Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
o/vulnerability-database/CVE-2022-32166 - https://github.com/cloudbase/ovs/commit/2ed6505555cdcb46f9b1f0329d1491b75290fc73 - https://lists.debian.org/debian-lts-announce/2022/10/msg00036.html
CVE ID: CVE-2022-32167 State: PUBLISHED Published: 2022-09-20T14:45:19.000Z Last Updated: 2025-05-29T13:50:36.589Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Cloudreve Products: Cloudreve Problem Types: CWE-79 Description: Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32167
CVE ID: CVE-2022-32168 State: PUBLISHED Published: 2022-09-28T09:00:15.327Z Last Updated: 2025-05-21T14:14:43.298Z Vendors: notepad-plus-plus Products: notepad-plus-plus Problem Types: CWE-427 Description: Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32168 - https://github.com/notepad-plus-plus/notepad-plus-plus/commit/85d7215d9b3e0d5a8433fc31aec4f2966821051e
CVE ID: CVE-2022-32169 State: PUBLISHED Published: 2022-09-28T09:30:23.675Z Last Updated: 2025-05-21T13:57:27.821Z Vendors: bytebase Products: bytebase Problem Types: CWE-285 Description: The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32169 - https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/issue.ts#L108-L187
CVE ID: CVE-2022-32170 State: PUBLISHED Published: 2022-09-28T09:30:18.081Z Last Updated: 2025-05-21T14:05:26.762Z Vendors: bytebase Products: bytebase Problem Types: CWE-285 Description: The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32170 - https://github.com/bytebase/bytebase/blob/1.0.4/frontend/src/store/modules/project.ts#L166-L197
CVE ID: CVE-2022-32171 State: PUBLISHED Published: 2022-10-06T17:14:15.732295Z Last Updated: 2024-09-17T01:41:50.446Z Vendors: zinc Products: zinc Problem Types: CWE-79 Description: In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zinclabs/zinc/commit/3376c248bade163430f9347742428f0a82cd322d - https://www.mend.io/vulnerability-database/CVE-2022-32171
CVE ID: CVE-2022-32172 State: PUBLISHED Published: 2022-10-06T17:13:36.407988Z Last Updated: 2024-09-16T22:02:26.570Z Vendors: zinc Products: zinc Problem Types: CWE-79 Description: In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-32172 - https://github.com/zinclabs/zinc/commit/3376c248bade163430f9347742428f0a82cd322d
CVE ID: CVE-2022-32173 State: PUBLISHED Published: 2022-10-03T12:25:08.390383Z Last Updated: 2024-09-16T19:15:42.733Z Vendors: OrchardCore Products: OrchardCore Problem Types: CWE-79 Description: In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-32173 - https://github.com/OrchardCMS/OrchardCore/commit/0163c88ddeaca39815d7e6e5ea1c8391085cc136
CVE ID: CVE-2022-32174 State: PUBLISHED Published: 2022-10-11T14:20:16.527Z Last Updated: 2025-05-16T13:49:17.944Z Vendors: gogs Products: gogs Problem Types: CWE-79 Description: In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32174 - https://github.com/gogs/gogs/blob/v0.12.10/public/js/gogs.js#L263
CVE ID: CVE-2022-32175 State: PUBLISHED Published: 2022-10-11T14:20:11.178Z Last Updated: 2025-05-20T14:10:22.988Z Vendors: AdguardHome Products: AdguardHome Problem Types: CWE-352 Description: In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the custom filtering rules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32175 - https://github.com/AdguardTeam/AdGuardHome/blob/v0.108.0-b.13/internal/ho
end.io/vulnerability-database/CVE-2022-32175 - https://github.com/AdguardTeam/AdGuardHome/blob/v0.108.0-b.13/internal/home/controlfiltering.go#L265
CVE ID: CVE-2022-32176 State: PUBLISHED Published: 2022-10-17T18:25:09.233Z Last Updated: 2025-05-10T02:53:12.843Z Vendors: gin-vue-admin Products: gin-vue-admin Problem Types: CWE-434 Description: In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin's cookie leading to account takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32176 - https://git
ontainer: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32176 - https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/image.vue#L43-L49
CVE ID: CVE-2022-32177 State: PUBLISHED Published: 2022-10-14T07:00:14.339Z Last Updated: 2025-05-14T15:19:24.105Z Vendors: gin-vue-admin Products: gin-vue-admin Problem Types: CWE-434 Description: In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32177 - https://gi
Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32177 - https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37
CVE ID: CVE-2022-32189 State: PUBLISHED Published: 2022-08-09T20:17:59 Last Updated: 2024-08-03T07:32:56.026Z Vendors: Go standard library Products: math/big Problem Types: CWE 400: Uncontrolled Resource Consumption Description: A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/cl/417774 - https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66 - https://go.dev/issue/53871 - https://groups.google.com/g/golang-announce/c/YqYYG87xB10 - https://pkg.go.dev/vuln/GO-2022-0537
CVE ID: CVE-2022-32190 State: PUBLISHED Published: 2022-09-13T17:08:57 Last Updated: 2024-08-03T07:32:56.001Z Vendors: Go standard library Products: net/url Problem Types: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce/c/x49AQzIVX-s - https://go.dev/issue/54385 - htt
am Container: References: - https://groups.google.com/g/golang-announce/c/x49AQzIVX-s - https://go.dev/issue/54385 - https://go.dev/cl/423514 - https://pkg.go.dev/vuln/GO-2022-0988
CVE ID: CVE-2022-32191 State: REJECTED Published: N/A Last Updated: 2024-07-02T16:15:41.909Z Description: No description available.
CVE ID: CVE-2022-32192 State: PUBLISHED Published: 2022-06-13T22:15:07 Last Updated: 2024-08-03T07:32:56.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. Additional Analyst Notes: - CVE Program Container: References: - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts
CVE ID: CVE-2022-32193 State: PUBLISHED Published: 2022-06-13T20:45:55 Last Updated: 2024-08-03T07:32:56.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. Additional Analyst Notes: - CVE Program Container: References: - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts
CVE ID: CVE-2022-32195 State: PUBLISHED Published: 2022-06-09T00:36:32 Last Updated: 2024-08-03T07:32:56.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/edx - https://discuss.openedx.org/t/security-patch-for-logout-page-xss-vulnerability/7408
CVE ID: CVE-2022-32199 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T20:46:59.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.scriptcase.net/download/ - https://github.com/Toxich4/CVE-2022-32199
CVE ID: CVE-2022-32200 State: PUBLISHED Published: 2022-06-01T05:12:58 Last Updated: 2024-08-03T07:32:56.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: libdwarf 0.4.0 has a heap-based buffer over-read in _dwarf_check_string_valid in dwarf_util.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.prevanders.net/dwarfbug.html - https://github.com/davea42/libdwarf-code/issues/116 - https://github.com/davea42/libdwarf-code/commit/8151575a6ace77d005ca5bb5d71c1bfdba3f7069
CVE ID: CVE-2022-32201 State: PUBLISHED Published: 2022-06-01T05:12:47 Last Updated: 2024-08-03T07:32:55.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libjpeg 1.63, there is a NULL pointer dereference in Component::SubXOf in component.hpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thorfdbg/libjpeg/commit/ea6315164b1649ff932a396b7600eac4bffcfaba - https://github.com/thorfdbg/libjpeg/issues/73
CVE ID: CVE-2022-32202 State: PUBLISHED Published: 2022-06-01T05:12:37 Last Updated: 2024-08-03T07:32:55.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libjpeg 1.63, there is a NULL pointer dereference in LineBuffer::FetchRegion in linebuffer.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thorfdbg/libjpeg/commit/51c3241b6da39df30f016b63f43f31c4011222c7 - https://github.com/thorfdbg/libjpeg/issues/74
CVE ID: CVE-2022-32203 State: PUBLISHED Published: 2024-12-20T01:54:16.686Z Last Updated: 2024-12-20T17:08:06.041Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: CV81-WDM FW Problem Types: CWE-77 Description: There is a command injection vulnerability in Huawei terminal printer product. Successful exploitation could result in the highest privileges of the printer. (Vulnerability ID: HWPSIRT-2022-51773) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32203. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220601-01
Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220601-01-6b47c6b6-en
CVE ID: CVE-2022-32204 State: PUBLISHED Published: 2024-12-20T01:57:06.968Z Last Updated: 2024-12-24T00:40:34.532Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: CV81-WDM FW Problem Types: CWE-20 Description: There is an improper input verification vulnerability in Huawei printer product. Successful exploitation of this vulnerability may cause service abnormal. (Vulnerability ID: HWPSIRT-2022-87185) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32204. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220608-01-1a91f8
- CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220608-01-1a91f8a4-en
CVE ID: CVE-2022-32205 State: PUBLISHED Published: 2022-07-07T00:00:00.000Z Last Updated: 2025-05-05T16:17:03.151Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-770 Description: A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are k
quests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1569946 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - https://w
oject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - https://www.debian.org/security/2022/dsa-5197 - https://security.netapp.com/advisory/ntap-20220915-0003/ - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf - https://security.gentoo.org/glsa/202212-01
CVE ID: CVE-2022-32206 State: PUBLISHED Published: 2022-07-07T00:00:00.000Z Last Updated: 2025-05-05T16:16:54.022Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-770 Description: curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand return
result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1570651 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - https://www.debian.org/security/2022/dsa-5197 - https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html - https://security.netapp.com/advisory/ntap-20220915-0003/ - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldi
3/ - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf - https://security.gentoo.org/glsa/202212-01 - http://www.openwall.com/lists/oss-security/2023/02/15/3
CVE ID: CVE-2022-32207 State: PUBLISHED Published: 2022-07-07T00:00:00.000Z Last Updated: 2025-04-23T18:04:31.119Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-840 Description: When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1573634 - https://lists
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1573634 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - https://www.debian.org/security/2022/dsa-5197 - https://security.netapp.com/advisory/ntap-20220915-0003/ - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://security.gentoo.org/glsa/202212-01
CVE ID: CVE-2022-32208 State: PUBLISHED Published: 2022-07-07T00:00:00.000Z Last Updated: 2025-05-05T16:16:44.842Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-840 Description: When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1590071 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - https
raproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/ - https://www.debian.org/security/2022/dsa-5197 - https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html - https://security.netapp.com/advisory/ntap-20220915-0003/ - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://security.gentoo.org/glsa/202212-01
CVE ID: CVE-2022-32209 State: PUBLISHED Published: 2022-06-24T00:00:00.000Z Last Updated: 2025-11-03T21:46:21.461Z Vendors: n/a Products: https://github.com/rails/rails-html-sanitizer Problem Types: CWE-79 Description: # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed ta
Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```<%= sanitize @comment.body, tags: ["select", "style"] %>```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done
] %>```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])```All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.
are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user). Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1530898 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHDACMCLWE32BZZTSNWQPIFUAD5I6Q47/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00012.html
CVE ID: CVE-2022-32210 State: PUBLISHED Published: 2022-07-14T14:51:40 Last Updated: 2024-08-03T07:32:56.020Z Vendors: n/a Products: https://github.com/nodejs/undici Problem Types: CWE-295 Description: `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1583680 - https://github.com/nodejs/undici/security/ad
VE Program Container: References: - https://hackerone.com/reports/1583680 - https://github.com/nodejs/undici/security/advisories/GHSA-pgw7-wx7w-2w33