Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e extension. The web version of TurboWarp is not affected. This bug has been addressed in commit `55e07e99b59` after an initial fix which was reverted. Users are advised to upgrade to version 1.8.0 or later. Users unable to upgrade should avoid opening sb3 files or loading extensions from untrusted sources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TurboWarp/desktop/security/advisories/GHSA-wg4p-vj7h-q82q - https://github.com/TurboWarp/desktop/commit/55e07e99b59db334d75e8f46792a1569ab0884a6 - https://github.com/TurboWarp/desktop/commit/a62dbd7a28b41857e3b6f32443fda0527d493267 - https://github.com/TurboWarp/desktop/commit/f0f8
com/TurboWarp/desktop/commit/a62dbd7a28b41857e3b6f32443fda0527d493267 - https://github.com/TurboWarp/desktop/commit/f0f82aaf6cc8170e9da8b36953c98bfe533c019f
CVE ID: CVE-2023-40170 State: PUBLISHED Published: 2023-08-28T20:01:57.156Z Last Updated: 2025-02-13T17:03:25.640Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: jupyter-server Products: jupyter_server Problem Types: CWE-284, CWE-306 Description: jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performa
h has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-64x5-55rw-9974 - https://github.com/jupyter-server/jupyter_server/commit/87a4927272819f0b1cae1afa4c8c86ee2da002fd - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XDKQAWQN6SQTOVACZNXYKEHWQXGG4DOF/ - https://lists.fedoraproject.org/archives/lis
nnounce@lists.fedoraproject.org/message/XDKQAWQN6SQTOVACZNXYKEHWQXGG4DOF/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRP7DNZYVOIA4ZB3U3ZWKTFZEPYWNGCQ/
CVE ID: CVE-2023-40171 State: PUBLISHED Published: 2023-08-17T21:19:28.326Z Last Updated: 2024-10-07T19:47:13.307Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Netflix Products: dispatch Problem Types: CWE-209 Description: Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to decode a JWT token. Any Dispatch users who own their instance and rely on the `Dispatch Plugin - Basic Authentication Provider` plugin for authentication may be impacted, allowin
nce and rely on the `Dispatch Plugin - Basic Authentication Provider` plugin for authentication may be impacted, allowing for any account to be taken over within their own instance. This could be done by using the secret to sign attacker crafted JWTs. If you think that you may be impacted, we strongly suggest you to rotate the secret stored in the `DISPATCH_JWT_SECRET` envvar in the `.env` file. This issue has been addressed in commit `b1942a4319` which has been included in the `20230817` release. users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Net
bility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Netflix/dispatch/security/advisories/GHSA-fv3x-67q3-6pg7 - https://github.com/Netflix/dispatch/pull/3695 - https://github.com/Netflix/dispatch/commit/b1942a4319f0de820d86b84a58ebc85398b97c70 - https://github.com/Netflix/dispatch/releases/tag/latest
CVE ID: CVE-2023-40172 State: PUBLISHED Published: 2023-08-18T21:48:42.294Z Last Updated: 2024-10-02T15:36:25.629Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: fobybus Products: social-media-skeleton Problem Types: CWE-352 Description: Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on a website that they do not intend to do. This can be done by sending the victim a malicious link or by exploiting a vulnerability in the website. Prior to version 1.0.
an be done by sending the victim a malicious link or by exploiting a vulnerability in the website. Prior to version 1.0.5 Social media skeleton did not properly restrict CSRF attacks. This has been addressed in version 1.0.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-873h-pqjx-3pwg - https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848
CVE ID: CVE-2023-40173 State: PUBLISHED Published: 2023-08-18T21:47:17.987Z Last Updated: 2024-10-02T15:49:30.520Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: fobybus Products: social-media-skeleton Problem Types: CWE-522 Description: Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue. Add
has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-rfmv-7m7g-v628 - https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848 - https://github.com/fobybus/social-media-skeleton/commit/df31da44ffed3ea065cbbadc3c8052d0d489a2ef
CVE ID: CVE-2023-40174 State: PUBLISHED Published: 2023-08-18T21:41:53.666Z Last Updated: 2024-10-03T14:16:00.246Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: fobybus Products: social-media-skeleton Problem Types: CWE-613 Description: Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. Social media skeleton releases prior to 1.0.5 did not properly limit manage user session lifecycles. This issue has been addressed in
keleton releases prior to 1.0.5 did not properly limit manage user session lifecycles. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-cr5c-ggwq-g4hq - https://github.com/fobybus/social-media-skeleton/commit/99738b2cc5efb6a5739161c931daa43f99431e5a
CVE ID: CVE-2023-40175 State: PUBLISHED Published: 2023-08-18T21:35:47.577Z Last Updated: 2024-10-07T20:04:46.951Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: puma Products: puma Problem Types: CWE-444 Description: Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or
ing puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8 - https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a
CVE ID: CVE-2023-40176 State: PUBLISHED Published: 2023-08-23T19:33:15.234Z Last Updated: 2024-10-02T20:42:19.534Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user p
value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights). This issue is present since version 4.1M2 when the time zone user preference was introduced. The issue has been fixed in XWiki 14.10.5 and 15.1RC1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/secu
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h8cm-3v5f-rgp6 - https://github.com/xwiki/xwiki-platform/commit/d11ca5d781f8a42a85bc98eb82306c1431e764d4 - https://jira.xwiki.org/browse/XWIKI-7847
CVE ID: CVE-2023-40177 State: PUBLISHED Published: 2023-08-23T20:11:45.227Z Last Updated: 2024-10-03T13:41:37.138Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-95 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is present since version 4.3M2 when AppWithinMinutes Application added support for the Content field, allowing any wiki page (including the user
4.3M2 when AppWithinMinutes Application added support for the Content field, allowing any wiki page (including the user profile page) to use its content as an AWM Content field, which has a custom displayer that executes the content with the rights of the ``AppWithinMinutes.Content`` author, rather than the rights of the content author. The vulnerability has been fixed in XWiki 14.10.5 and 15.1RC1. The fix is in the content of the AppWithinMinutes.Content page that defines the custom displayer. By using the ``display`` script service to render the content we make sure that the proper author is used for access rights checks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
the proper author is used for access rights checks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5mf8-v43w-mfxp - https://github.com/xwiki/xwiki-platform/commit/dfb1cde173e363ca5c12eb3654869f9719820262 - https://jira.xwiki.org/browse/XWIKI-7369
CVE ID: CVE-2023-40178 State: PUBLISHED Published: 2023-08-23T20:15:23.057Z Last Updated: 2024-10-02T18:56:08.820Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: node-saml Products: node-saml Problem Types: CWE-347 Description: Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large sc
In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale. This issue was patched in version 4.0.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/node-saml/node-saml/security/advisories/GHSA-vx8m-6fhw-pccw - https://github.com/node-saml/node-saml/commit/045e3b9c54211fdb95f96edf363679845b195cec - https://github.com/node-saml/node-saml/releases/tag/v4.0.5
CVE ID: CVE-2023-40179 State: PUBLISHED Published: 2023-08-25T00:58:56.607Z Last Updated: 2024-10-02T17:43:31.803Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mesosoi Products: silverwaregames-io-issue-tracker Problem Types: CWE-204 Description: Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the specified email was not found in our database. It would only display the "Enter the code" form if the email is associated with a member of the site. Since version 1.3.6, the "Enter the code" form is always returned, showing the message "If the entered emai
of the site. Since version 1.3.6, the "Enter the code" form is always returned, showing the message "If the entered email is associated with an account, a code will be sent now". This change prevents potential violators from determining if our site has a user with the specified email. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-789j-chfj-58hr
CVE ID: CVE-2023-40180 State: PUBLISHED Published: 2023-10-16T18:05:14.806Z Last Updated: 2024-09-16T17:21:39.838Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silverstripe Products: silverstripe-graphql Problem Types: CWE-400 Description: silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attac
rstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-v23w-pppm-jh66 - https://github.com/silverstripe/silverstripe-graphql/commit/f6d5976ec4608e51184b0db1ee5b9e9a99d
es/GHSA-v23w-pppm-jh66 - https://github.com/silverstripe/silverstripe-graphql/commit/f6d5976ec4608e51184b0db1ee5b9e9a99d2501c - https://docs.silverstripe.org/en/developer_guides/graphql/security_and_best_practices/recursive_or_complex_queries - https://github.com/silverstripe/silverstripe-graphql/tree/3.8#recursive-or-complex-queries - https://www.silverstripe.org/download/security-releases/CVE-2023-40180
CVE ID: CVE-2023-40181 State: PUBLISHED Published: 2023-08-31T21:06:14.883Z Last Updated: 2025-11-03T20:35:49.526Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125, CWE-191 Description: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are adv
d packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxp4-rx7x-h2g8 - https://github.com/FreeRDP/FreeRDP/blob/2252d53001d9ce8a452f0a0a5b1f5ed9db6d57f1/libfreerdp/codec/zgfx.c#L256-L261 - https://github.com/FreeRDP/FreeRDP/blob/2252d53001d9ce8a452f0a0a5b1f5ed9db6d57f1/libfreerdp/codec/zgfx.c#L334-L355 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/ - https://l
project.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html - https://security.gentoo.org/glsa/202401-16
CVE ID: CVE-2023-40182 State: PUBLISHED Published: 2023-08-25T00:36:40.066Z Last Updated: 2024-09-30T18:18:19.411Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mesosoi Products: silverwaregames-io-issue-tracker Problem Types: CWE-208 Description: Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mesosoi/silverwaregames-io-issue-t
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-9684-6j5x-ccx9
CVE ID: CVE-2023-40183 State: PUBLISHED Published: 2023-09-21T14:21:49.833Z Last Updated: 2024-09-24T18:17:15.144Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: dataease Products: dataease Problem Types: CWE-434 Description: DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the `ImageIO.read()` method to determine whether the file is an image file or not. There is no whitelisting restriction on file suffixes. This allows the attacker to synthesize the attack code into an image for uploading and change the file extensi
suffixes. This allows the attacker to synthesize the attack code into an image for uploading and change the file extension to html. The attacker may steal user cookies by accessing links. The vulnerability has been fixed in v1.18.11. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-w2r4-2r4w-fjxv - https://github.com/dataease/dataease/commit/826513053146721a2b3e09a9c9d3ea41f8f10569 - https://github.com/dataease/dataease/releases/tag/v1.18.11
CVE ID: CVE-2023-40184 State: PUBLISHED Published: 2023-08-30T17:48:30.552Z Last Updated: 2025-11-03T19:28:18.386Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-755 Description: xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't us
max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-f489-557v-47jq - https://github.com/neutrinolabs/xrdp/commit/a111a0fdfe2421ef600e40708b5f0168594cfb23 - https://github.com/neutrinolabs/xrdp/blame/9bbb2ec68f390504c32f2062847aa3d821a0089a/sesman/sesexec/session.c#L571C5-L571C19 - https://lists.fedoraproj
s/xrdp/blame/9bbb2ec68f390504c32f2062847aa3d821a0089a/sesman/sesexec/session.c#L571C5-L571C19 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5IXMQODV3OIJ7DRQBUQV7PUKNT7SH36/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SOT237TIHTHPX5YNIWLVNINOEYC7WMG2/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URO3FKTFBPNKFARAQBEJLI4MH6YS35P5/
CVE ID: CVE-2023-40185 State: PUBLISHED Published: 2023-08-23T20:20:45.807Z Last Updated: 2024-09-30T19:14:01.973Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: ericcornelissen Products: shescape Problem Types: CWE-150 Description: shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell. This bug has been patched in version 1.7.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
ell. This bug has been patched in version 1.7.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j55r-787p-m549 - https://github.com/ericcornelissen/shescape/pull/1142 - https://github.com/ericcornelissen/shescape/commit/0b976dab645abf45ffd85e74a8c6e51ee2f42d63 - https://github.com/ericcornelissen/shescape/releases/tag/v1.7.4