Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-48166 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-20T16:38:42.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in the SOAP Server integrated in Atos Unify OpenScape Voice V10 before V10R3.26.1 allows a remote attacker to view the contents of arbitrary files in the local file system. An unauthenticated attacker might obtain sensitive files that allow for the compromise of the underlying system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://networks.unify.com/security/advisories/OBSO-2401-01.pdf - https://labs.integrity.pt/advisories/cve-2023-48
es: - https://networks.unify.com/security/advisories/OBSO-2401-01.pdf - https://labs.integrity.pt/advisories/cve-2023-48166/
CVE ID: CVE-2023-48171 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-13T18:29:24.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gccybermonks.com/posts/defectdojo/
CVE ID: CVE-2023-48172 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:23:39.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in Shuttle Booking Software 2.0 allows a remote attacker to inject JavaScript via the name, description, title, or address parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/shuttle-booking-software/ - http://packetstormsecurity.com/files/175800 - https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48172
CVE ID: CVE-2023-48176 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-11-26T19:44:24.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://prairie-steed-4d7.notion.site/WebsiteGuide-vulnerability-analysis-33a701c4fbf24555bffde17da0c73d8d?pvs=4
CVE ID: CVE-2023-48183 State: PUBLISHED Published: 2024-04-23T00:00:00 Last Updated: 2024-08-02T21:23:39.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bellard/quickjs/issues/192 - https://github.com/bellard/quickjs/commit/c4cdd61a3ed284cd760faf6b00bbf0cb908da077
CVE ID: CVE-2023-48184 State: PUBLISHED Published: 2024-04-23T00:00:00 Last Updated: 2024-08-02T21:23:39.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: QuickJS before 7414e5f has a quickjs.h JS_FreeValueRT use-after-free because of incorrect garbage collection of async functions with closures. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bellard/quickjs/issues/198
CVE ID: CVE-2023-48185 State: PUBLISHED Published: 2023-11-17T00:00:00 Last Updated: 2024-08-02T21:23:39.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request. Additional Analyst Notes: - CVE Program Container: References: - https://forum.terra-master.com/cn/viewtopic.php?f=100&t=3842&p=17623#p17623 - https://forum.terra-master.com/cn/viewtopic.php?f=100&t=3842&p=17623#p
CVE ID: CVE-2023-48188 State: PUBLISHED Published: 2023-11-27T00:00:00 Last Updated: 2024-08-02T21:23:39.024Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in PrestaShop opartdevis v.4.5.18 thru v.4.6.12 allows a remote attacker to execute arbitrary code via a crafted script to the getModuleTranslation function. Additional Analyst Notes: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2023/11/23/opartdevis.html
CVE ID: CVE-2023-48192 State: PUBLISHED Published: 2023-11-20T00:00:00 Last Updated: 2024-08-02T21:23:39.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTOlink A3700R v.9.1.2u.6134_B20201202 allows a local attacker to execute arbitrary code via the setTracerouteCfg function. Additional Analyst Notes: - CVE Program Container: References: - http://totolink.com - https://www.totolink.net/ - https://github.com/zxsssd/TotoLink-
CVE ID: CVE-2023-48193 State: PUBLISHED Published: 2023-11-28T00:00:00 Last Updated: 2024-08-02T21:23:39.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function. NOTE: this is disputed because command filtering is not intended to restrict what code can be run by authorized users who are allowed to execute files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jumpserver/jumpserver - http://jumpserver.com - https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md - https://blog.fit2cl
server - http://jumpserver.com - https://github.com/296430468/lcc_test/blob/main/jumpserver_BUG.md - https://blog.fit2cloud.com/?p=8cf83cd9-c23b-4625-9350-38926fb7f88e - https://github.com/jumpserver/jumpserver/issues/13394
CVE ID: CVE-2023-48194 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-10-24T17:36:39.015027 Vendors: n/a Products: n/a Problem Types: n/a Description: Vulnerability in Tenda AC8v4 .V16.03.34.09 due to sscanf and the last digit of s8 being overwritten with \x0. After executing set_client_qos, control over the gp register can be obtained. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://tenda.com - https://github.com/zt20xx/CVE-2023-48194 - https://www.tenda.com.cn/download/detail-3683.html
CVE ID: CVE-2023-48197 State: PUBLISHED Published: 2023-11-15T00:00:00.000Z Last Updated: 2025-09-29T13:59:05.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grocy/grocy - https://nitipoom-jar.github.io/CVE-2023-48197/ - https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48197
CVE ID: CVE-2023-48198 State: PUBLISHED Published: 2023-11-15T00:00:00.000Z Last Updated: 2025-09-29T14:05:18.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to obtain a victim's cookies. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grocy/grocy - https://nitipoom-jar.github.io/CVE-2023-48198 - https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48198
CVE ID: CVE-2023-48199 State: PUBLISHED Published: 2023-11-15T00:00:00.000Z Last Updated: 2025-09-29T14:08:09.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker can then manipulate page content in the QR code detail popup, often coupled with social engineering tactics, exploiting both the trust of users and the application's lack of proper input handling. Additional Analyst Notes: - CV
, exploiting both the trust of users and the application's lack of proper input handling. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grocy/grocy - https://grocy.info - https://nitipoom-jar.github.io/CVE-2023-48199/ - https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48199
CVE ID: CVE-2023-48200 State: PUBLISHED Published: 2023-11-15T00:00:00.000Z Last Updated: 2025-09-29T14:12:05.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment description component within /equipment/ component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grocy/grocy - https://nitipoom-jar.github.io/CVE-2023-48200/ - https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48200
CVE ID: CVE-2023-48201 State: PUBLISHED Published: 2024-01-27T00:00:00.000Z Last Updated: 2025-05-29T15:11:48.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Sunlight CMS v.8.0.1, allows remote authenticated attackers to execute arbitrary code and escalate privileges via a crafted script to the Content text editor component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mechaneus.github.io/CVE-2023-48201.html
CVE ID: CVE-2023-48202 State: PUBLISHED Published: 2024-01-27T00:00:00.000Z Last Updated: 2025-05-29T15:11:39.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mechaneus.github.io/CVE-2023-48202.html
CVE ID: CVE-2023-48204 State: PUBLISHED Published: 2023-11-15T00:00:00 Last Updated: 2024-08-29T15:23:03.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sanluan/PublicCMS/issues/77
CVE ID: CVE-2023-48205 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:23:39.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/175802
CVE ID: CVE-2023-48206 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-10-09T15:19:03.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via the page parameter to login.php or header.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/175803
CVE ID: CVE-2023-48207 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:23:39.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/175804
CVE ID: CVE-2023-48208 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-11-26T15:38:44.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_api_key, plugin_sms_country_code, uuid, title, or country name parameter to index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/175805
CVE ID: CVE-2023-48217 State: PUBLISHED Published: 2023-11-14T21:38:37.590Z Last Updated: 2024-08-30T14:03:24.570Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: statamic Products: cms Problem Types: CWE-94 Description: Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14
ious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86 - https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411
CVE ID: CVE-2023-48218 State: PUBLISHED Published: 2023-11-20T17:09:49.274Z Last Updated: 2024-08-02T21:23:39.034Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: strapi-community Products: strapi-plugin-protected-populate Problem Types: CWE-863 Description: The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds. Additional Analyst Notes: - CVE Program Containe
ssue has been patched in version 1.3.4. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7 - https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39 - https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4
CVE ID: CVE-2023-48219 State: PUBLISHED Published: 2023-11-15T18:59:03.776Z Last Updated: 2024-08-29T17:42:00.819Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tinymce Products: tinymce Problem Types: CWE-79 Description: TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization according to the HTML standard. If such text nodes contain a special character reserved as an internal marker, they can be combined with other HTML patterns to form malicious snippets. These
haracter reserved as an internal marker, they can be combined with other HTML patterns to form malicious snippets. These snippets pass the initial sanitisation layer when the content is parsed into the editor body, but can trigger XSS when the special internal marker is removed from the content and re-parsed. his vulnerability has been patched in TinyMCE versions 6.7.3 and 5.10.9. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tinymce/tinymce/security/advisories/GHSA-v626-r774-j7f8 - https://tiny.cloud/docs/release-notes/release-notes5109/ - https
nymce/tinymce/security/advisories/GHSA-v626-r774-j7f8 - https://tiny.cloud/docs/release-notes/release-notes5109/ - https://tiny.cloud/docs/tinymce/6/6.7.3-release-notes/
CVE ID: CVE-2023-48220 State: PUBLISHED Published: 2024-02-20T17:24:37.791Z Last Updated: 2025-04-24T15:04:40.243Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: decidim Products: decidim Problem Types: CWE-672 Description: Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable dependencies starting in version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-sy
version 0.0.1.alpha3 and prior to versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems. When using the password reset functionality, the `devise_invitable` gem always accepts the pending invitation if the user has been invited. The only check done is if the user has been invited but the code does not ensure that the pending invitation is still valid as defined by the `invite_for` expiry period. Decidim sets this configuration to `2.weeks` so this configuration should be respected. The bug is in the `devise_invitable` gem and should be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to
d be fixed there and the dependency should be upgraded in Decidim once the fix becomes available. `devise_invitable` to version `2.0.9` and above fix this issue. Versions 0.26.9, 0.27.5, and 0.28.0 of the `decidim,` `decidim-admin`, and `decidim-system` gems contain this fix. As a workaround, invitations can be cancelled directly from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp - https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34 - https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454 - https://gith
a784002ebba30f2ebb34 - https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454 - https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098 - https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134 - https://github.com/decidim/decidim/releases/tag/v0.26.9 - https://github.com/decidim/decidim/releases/tag/v0.27.5 - https://github.com/decidim/decidim/releases/tag/v0.28.0 - https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198
CVE ID: CVE-2023-48221 State: PUBLISHED Published: 2023-11-20T17:18:19.030Z Last Updated: 2024-08-02T21:23:39.025Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H) Vendors: wireapp Products: wire-avs Problem Types: CWE-134 Description: wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available. Additional Analyst Notes:
.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wireapp/wire-avs/security/advisories/GHSA-m4xg-fcr3-w3pq - https://github.com/wireapp/wire-avs/commit/364c3326a1331a84607bce2e17126306d39150cd
CVE ID: CVE-2023-48222 State: PUBLISHED Published: 2023-11-16T21:59:17.837Z Last Updated: 2024-08-29T14:41:54.188Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: rundeck Products: rundeck Problem Types: CWE-862 Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no
essary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rundeck/rundeck/security/advisories/GHSA-phmw-jx86-x666
CVE ID: CVE-2023-48223 State: PUBLISHED Published: 2023-11-20T17:39:56.816Z Last Updated: 2024-08-02T21:23:39.066Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: nearform Products: fast-jwt Problem Types: CWE-20 Description: fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. The 'publicKeyPemMatcher' in 'fast-jwt/src/crypto.js' does not properly match all common PEM formats for public keys. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA ke
rability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application. This attack will only work if the victim application utilizes a public key containing the `BEGIN RSA PUBLIC KEY` header. Applications using the RS256 algorithm, a public key with a `BEGIN RSA PUBLIC KEY` header, and calling the verify function without explicitly providing an algorithm, are vulnerable to this algorithm confusion attack which allows attackers to sign arbitrary payloads which will be accepted by the verifier. Version 3.3.2 contains a patch for this issue. As a workaround, change line 29 of `blob/master/src/crypto.js` to include a r
ion 3.3.2 contains a patch for this issue. As a workaround, change line 29 of `blob/master/src/crypto.js` to include a regular expression. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nearform/fast-jwt/security/advisories/GHSA-c2ff-88x2-x9pg - https://github.com/nearform/fast-jwt/blob/master/src/crypto.js#L29 - https://github.com/nearform/fast-jwt/releases/tag/v3.3.2
CVE ID: CVE-2023-48224 State: PUBLISHED Published: 2023-11-15T20:53:19.590Z Last Updated: 2024-08-29T15:02:52.052Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: ethyca Products: fides Problem Types: CWE-338 Description: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or d
on. Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it. Consent request allows data subject users to modify their privacy preferences for how the data controller uses their personal data e.g. data sales and sharing consent opt-in/opt-out. If `subject_identity_verification_required` in the `[execution]` section of `fides.toml` or the env var `FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED` is set to `True` on the fides webserver backend, data subjects are sent a one-time code to their email address or phone number, depending on messaging configuration, and the one-time code must be entered in the Privacy