Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-34205 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-10T21:21:48.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/moov-io/signedxml/issues/23
CVE ID: CVE-2023-34207 State: PUBLISHED Published: 2023-10-17T03:35:35.535Z Last Updated: 2024-09-13T19:52:42.498Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: EasyUse Digital Technology Products: MailHunter Ultimate Problem Types: CWE-434 Description: Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with ‘NT Authority\SYSTEM‘ privilege via a crafted ZIP archive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zuso.ai/Advisory/ZA-2023-04
CVE ID: CVE-2023-34208 State: PUBLISHED Published: 2023-10-17T04:00:05.711Z Last Updated: 2024-09-13T18:05:58.771Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: EasyUse Digital Technology Products: MailHunter Ultimate Problem Types: CWE-22 Description: Path Traversal in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to extract files into arbitrary directories via a crafted ZIP archive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zuso.ai/Advisory/ZA-2023-05
CVE ID: CVE-2023-34209 State: PUBLISHED Published: 2023-10-17T04:00:28.128Z Last Updated: 2024-09-13T18:05:39.995Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: EasyUse Digital Technology Products: MailHunter Ultimate Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to obtain the absolute path via unencrypted VIEWSTATE parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zuso.ai/Advisory/ZA-2023-06
CVE ID: CVE-2023-34210 State: PUBLISHED Published: 2023-10-17T04:00:49.629Z Last Updated: 2024-09-13T18:05:21.099Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: EasyUse Digital Technology Products: MailHunter Ultimate Problem Types: CWE-89 Description: SQL Injection in create customer group function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to execute arbitrary SQL commands via the ctl00$ContentPlaceHolder1$txtCustSQL parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zuso.ai/Advisory/ZA-2023-07
CVE ID: CVE-2023-34211 State: REJECTED Published: N/A Last Updated: 2023-07-02T21:50:50.847420Z Description: No description available.
CVE ID: CVE-2023-34212 State: PUBLISHED Published: 2023-06-12T15:14:06.990Z Last Updated: 2025-02-13T16:55:23.157Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: CWE-502 Description: The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue. Additional Analyst
f allowed schemes. You are recommended to upgrade to version 1.22.0 or later which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nifi.apache.org/security.html#CVE-2023-34212 - https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5 - http://www.openwall.com/lists/oss-security/2023/06/12/2
CVE ID: CVE-2023-34213 State: PUBLISHED Published: 2023-08-17T02:20:20.289Z Last Updated: 2024-10-28T06:06:35.355Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: TN-5900 Series Problem Types: CWE-78 Description: TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the key-generation function, which could potentially allow malicious users to execute remote code on affected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-s
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
CVE ID: CVE-2023-34214 State: PUBLISHED Published: 2023-08-17T02:26:05.428Z Last Updated: 2024-10-28T06:07:21.645Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: TN-5900 Series, TN-4900 Series, EDR-810 Series, EDR-G902 Series, EDR-G903 Series Problem Types: CWE-78 Description: TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-generation function, which could potentially allow malicious users to execute remote code on affected devices. Additional Analyst Notes: -
n, which could potentially allow malicious users to execute remote code on affected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
CVE ID: CVE-2023-34215 State: PUBLISHED Published: 2023-08-17T06:35:06.293Z Last Updated: 2024-10-28T06:08:37.703Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: TN-5900 Series Problem Types: CWE-78 Description: TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the certification-generation function, which could potentially allow malicious users to execute remote code on affected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/sup
s. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
CVE ID: CVE-2023-34216 State: PUBLISHED Published: 2023-08-17T06:41:41.568Z Last Updated: 2024-10-08T14:10:45.108Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Moxa Products: TN-5900 Series, TN-4900 Series, EDR-G902 Series, EDR-G903 Series, EDR-G9010 Series, NAT-102 Series Problem Types: CWE-22 Description: TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability derives from insufficient input validation in the key-delete function, which could potentially allow malicious users to delete arbitrary files. Additional Analyst Notes: - CVE Prog
function, which could potentially allow malicious users to delete arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
CVE ID: CVE-2023-34217 State: PUBLISHED Published: 2023-08-17T06:48:38.770Z Last Updated: 2024-10-02T19:58:00.223Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Moxa Products: TN-5900 Series, TN-4900 Series, EDR-G902 Series, EDR-G903 Series, EDR-G9010 Series, NAT-102 Series Problem Types: CWE-22 Description: TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which could potentially allow malicious users to delete arbitrary files. Additional Analyst Notes: - CV
delete function, which could potentially allow malicious users to delete arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230402-tn-5900-and-tn-4900-series-web-server-multiple-vulnerabilities
CVE ID: CVE-2023-34218 State: PUBLISHED Published: 2023-05-31T13:03:12.814Z Last Updated: 2025-01-09T20:54:20.791Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-863 Description: In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34219 State: PUBLISHED Published: 2023-05-31T13:03:13.367Z Last Updated: 2025-01-09T20:33:32.302Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-285 Description: In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34220 State: PUBLISHED Published: 2023-05-31T13:03:13.956Z Last Updated: 2025-01-09T20:03:26.445Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34221 State: PUBLISHED Published: 2023-05-31T13:03:14.464Z Last Updated: 2025-01-09T20:33:08.762Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34222 State: PUBLISHED Published: 2023-05-31T13:03:14.995Z Last Updated: 2025-01-09T20:32:34.480Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34223 State: PUBLISHED Published: 2023-05-31T13:03:15.563Z Last Updated: 2025-01-09T20:32:11.363Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-532 Description: In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34224 State: PUBLISHED Published: 2023-05-31T13:03:15.821Z Last Updated: 2025-01-09T20:31:44.537Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-601 Description: In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34225 State: PUBLISHED Published: 2023-05-31T13:03:16.074Z Last Updated: 2025-01-09T20:31:09.300Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34226 State: PUBLISHED Published: 2023-05-31T13:03:16.303Z Last Updated: 2025-01-09T20:30:47.812Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34227 State: PUBLISHED Published: 2023-05-31T13:03:16.642Z Last Updated: 2025-01-09T20:30:23.803Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-749 Description: In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34228 State: PUBLISHED Published: 2023-05-31T13:03:17.042Z Last Updated: 2025-01-09T20:29:58.874Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-308 Description: In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34229 State: PUBLISHED Published: 2023-05-31T13:03:17.292Z Last Updated: 2025-01-09T20:29:22.277Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-34230 State: PUBLISHED Published: 2023-06-08T20:29:50.429Z Last Updated: 2025-01-06T19:28:28.779Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: snowflakedb Products: snowflake-connector-net Problem Types: CWE-77 Description: snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the S
users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 2.0.18 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/snowflake-connector-net/security/advisories/GHSA-223g-8w3x-98wr
CVE ID: CVE-2023-34231 State: PUBLISHED Published: 2023-06-08T19:42:13.381Z Last Updated: 2025-01-06T19:45:43.259Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: snowflakedb Products: gosnowflake Problem Types: CWE-77 Description: gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on (SSO) browser URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly access
cious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. A patch is available in version 1.6.19. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/gosnowflake/security/advisories/GHSA-fwv2-65wh-2w8c - https:
Vulnrichment: References: - https://github.com/snowflakedb/gosnowflake/security/advisories/GHSA-fwv2-65wh-2w8c - https://github.com/snowflakedb/gosnowflake/pull/757 - https://github.com/snowflakedb/gosnowflake/commit/e11a2a555f1b9f7adc1f01fb7b5e7f38fbbb2a1c
CVE ID: CVE-2023-34232 State: PUBLISHED Published: 2023-06-08T20:17:49.734Z Last Updated: 2025-01-06T20:19:54.764Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: snowflakedb Products: snowflake-connector-nodejs Problem Types: CWE-77 Description: snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions prior to 1.6.21. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessibl
us resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 1.6.21 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-h53
A ADP Vulnrichment: References: - https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-h53w-7qw7-vh5c - https://github.com/snowflakedb/snowflake-connector-nodejs/pull/465 - https://github.com/snowflakedb/snowflake-connector-nodejs/commit/0c9622ae12cd7d627df404b73a783b4a5f60728a - https://community.snowflake.com/s/article/Node-js-Driver-Release-Notes
CVE ID: CVE-2023-34233 State: PUBLISHED Published: 2023-06-08T20:22:13.386Z Last Updated: 2025-01-06T19:38:29.078Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: snowflakedb Products: snowflake-connector-python Problem Types: CWE-77 Description: The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Versions prior to 3.0.2 are vulnerable to command injection via single sign-on(SSO) browser URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redi
ial for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 3.0.2 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
3.0.2 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-5w5m-pfw9-c8fp - https://github.com/snowflakedb/snowflake-connector-python/pull/1480 - https://github.com/snowflakedb/snowflake-connector-python/commit/1cdbd3b1403c5ef520d7f4d9614fe35165e101ac
CVE ID: CVE-2023-34234 State: PUBLISHED Published: 2023-06-07T17:06:10.154Z Last Updated: 2025-02-06T16:55:49.744Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenZeppelin Products: openzeppelin-contracts Problem Types: CWE-862 Description: OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in
r` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. This problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Users are advised to upgrade. Users unable to upgrade may submit the proposal creation transaction to an endpoint with frontrunning protection as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-5h3x-9wvq-w4m2 - https://github.com/OpenZeppelin/openzeppelin-contracts/commit/d9474327a492f9f310f31bc53f38dbea56ed9a57
CVE ID: CVE-2023-34235 State: PUBLISHED Published: 2023-07-25T17:24:19.864Z Last Updated: 2024-10-03T20:02:58.764Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: strapi Products: strapi Problem Types: CWE-200 Description: Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to another table they want to query, the query changes from `password` to `t1.password`. `password` is protected by filtering protections but `t1.pas