Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-35908 State: PUBLISHED Published: 2023-09-29T00:00:00 Last Updated: 2024-09-23T16:52:04.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cambiumnetworks.com/support/security/ - https://community.cambiumnetworks.com/t/enterprise-wi-fi-system-software-release-6-4-2/87229
CVE ID: CVE-2022-35909 State: PUBLISHED Published: 2022-08-19T11:52:55 Last Updated: 2024-08-03T09:44:22.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1cBXQrokCvWxKET4BKi3ZLtVp5gst6-MrGPgMKpfXw8Y/edit - https://github.com/jellyfin/jellyfin/pull/7569/files - https://medium.com/stolabs/cve-2022-35909-cve-2022-35910-incorrect-access-control-and-xss-stored-to-jellyfin-967359c91058
CVE ID: CVE-2022-35910 State: PUBLISHED Published: 2022-08-19T11:52:33 Last Updated: 2024-08-03T09:44:22.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jellyfin before 10.8, stored XSS allows theft of an admin access token. Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1cBXQrokCvWxKET4BKi3ZLtVp5gst6-MrGPgMKpfXw8Y/edit - https://github.com/jellyfin/jellyfin/pull/7569/files - https://medium.com/stolabs/cve-2022-35909-cve-2022-35910-incorrect-access-control-and-xss-stored-to-jellyfin-967359c91058
CVE ID: CVE-2022-35911 State: PUBLISHED Published: 2022-07-27T20:05:35 Last Updated: 2024-08-03T09:44:22.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Patlite NH-FB series devices through 1.46, remote attackers can cause a denial of service by omitting the query string. NOTE: the vendor's perspective is that "omitting the query string does not cause a denial of service and the indicated event can not be reproduced. Additional Analyst Notes: - CVE Program Container: References: - https://www.patlite.co.jp/product/detail0000021462.html - https://www.patlite.com/network-products/lineup/nh-fb.html - https://packetstormsecurity.com/files/167797/Patlite-1.46-Buffer-Overflow.ht
te.com/network-products/lineup/nh-fb.html - https://packetstormsecurity.com/files/167797/Patlite-1.46-Buffer-Overflow.html
CVE ID: CVE-2022-35912 State: PUBLISHED Published: 2022-07-19T15:56:59 Last Updated: 2024-08-03T09:44:22.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97 - https://grails.org/blog/2022-07-18-rce-vulnerability.html - https://github.com/grails/grails-core/issues/12626 - http://www.openwal
ils.org/blog/2022-07-18-rce-vulnerability.html - https://github.com/grails/grails-core/issues/12626 - http://www.openwall.com/lists/oss-security/2022/07/20/4
CVE ID: CVE-2022-35913 State: PUBLISHED Published: 2022-09-06T21:01:43 Last Updated: 2024-08-03T09:44:22.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin. The attacker and victim must follow each other's paynym. Then, the victim must try to collaborate with the attacker for a Stonewallx2 transaction. Next, the attacker broadcasts a tx, spending the inputs used in Stonewallx2 before the victim can broadcast the collaborative transaction. The attacker does not signal opt in RBF, and uses the lowest fee rate. This would result in the victim being unable to perform Stonewallx2. (Note that the attack
and uses the lowest fee rate. This would result in the victim being unable to perform Stonewallx2. (Note that the attacker could use multiple paynyms.) Additional Analyst Notes: - CVE Program Container: References: - https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-June/020595.html - https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-July/020737.html
CVE ID: CVE-2022-35914 State: PUBLISHED Published: 2022-09-19T00:00:00.000Z Last Updated: 2025-10-21T23:15:35.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed - https://github.com/glpi-project/glpi/releases - https://glpi-project.org/fr/glpi-10-0-3-disponible/ - http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html - https://gith
/glpi-10-0-3-disponible/ - http://packetstormsecurity.com/files/169501/GLPI-10.0.2-Command-Injection.html - https://github.com/Orange-Cyberdefense/CVE-repository/ - https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/POC_2022-35914.sh - https://mayfly277.github.io/posts/GLPI-htmlawed-CVE-2022-35914/
CVE ID: CVE-2022-35915 State: PUBLISHED Published: 2022-08-01T21:05:11.000Z Last Updated: 2025-04-23T17:54:51.563Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenZeppelin Products: openzeppelin-contracts Problem Types: CWE-400 Description: OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program
.2. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-7grf-83vw-6f5x - https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587
CVE ID: CVE-2022-35916 State: PUBLISHED Published: 2022-08-01T21:00:30.000Z Last Updated: 2025-04-23T17:54:57.118Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: OpenZeppelin Products: openzeppelin-contracts Problem Types: CWE-669 Description: OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrumL2`, will classify direct interactions of externally owned accounts (EOAs) as cross chain calls, even though they are not started on L1. This issue has been patched in v4.7.2. Users are advised to upgrade. There are no known workarounds for t
started on L1. This issue has been patched in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9j3m-g383-29qr - https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3578
CVE ID: CVE-2022-35917 State: PUBLISHED Published: 2022-08-01T21:10:11.000Z Last Updated: 2025-04-23T17:54:43.793Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: solana-labs Products: solana-pay Problem Types: CWE-670 Description: Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied `validateTransfer` function. An edge case regarding this mechanism could cause the validation logic to validate mult
ied `validateTransfer` function. An edge case regarding this mechanism could cause the validation logic to validate multiple transfers. This issue has been patched as of version `0.2.1`. Users of the Solana Pay SDK should upgrade to it. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/solana-labs/solana-pay/security/advisories/GHSA-j47c-j42c-mwqq - https://github.com/solana-labs/solana-pay/commit/ac6ce0d0a81137700874a8bf5a7caac3be999fad - https://github.com/solana-labs/solana-pay/blob/master/SPEC.md#reference - https://github.com/solana-labs/solana-pay/blob/master/core/src/validateTrans
/solana-pay/blob/master/SPEC.md#reference - https://github.com/solana-labs/solana-pay/blob/master/core/src/validateTransfer.ts
CVE ID: CVE-2022-35918 State: PUBLISHED Published: 2022-08-01T21:25:10.000Z Last Updated: 2025-04-23T17:54:37.477Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: streamlit Products: streamlit Problem Types: CWE-22 Description: Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return t
tion. An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file. This issue has been resolved in version 1.11.1. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/streamlit/streamlit/security/advisories/GHSA-v4hr-4jpx-56gc - https://github.com/streamlit/streamlit/commit/80d9979d5f4a00217743d607078a1d867fad8acf
CVE ID: CVE-2022-35919 State: PUBLISHED Published: 2022-08-01T00:00:00.000Z Last Updated: 2025-04-22T17:47:58.354Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: minio Products: minio Problem Types: CWE-22 Description: MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable Serv
bitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/minio/minio/security/advisories/GHSA-gr9v-6pcm-rqvg - https://github.com/minio/minio/pull/15429 - https://github.com/minio/minio/commit/bc72e4226e669d98c8e0f3eccc9297be9251c692 - http://packetstormsecurity.com/files/175010/Minio-2022-07-29T19-40-48Z-Path-Traversal.html
CVE ID: CVE-2022-35920 State: PUBLISHED Published: 2022-08-01T21:35:27.000Z Last Updated: 2025-04-22T17:45:43.669Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: sanic-org Products: sanic Problem Types: CWE-22 Description: Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5h
am Container: - CISA ADP Vulnrichment: References: - https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6 - https://github.com/sanic-org/sanic/issues/2478 - https://github.com/sanic-org/sanic/pull/2495
CVE ID: CVE-2022-35921 State: PUBLISHED Published: 2022-08-01T21:50:10.000Z Last Updated: 2025-04-23T17:54:25.677Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: FriendsOfFlarum Products: byobu Problem Types: CWE-269 Description: fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed. There are no wor
evaluate the impact this issue has on your forum's users and choose to disable the extension if needed. There are no workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FriendsOfFlarum/byobu/security/advisories/GHSA-6gjm-6wj6-4px5 - https://github.com/FriendsOfFlarum/byobu/commit/23dcf93a30f948d30c678a96681f7fdefeba5171
CVE ID: CVE-2022-35922 State: PUBLISHED Published: 2022-08-01T21:35:11.000Z Last Updated: 2025-04-23T17:54:31.658Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: websockets-rs Products: rust-websocket Problem Types: CWE-400 Description: Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When `Vec::with_capacity` fails to allocate, the defaul
eclared dataframe size, which may come from an untrusted source. When `Vec::with_capacity` fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use `with_capacity`, so DoS can happen only when bytes for oversized dataframe or message actually got delivered by the attacker. The crashes are fixed in version 0.26.5 by imposing default dataframe size limits. Affected users are advised to update to this version. Users unable to upgrade are advised to filter websocket traffic externally or to only accept trusted traffic. Additional Analyst Notes: -
pgrade are advised to filter websocket traffic externally or to only accept trusted traffic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/websockets-rs/rust-websocket/security/advisories/GHSA-qrjv-rf5q-qpxc - https://github.com/websockets-rs/rust-websocket/commit/cbf6e9983e839d2ecad86de8cd1b3f20ed43390b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYPNCM4H4OFBIZI6XMJ2DUTS54FT2TWP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V2EOOU5OLEHVMKAH6BALQXKDKIZRXCI/
CVE ID: CVE-2022-35923 State: PUBLISHED Published: 2022-08-02T20:10:11.000Z Last Updated: 2025-04-22T17:45:31.262Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: imbrn Products: v8n Problem Types: CWE-400 Description: v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no know
cters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9 - https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9 - https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/
CVE ID: CVE-2022-35924 State: PUBLISHED Published: 2022-08-02T17:55:13.000Z Last Updated: 2025-04-23T17:54:19.705Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: nextauthjs Products: next-auth Problem Types: CWE-20 Description: NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected. If an attacker could forge a request that sent a comma-separated list of emails (eg.: `attacker@attacker.com,victim@victim.com`) to the sign-in endpoint, NextAuth.js would send emails to both the attacker and the victim's e-mail addr
im@victim.com`) to the sign-in endpoint, NextAuth.js would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user with the email being `attacker@attacker.com,victim@victim.com`. This means that basic authorization like `email.endsWith("@victim.com")` in the `signIn` callback would fail to communicate a threat to the developer and would let the attacker bypass authorization, even with an `@attacker.com` address. This vulnerability has been patched in `v4.10.3` and `v3.29.10` by normalizing the email value that is sent to the sign-in endpoint before accessing it anywhere else. We also added a `normalizeIdentifier` callback on t
t is sent to the sign-in endpoint before accessing it anywhere else. We also added a `normalizeIdentifier` callback on the `EmailProvider` configuration, where you can further tweak your requirements for what your system considers a valid e-mail address. (E.g.: strict RFC2821 compliance). Users are advised to upgrade. There are no known workarounds for this vulnerability. If for some reason you cannot upgrade, you can normalize the incoming request using Advanced Initialization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://next-auth.js.org/configuration/initialization#advanced-initialization - https://github.com/nextauthjs/next-auth/securi
//next-auth.js.org/configuration/initialization#advanced-initialization - https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xv97-c62v-4587 - https://github.com/nextauthjs/next-auth/commit/afb1fcdae3cc30445038ef588e491d139b916003 - https://en.wikipedia.org/wiki/Email_address#Local-part - https://next-auth.js.org/configuration/callbacks#sign-in-callback - https://next-auth.js.org/providers/email - https://next-auth.js.org/providers/email#normalizing-the-e-mail-address - https://nodemailer.com/message/addresses
CVE ID: CVE-2022-35925 State: PUBLISHED Published: 2022-08-02T20:15:15.000Z Last Updated: 2025-04-22T17:43:24.043Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: bookwyrm-social Products: bookwyrm Problem Types: CWE-287 Description: BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their `nginx.conf` file that was created when the instance was set up. Users are advised advised to upgrade. Users unable to upgrade may update their nginx.conf files wi
instance was set up. Users are advised advised to upgrade. Users unable to upgrade may update their nginx.conf files with the changes manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-jvp3-mqv8-5rjw - https://huntr.dev/bounties/ebee593d-3fd0-4985-bf5e-7e7927e08bf6/ - https://www.github.com/bookwyrm-social/bookwyrm/commit/7bbe42fb30a79a26115524d18b697d895563c92f
CVE ID: CVE-2022-35926 State: PUBLISHED Published: 2022-08-04T20:30:18.000Z Last Updated: 2025-04-23T17:53:28.103Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-125 Description: Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki-NG, attackers can send neighbor solicitation packets that trigger an out-of-bounds read. The problem exists in the module os/net/ipv6/uip-nd6.c, where memory read operations from the main packet buffer, <code>uip_buf</code>, are not checked if they go out of bounds. In parti
ry read operations from the main packet buffer, <code>uip_buf</code>, are not checked if they go out of bounds. In particular, this problem can occur when attempting to read the 2-byte option header and the Source Link-Layer Address Option (SLLAO). This attack requires ipv6 be enabled for the network. The problem has been patched in the develop branch of Contiki-NG. The upcoming 4.8 release of Contiki-NG will include the patch.Users unable to upgrade may apply the patch in Contiki-NG PR #1654. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.8 - https://github.com/contiki-ng/contiki-ng
ences: - https://github.com/contiki-ng/contiki-ng/releases/tag/release%2Fv4.8 - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-4hpq-4f53-w386 - https://github.com/contiki-ng/contiki-ng/pull/1654 - https://github.com/contiki-ng/contiki-ng/pull/1654/commits/a4597001d50a04f4b9c78f323ba731e2f979802c
CVE ID: CVE-2022-35927 State: PUBLISHED Published: 2022-08-04T20:35:14.000Z Last Updated: 2025-04-23T17:53:22.094Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-120 Description: Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating system, an incoming DODAG Information Option (DIO) control message can contain a prefix information option with a length parameter. The value of the length parameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_fr
ameter is not validated, however, and it is possible to cause a buffer overflow when copying the prefix in the set_ip_from_prefix function. This vulnerability affects anyone running a Contiki-NG version prior to 4.7 that can receive RPL DIO messages from external parties. To obtain a patched version, users should upgrade to Contiki-NG 4.7 or later. There are no workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9rm9-3phh-p4wm - https://github.com/contiki-ng/contiki-ng/pull/1589 - https://github.com/contiki-ng/contiki-ng/pull/1589/commits/4fffab0e632c4d01910fa95
com/contiki-ng/contiki-ng/pull/1589 - https://github.com/contiki-ng/contiki-ng/pull/1589/commits/4fffab0e632c4d01910fa957d1fd9ef321eb87d2