Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-31121 State: PUBLISHED Published: 2022-07-07T18:00:14.000Z Last Updated: 2025-04-23T18:04:03.524Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: hyperledger Products: fabric Problem Types: CWE-20 Description: Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error to the consensus client should the message be missing. Users are advised to upgrade to versions 2.2.7 or v2.4.5. There are no known workarounds
should the message be missing. Users are advised to upgrade to versions 2.2.7 or v2.4.5. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hyperledger/fabric/security/advisories/GHSA-72x4-cq6r-jp4p - https://github.com/hyperledger/fabric/commit/0f18359493bcbd5f9f9d1a9b05adabfe5da23b06 - https://github.com/hyperledger/fabric/releases/tag/v2.2.7 - https://github.com/hyperledger/fabric/releases/tag/v2.4.5
CVE ID: CVE-2022-31122 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-04-23T16:45:37.145Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wireapp Products: wire-server Problem Types: CWE-287, CWE-1270 Description: Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attacker has certain details of SAML IdP metadata, and configures their own SAML on the same backend, the attacker can delete all SAML authenticated accounts of a targeted team, Authenticate as a user of the attacked team and create arbitrary accounts in the context of th
ounts of a targeted team, Authenticate as a user of the attacked team and create arbitrary accounts in the context of the team if it is not managed by SCIM. This issue is fixed in wire-server 2022-07-12 and is already deployed on all Wire managed services. On-premise instances of wire-server need to be updated to 2022-07-12/Chart 4.19.0, so that their backends are no longer affected. As a workaround, the risk of an attack can be reduced by disabling SAML configuration for teams (galley.config.settings.featureFlags.sso). Helm overrides are located in `values/wire-server/values.yaml` Note that the ability to configure SAML SSO as a team is disabled by default for on-premise installations. Addi
es.yaml` Note that the ability to configure SAML SSO as a team is disabled by default for on-premise installations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wireapp/wire-server/security/advisories/GHSA-gq27-gmgq-fmxw
CVE ID: CVE-2022-31123 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-04-23T16:51:03.375Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: grafana Products: grafana Problem Types: CWE-347 Description: Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted source
.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8 - https://github.com/grafana/grafana/releases/tag/v9.1.8 - https://security.netapp.com/advisory/ntap-20221124-0002/
CVE ID: CVE-2022-31124 State: PUBLISHED Published: 2022-07-06T17:30:27.000Z Last Updated: 2025-04-22T17:51:53.172Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: scottcwang Products: openssh_key_parser Problem Types: CWE-209 Description: openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to up
dify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/scottcwang/openssh_key_parser/security/advisories/GHSA-hm37-9xh2-q499 - https://github.com/scottcwang/openssh_key_parser/pull/5 - https://github.com/scottcwang/openssh_key_parser/commit/26e0a471e9fdb23e635bc3014cf4cbd2323a08d3 - https://github.com/scottcwang/openssh_key_parser/commit/274447f91b4037b7050ae634879b657554523b39 - https
4cbd2323a08d3 - https://github.com/scottcwang/openssh_key_parser/commit/274447f91b4037b7050ae634879b657554523b39 - https://github.com/scottcwang/openssh_key_parser/commit/d5b53b4b7e76c5b666fc657019dbf864fb04076c
CVE ID: CVE-2022-31125 State: PUBLISHED Published: 2022-07-06T00:00:00.000Z Last Updated: 2025-04-23T18:04:54.702Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: hap-wi Products: roxy-wi Problem Types: CWE-287 Description: Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request. This affects Roxywi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container
are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-hr76-3hxp-5mm3 - http://packetstormsecurity.com/files/171648/Roxy-WI-6.1.0.0-Improper-Authentication-Control.html
CVE ID: CVE-2022-31126 State: PUBLISHED Published: 2022-07-06T17:30:13.000Z Last Updated: 2025-04-23T18:04:37.698Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: hap-wi Products: roxy-wi Problem Types: CWE-74 Description: Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9
CVE ID: CVE-2022-31127 State: PUBLISHED Published: 2022-07-06T18:00:16.000Z Last Updated: 2025-04-22T17:51:28.600Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: nextauthjs Products: next-auth Problem Types: CWE-79 Description: NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail [signin endpoint](https://next-auth.js.org/getting-started/rest-api#post-apiauthsigninprovider) that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: `balazs@email.com, <a href="http://attacker.com">Before signing in, cl
user, so they can perform a phishing attack. Eg.: `balazs@email.com, <a href="http://attacker.com">Before signing in, claim your money!</a>`. This was previously sent to `balazs@email.com`, and the content of the email containing a link to the attacker's site was rendered in the HTML. This has been remedied in the following releases, by simply not rendering that e-mail in the HTML, since it should be obvious to the receiver what e-mail they used: next-auth v3 users before version 3.29.8 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. next-auth v4 users before version 4.9.0 are impacted. If for some reason you cannot upgrade, the workaround requires you to sanit
v4 users before version 4.9.0 are impacted. If for some reason you cannot upgrade, the workaround requires you to sanitize the `email` parameter that is passed to `sendVerificationRequest` and rendered in the HTML. If you haven't created a custom `sendVerificationRequest`, you only need to upgrade. Otherwise, make sure to either exclude `email` from the HTML body or efficiently sanitize it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://next-auth.js.org/getting-started/upgrade-v4 - https://github.com/nextauthjs/next-auth/security/advisories/GHSA-pgjx-7f9g-9463 - https://github.com/nextauthjs/next-auth/commit/ae834f1e08a4a9915665eecb9479c74c
ecurity/advisories/GHSA-pgjx-7f9g-9463 - https://github.com/nextauthjs/next-auth/commit/ae834f1e08a4a9915665eecb9479c74c6b039c9c - https://github.com/nextauthjs/next-auth/releases/tag/next-auth%40v4.9.0 - https://next-auth.js.org/providers/email#customizing-emails
CVE ID: CVE-2022-31128 State: PUBLISHED Published: 2022-08-01T16:20:13.000Z Last Updated: 2025-04-23T17:56:59.891Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-862 Description: Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not properly verify permissions when creating branches with the REST API in Git repositories using the fine grained permissions. Users can create branches via the REST endpoint `POST git/:id/branches` regardless of the permissions set on the repository. This issue has been fixed in version 13.10.99.82 Tul
/:id/branches` regardless of the permissions set on the repository. This issue has been fixed in version 13.10.99.82 Tuleap Community Edition as well as in version 13.10-3 of Tuleap Enterprise Edition. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-2p49-vgcx-5w79 - https://github.com/Enalean/tuleap/commit/58ecb1dee1c46075d3e089980301ebfbe0bafd33 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=58ecb1dee1c46075d3e089980301ebfbe0bafd33 - https://tuleap.net/plugins/tracker/?aid=27538
CVE ID: CVE-2022-31129 State: PUBLISHED Published: 2022-07-06T00:00:00.000Z Last Updated: 2025-11-03T21:46:17.025Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: moment Products: moment Problem Types: CWE-400 Description: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass us
specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g - https://github.com/moment/moment/pull/6015#issuecomment-1152961973 - https://github.
ty/advisories/GHSA-wc69-rhjr-hc9g - https://github.com/moment/moment/pull/6015#issuecomment-1152961973 - https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3 - https://huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O/ - https://lists.fedoraproject.org/archives/list/
nce%40lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO/ - https://security.netapp.com/advisory/ntap-20221014-0003/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
CVE ID: CVE-2022-31130 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-04-23T16:50:57.182Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: grafana Products: grafana Problem Types: CWE-200 Description: Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issu
tion plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grafana/grafana/releases/tag/v9.1.8 - https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc - https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177 - https://github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885f
CVE ID: CVE-2022-31131 State: PUBLISHED Published: 2022-07-06T17:55:14.000Z Last Updated: 2025-04-22T17:51:44.515Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-287 Description: Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended that the Nextcloud Mail app is upgraded to 1.12.2. There are no known workarounds for this issue. ### Workarounds No workaround ava
xtcloud Mail app is upgraded to 1.12.2. There are no known workarounds for this issue. ### Workarounds No workaround available ### References * [Pull request](https://github.com/nextcloud/mail/pull/6600) * [HackerOne](https://hackerone.com/reports/1579820) ### For more information If you have any questions or comments about this advisory: * Create a post in [nextcloud/security-advisories](https://github.com/nextcloud/security-advisories/discussions) * Customers: Open a support ticket at [support.nextcloud.com](https://support.nextcloud.com) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advis
rogram Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xhv7-5mhv-299j - https://github.com/nextcloud/mail/pull/6600 - https://github.com/nextcloud/mail/pull/6600/commits/6dd2527be8d4f6788b449c8a8f5577628b990605
CVE ID: CVE-2022-31132 State: PUBLISHED Published: 2022-08-04T17:10:10.000Z Last Updated: 2025-04-23T17:53:46.349Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-918 Description: Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at `./vendor/cerdic/css-t
de to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at `./vendor/cerdic/css-tidy/css_optimiser.php` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24pm-rjfv-23mh
CVE ID: CVE-2022-31133 State: PUBLISHED Published: 2022-07-07T17:45:12.000Z Last Updated: 2025-04-23T18:04:24.163Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: humhub Products: humhub Problem Types: CWE-79 Description: HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It i
icient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/humhub/humhub/security/advisories/GHSA-p7h3-73v7-959c - https://github.com/humhub/humhub/commit/07d9f8f9b6334970ee38156a3416c3708d157cae - https://github.com/humhub/humhub/commit/f88991dfe56a05870df165ac89a2755dd4c1ffa1 - https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76
CVE ID: CVE-2022-31134 State: PUBLISHED Published: 2022-07-12T20:35:10.000Z Last Updated: 2025-04-23T18:02:59.572Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: zulip Products: zulip Problem Types: CWE-200 Description: Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams. However, the "public data" export which adm
ors are not expected to have access to private messages and private streams. However, the "public data" export which administrators could generate contained the attachment contents for all attachments, even those from private messages and streams. Zulip Server version 5.4 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-58pm-88xp-7x9m - https://blog.zulip.com/2022/07/12/zulip-cloud-data-exports - https://blog.zulip.com/2022/07/12/zulip-server-5-4-security-release
CVE ID: CVE-2022-31135 State: PUBLISHED Published: 2022-07-07T17:50:11.000Z Last Updated: 2025-04-23T18:04:17.060Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: AttorneyOnline Products: akashi Problem Types: CWE-129 Description: Akashi is an open source server implementation of the Attorney Online video game based on the Ace Attorney universe. Affected versions of Akashi are subject to a denial of service attack. An attacker can use a specially crafted evidence packet to make an illegal modification, causing a server crash. This can be used to mount a denial-of-service exploit. Users are advised to upgrade. There is no known workaround for this issue. Addi
ed to mount a denial-of-service exploit. Users are advised to upgrade. There is no known workaround for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AttorneyOnline/akashi/security/advisories/GHSA-vj86-vfmg-q68v - https://github.com/AttorneyOnline/akashi/commit/5566cdfedddef1f219aee33477d9c9690bf2f78b
CVE ID: CVE-2022-31136 State: PUBLISHED Published: 2022-07-07T17:55:13.000Z Last Updated: 2025-04-23T18:04:09.995Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: bookwyrm-social Products: bookwyrm Problem Types: CWE-79 Description: Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as cross site scripting attacks on users viewing these fields. Users are advised to upgrade to version 0.4.1. There are no known workaroun
pting attacks on users viewing these fields. Users are advised to upgrade to version 0.4.1. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-2cfh-v7rf-pxfp - https://github.com/bookwyrm-social/bookwyrm/commit/fe33fdcf564a6a5667aef75d5456bea08feab50d
CVE ID: CVE-2022-31137 State: PUBLISHED Published: 2022-07-08T00:00:00.000Z Last Updated: 2025-04-22T17:51:19.004Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: hap-wi Products: roxy-wi Problem Types: CWE-78 Description: Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known worka
ttackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-53r2-mq99-f532 - https://github.com/hap-wi/roxy-wi/commit/82666df1e60c45dd6aa533b01a392f015d32f755 - http://packetstormsecurity.com/files/167805/Roxy-WI-Remote-Command-Execution.html - http://packetstormsecurity.com/files/171648/Roxy-WI-6.1.0.0-Improper-Authentication-Control.html - http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html - http://packetstormsecurity.
l - http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html - http://packetstormsecurity.com/files/172547/Roxy-WI-6.1.0.0-Remote-Command-Execution.html