Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ill cause a sustained Denial of Service condition. On all SRX Series and MX Series platforms, where IDP is enabled and a specific malformed SSL packet is received, the SSL detector crashes leading to an FPC core. This issue affects Juniper Networks SRX Series and MX Series prior to SigPack 3598. In order to identify the current SigPack version, following command can be used: user@junos# show security idp security-package-version Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportportal.juniper.net/JSA71662
CVE ID: CVE-2023-28986 State: PUBLISHED Published: 2023-07-10T15:05:41.452Z Last Updated: 2024-10-17T15:49:02.668Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: wp.insider, wpaffiliatemgr Products: Affiliates Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28987 State: PUBLISHED Published: 2023-11-12T21:28:13.719Z Last Updated: 2024-09-03T13:33:15.762Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Wpmet Products: Wp Ultimate Review Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28988 State: PUBLISHED Published: 2023-06-26T05:05:12.321Z Last Updated: 2024-10-10T17:12:19.117Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: PI Websolution Products: Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin <= 2.1.48 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.co
ersions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/add-to-cart-direct-checkout-for-woocommerce/wordpress-direct-checkout-add-to-cart-redirect-for-woocommerce-plugin-2-1-48-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28989 State: PUBLISHED Published: 2023-07-10T12:51:07.650Z Last Updated: 2024-10-07T19:30:27.197Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: weDevs Products: Happy Addons for Elementor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/happy-elementor-addons/wordpress-happy-addons-for-elementor-plugin-3-8-2-cross-site-request-forgery-csrf-on-collect-data-popup?_s_id=cve
CVE ID: CVE-2023-28990 State: PUBLISHED Published: 2024-12-13T14:23:20.412Z Last Updated: 2024-12-13T21:18:35.983Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: HashThemes Products: Viral Mag Problem Types: CWE-862 Description: Missing Authorization vulnerability in HashThemes Viral Mag allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Mag: from n/a through 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/viral-mag/vulnerability/wordpress-viral-mag-theme-1-0-9-authenticated-arbitrary-plugin-activation-vulnerability?_s_id=cve
CVE ID: CVE-2023-28991 State: PUBLISHED Published: 2023-06-26T05:27:18.323Z Last Updated: 2024-08-02T14:48:23.482Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: PI Websolution Products: Order date, Order pickup, Order date time, Pickup Location, delivery date for WooCommerce Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Order date, Order pickup, Order date time, Pickup Location, delivery date for WooCommerce plugin <= 3.0.19 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pi-woocommerce-orde
gram Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pi-woocommerce-order-date-time-and-type/wordpress-order-date-time-for-woocommerce-plugin-3-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28992 State: PUBLISHED Published: 2023-06-26T05:21:43.742Z Last Updated: 2024-10-10T17:12:03.834Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Elliot Sowersby, RelyWP Products: Coupon Affiliates – WooCommerce Affiliate Plugin Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Elliot Sowersby, RelyWP Coupon Affiliates – WooCommerce Affiliate Plugin plugin <= 5.4.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-coupon-usage/wordpress-coupon-affiliates-plugin-5-4-3-cross-site-scripting-xss-vulnera
ck.com/database/vulnerability/woo-coupon-usage/wordpress-coupon-affiliates-plugin-5-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28993 State: PUBLISHED Published: 2023-04-07T11:26:59.877Z Last Updated: 2025-01-10T18:58:31.196Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ignazio Scimone Products: Albo Pretorio On line Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On Line plugin <= 4.6.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/albo-pretorio-on-line/wordpress-albo-pretorio-on-line-plugin-4-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28994 State: PUBLISHED Published: 2023-08-23T14:04:05.637Z Last Updated: 2024-09-25T14:37:26.245Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: UX-themes Products: Flatsome Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UX-themes Flatsome plugin <= 3.16.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/flatsome/wordpress-flatsome-theme-3-16-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-28995 State: PUBLISHED Published: 2023-07-10T15:31:27.344Z Last Updated: 2024-10-17T15:53:36.081Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Keith Solomon Products: Configurable Tag Cloud (CTC) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Keith Solomon Configurable Tag Cloud (CTC) plugin <= 5.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/configurable-tag-cloud-widget/wordpress-configurable-tag-cloud-plugin-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-28997 State: PUBLISHED Published: 2023-04-04T12:42:24.540Z Last Updated: 2025-11-03T18:08:06.573Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-323 Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can recover and modify the contents of end-to-end encrypted files. Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
e a patch. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4p33-rw27-j5fc - https://github.com/nextcloud/desktop/pull/5324 - https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_DanieleCoppola.pdf
CVE ID: CVE-2023-28998 State: PUBLISHED Published: 2023-04-04T12:45:42.156Z Last Updated: 2025-02-11T15:31:43.099Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-325 Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new files.​ Users should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available. Additional
should upgrade the Nextcloud Desktop client to 3.6.5 to receive a patch. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jh3g-wpwv-cqgr - https://github.com/nextcloud/desktop/pull/5323 - https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_DanieleCoppola.pdf
CVE ID: CVE-2023-28999 State: PUBLISHED Published: 2023-04-04T12:51:08.241Z Last Updated: 2025-02-11T16:32:05.176Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-325 Description: Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextc
folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8875-wxww-3rr8 - https://github.com/nextcloud/desktop/pull/5560 - https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_DanieleCoppola.pdf
CVE ID: CVE-2023-29000 State: PUBLISHED Published: 2023-04-04T12:53:35.904Z Last Updated: 2025-02-11T16:20:51.424Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-295 Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available. Additional
ey known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h82x-98q3-7534 - https://github.com/nextcloud/desktop/pull/4949 - https://hackerone.com/reports/1679267
CVE ID: CVE-2023-29001 State: PUBLISHED Published: 2024-11-27T18:20:47.360Z Last Updated: 2024-11-27T19:22:42.237Z Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-674 Description: Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system processes source routing headers (SRH) in its two alternative RPL protocol implementations. The IPv6 implementation uses the results of this processing to determine whether an incoming packet should be forwarded to another host. Because of missing validation of the resulting next-hop address, an uncontrolled recursion may occur in the tcpip_ipv6_output function in the os/net/ipv6/tcpip.c module
ext-hop address, an uncontrolled recursion may occur in the tcpip_ipv6_output function in the os/net/ipv6/tcpip.c module when receiving a packet with a next-hop address that is a local address. Attackers that have the possibility to send IPv6 packets to the Contiki-NG host can therefore trigger deeply nested recursive calls, which can cause a stack overflow. The vulnerability has not been patched in the current release of Contiki-NG, but is expected to be patched in the next release. The problem can be fixed by applying the patch in Contiki-NG pull request #2264. Users are advised to either apply the patch manually or to wait for the next release. There are no known workarounds for this vuln
advised to either apply the patch manually or to wait for the next release. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-7p75-mf53-ffwm - https://github.com/contiki-ng/contiki-ng/pull/2264
CVE ID: CVE-2023-29002 State: PUBLISHED Published: 2023-04-18T21:21:11.033Z Last Updated: 2025-02-05T20:54:52.695Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: cilium Products: cilium Problem Types: CWE-532 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the `cilium-secrets` namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug output from the Cilium containers could use the resulting output to intercept and modify traffic to and from the affected cluster. Output of the s
tainers could use the resulting output to intercept and modify traffic to and from the affected cluster. Output of the sensitive information would occur at Cilium agent restart, when secrets in the namespace are modified, and on creation of Ingress or GatewayAPI resources. This vulnerability is fixed in Cilium releases 1.11.16, 1.12.9, and 1.13.2. Users unable to upgrade should disable debug mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-pg5p-wwp8-97g8
CVE ID: CVE-2023-29003 State: PUBLISHED Published: 2023-04-04T21:20:43.983Z Last Updated: 2025-02-10T21:29:13.609Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: sveltejs Products: kit Problem Types: CWE-352, CWE-184 Description: SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. While the implementation does a sufficient job in mitigating common CSRF attacks, prior to version 1.15.1, the protecti
While the implementation does a sufficient job in mitigating common CSRF attacks, prior to version 1.15.1, the protection can be bypassed by simply specifying a different `Content-Type` header value. If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts. SvelteKit 1.15.1 updates the `is_form_content_type` function call in the CSRF protection logic to include `text/plain`. As additional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now perform
dditional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now performing validation on `PUT`, `PATCH` and `DELETE` methods as well. This latter hardening is only needed to protect users who have put in some sort of `?_method= override` feature themselves in their `handle` hook, so that the request that resolve sees could be `PUT`/`PATCH`/`DELETE` when the browser issues a `POST` request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sveltejs/kit/security/advisories/GHSA-5p75-vc5g-8rv2 - https://github.com/sveltejs/kit/commit/bb2253d51d00aba2e4353952d4fb0dcde6c77123 - https://gith
ies/GHSA-5p75-vc5g-8rv2 - https://github.com/sveltejs/kit/commit/bb2253d51d00aba2e4353952d4fb0dcde6c77123 - https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%401.15.1
CVE ID: CVE-2023-29004 State: PUBLISHED Published: 2023-04-17T18:34:07.972Z Last Updated: 2025-03-03T19:19:37.825Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: hap-wi Products: roxy-wi Problem Types: CWE-22 Description: hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI (6.3.9.0 at the moment of writing this report). The vulnerability can be exploited via an HTTP request to /app/options.py and the config_file_name parameter. Successful exploitation of this vulnerability could allow an attacker with user level privileges to obtain the conte
er. Successful exploitation of this vulnerability could allow an attacker with user level privileges to obtain the content of arbitrary files on the file server within the scope of what the server process has access to. The root-cause of the vulnerability lies in the get_config function of the /app/modules/config/config.py file, which only checks for relative path traversal, but still allows to read files from absolute locations passed via the config_file_name parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-7qqj-xhvr-46fv
CVE ID: CVE-2023-29005 State: PUBLISHED Published: 2023-04-10T20:47:17.958Z Last Updated: 2025-02-07T19:35:38.143Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: dpgaspar Products: Flask-AppBuilder Problem Types: CWE-307 Description: Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA
Container: - CISA ADP Vulnrichment: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv - https://flask-limiter.readthedocs.io/en/stable/configuration.html
CVE ID: CVE-2023-29006 State: PUBLISHED Published: 2023-04-05T17:53:03.041Z Last Updated: 2025-02-10T15:23:39.714Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pluginsGLPI Products: order Problem Types: CWE-502 Description: The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin. Additional Analyst Notes: - CVE Program
e. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pluginsGLPI/order/security/advisories/GHSA-xfx2-qx2r-3wwm - https://github.com/pluginsGLPI/order/commit/c78e64b95e54d5e47d9835984c93049f245b579e
CVE ID: CVE-2023-29007 State: PUBLISHED Published: 2023-04-25T20:09:52.182Z Last Updated: 2025-11-04T16:10:07.750Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: git Products: git Problem Types: CWE-74 Description: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configurati
can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. Additional Analyst Notes: - CVE Program Container: References: - ht
tion of any submodule sections in `$GIT_DIR/config`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844 - https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4 - https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/ - https://lists.fedoraproject.org/archives/list/package-announce@li
roject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/ - https://security.gentoo.org/glsa/202312-15 - https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
CVE ID: CVE-2023-29008 State: PUBLISHED Published: 2023-04-06T16:36:50.972Z Last Updated: 2025-02-10T16:26:25.826Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: sveltejs Products: kit Problem Types: CWE-918 Description: The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at `kit/src/runtime/server/respond.js`. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can