: CVE-2021-32646 State: PUBLISHED Published: 2021-05-28T17:40:10 Last Updated: 2024-08-03T23:25:31.032Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dav-Git Products: Dav-Cogs Problem Types: CWE-287 Description: Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vulnerability has been discovered allowing discord users to get the ``manage channel`` permissions in a private VC they have joined. This allowed them to make changes to or delete the voice channel they have taken over. The exploit does not allow access or control to any other channels in the server. Upgrade
channel they have taken over. The exploit does not allow access or control to any other channels in the server. Upgrade to version 1.0.1 for a patched version of the cog. As a workaround you may disable private VCs in your guild(server) or unload the roomer cog to render the exploit unusable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dav-Git/Dav-Cogs/security/advisories/GHSA-3f73-8j6q-28v8 - https://github.com/Dav-Git/Dav-Cogs/commit/fbe2ae8ec851a2e9e3e2370db3b812f268e8c8cb
CVE ID: CVE-2021-32647 State: PUBLISHED Published: 2021-05-28T23:05:10 Last Updated: 2024-08-03T23:25:30.870Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: NationalSecurityAgency Products: emissary Problem Types: CWE-74 Description: Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36) REST endpoint accepts an `sppClassName` parameter which is used to load an arbitrary class. This
ePlaceAction.java#L36) REST endpoint accepts an `sppClassName` parameter which is used to load an arbitrary class. This class is later instantiated using a constructor with the following signature: `<constructor>(String, String, String)`. An attacker may find a gadget (class) in the application classpath that could be used to achieve Remote Code Execution (RCE) or disrupt the application. Even though the chances to find a gadget (class) that allow arbitrary code execution are low, an attacker can still find gadgets that could potentially crash the application or leak sensitive data. As a work around disable network access to Emissary from untrusted sources. Additional Analyst Notes: - CVE Pr
ive data. As a work around disable network access to Emissary from untrusted sources. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-ph73-7v9r-wg32 - https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36
CVE ID: CVE-2021-32648 State: PUBLISHED Published: 2021-08-26T19:00:12.000Z Last Updated: 2025-10-21T23:25:36.099Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: octobercms Products: october Problem Types: CWE-287 Description: octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/octobercms/october/security/advisories/GHS
Program Container: - CISA ADP Vulnrichment: References: - https://github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc - https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 - https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9
CVE ID: CVE-2021-32649 State: PUBLISHED Published: 2022-01-14T15:05:17.000Z Last Updated: 2025-04-23T19:12:11.368Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: octobercms Products: october Problem Types: CWE-74 Description: October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their instal
e issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 - https://github.com/octobercms/october/security/advisories/GHSA-wv23-pfj7-2mjj
CVE ID: CVE-2021-32650 State: PUBLISHED Published: 2022-01-14T15:05:10.000Z Last Updated: 2025-04-22T18:33:22.628Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: octobercms Products: october Problem Types: CWE-74 Description: October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch t
S templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/octobercms/october/security/advisories/GHSA-5hfj-r725-wpc4 - https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26
CVE ID: CVE-2021-32651 State: PUBLISHED Published: 2021-06-01T17:15:12 Last Updated: 2024-08-03T23:25:30.942Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-90 Description: OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an attacker can manipulate a user search filter to send forged queries to the application and explore the LDAP tree using Blind LDAP Injection techniques. The specific payload depends on how the User Search Filter property is configured in OneDev. This issue was fixed in version 4.4.2. Additional Analyst Notes
the User Search Filter property is configured in OneDev. This issue was fixed in version 4.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-5864-2496-4xjf - https://github.com/theonedev/onedev/commit/4440f0c57e440488d7e653417b2547eaae8ad19c
CVE ID: CVE-2021-32652 State: PUBLISHED Published: 2021-06-01T19:05:11 Last Updated: 2024-08-03T23:25:31.016Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and 1.8.2 contain patches for this vulnerability; no workarounds other than the patches are known to exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisori
o exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mxx2-6rg9-v2vc - https://hackerone.com/reports/1094063
CVE ID: CVE-2021-32653 State: PUBLISHED Published: 2021-06-01T19:50:09 Last Updated: 2024-08-03T23:25:30.965Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-201 Description: Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user has no fields set to published. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2; no workarounds outside the updates are known to exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/s
ates are known to exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-396j-vqpr-qg45 - https://hackerone.com/reports/1173436 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32654 State: PUBLISHED Published: 2021-06-01T20:45:12 Last Updated: 2024-08-03T23:25:30.980Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-639 Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing. Additional
upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5 - https://hackerone.com/reports/1170024 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32655 State: PUBLISHED Published: 2021-06-01T20:55:09 Last Updated: 2024-08-03T23:25:31.037Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-241 Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and tries to remove the "Create" privileges of this unexpected share, Nextcloud server would silently grant the share read privileges. The vuln
"Create" privileges of this unexpected share, Nextcloud server would silently grant the share read privileges. The vulnerability is patched in versions 19.0.11, 20.0.10 and 21.0.2. No workarounds are known to exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-grph-cm44-p3jv - https://hackerone.com/reports/1167929 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32656 State: PUBLISHED Published: 2021-06-01T21:45:11 Last Updated: 2024-08-03T23:25:31.075Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added as a federated share. This happens because Nextcloud supports sharing registered users with other Nextcloud servers, which can be done aut
re. This happens because Nextcloud supports sharing registered users with other Nextcloud servers, which can be done automatically when selecting the "Add server automatically once a federated share was created successfully" setting. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2 As a workaround, disable "Add server automatically once a federated share was created successfully" in the Nextcloud settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j875-vr2q-h6x6 - https://hackerone.com/reports/1167853 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32657 State: PUBLISHED Published: 2021-06-01T22:10:10 Last Updated: 2024-08-03T23:25:31.095Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-400 Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use the OCC command line tool to admi
ixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use the OCC command line tool to administrate the Nextcloud users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fx62-q47f-f665 - https://hackerone.com/reports/1147611 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32658 State: PUBLISHED Published: 2021-06-08T18:35:11 Last Updated: 2024-08-03T23:25:31.085Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that the Nextcloud Android App is upgraded to 3.16.1 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ne
Android App is upgraded to 3.16.1 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g5gf-rmhm-wpxw - https://github.com/nextcloud/android/commit/355f3c745b464b741b20a3b96597303490c26333 - https://hackerone.com/reports/1189168
CVE ID: CVE-2021-32659 State: PUBLISHED Published: 2021-06-16T18:45:11 Last Updated: 2024-08-03T23:25:31.074Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: matrix-org Products: matrix-appservice-bridge Problem Types: CWE-306 Description: Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room
event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. Versions 2.6.1 and greater are patched. As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhx
Container: References: - https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhx - https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34fcfd858df33e4631e420da07b9f - https://github.com/matrix-org/matrix-appservice-bridge/releases/tag/2.6.1
CVE ID: CVE-2021-32660 State: PUBLISHED Published: 2021-06-03T17:05:11 Last Updated: 2024-08-03T23:25:31.020Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: backstage Products: backstage Problem Types: CWE-77 Description: Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@backstage/tehdocs-common` prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitaz
anitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/backstage/backstage/securit
common`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/backstage/backstage/security/advisories/GHSA-pwhf-39xg-4rxw - https://github.com/backstage/backstage/commit/aad98c544e59369901fe9e0a85f6357644dceb5c - https://github.com/backstage/backstage/releases/tag/release-2021-06-03
CVE ID: CVE-2021-32661 State: PUBLISHED Published: 2021-06-03T17:25:10 Last Updated: 2024-08-03T23:25:31.127Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: backstage Products: backstage Problem Types: CWE-77 Description: Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limit
sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/backstage/backstage/commit/aad98c544e59369901fe9e0a85f6357644dceb5c - https://github.com/backstage/backstage/releases/tag/release-2021-06-03 - https://github.com/backstage/backstage/security/advisories/GHSA-gg96-f8wr-p89f
CVE ID: CVE-2021-32662 State: PUBLISHED Published: 2021-06-03T22:00:12 Last Updated: 2024-08-03T23:25:31.046Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: backstage Products: backstage Problem Types: CWE-22 Description: Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In `@backstage/techdocs-common` versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API.
ng a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API. This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API. The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/backstage/backstage/security/advisories/GHSA-pgf8-28gg-vpr6 - https://github.com/backstage/backstage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208 - https://github.com/backstage/backstage/releases/tag/release-2021
stage/commit/8cefadca04cbf01d0394b0cb1983247e5f1d6208 - https://github.com/backstage/backstage/releases/tag/release-2021-05-27
CVE ID: CVE-2021-32663 State: PUBLISHED Published: 2021-10-19T17:40:11 Last Updated: 2024-08-03T23:25:31.083Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-918 Description: iTop is an open source web based IT Service Management tool. In affected versions an attacker can call the system setup without authentication. Given specific parameters this can lead to SSRF. This issue has been resolved in versions 2.6.5 and 2.7.5 and later Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9 - https://github.com/Combodo/iTop/commit/43daa2ef088bf