Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
it returns directly without extension verification, so that arbitrary extension files are rendered as twig templates. When attacker with admin privileges on a DEV or an improperly configured STG or PROD environment, they can exploit this vulnerability to remote code execution. Code execution may grant the attacker access to the host operating system. This issue has been addressed in version 4.4.6. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-vqxf-r9ph-cc9c
CVE ID: CVE-2023-32680 State: PUBLISHED Published: 2023-05-18T22:55:30.636Z Last Updated: 2025-02-12T16:38:47.023Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: metabase Products: metabase Problem Types: CWE-306 Description: Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with native query editing permissions to a database–but affected versions of Metabase didn't enforce that requirement. This lack of enforcement meant that: Anyone–including people in sandboxed groups–could edit SQL snippets. They could edit snippets via the API or, in the application UI, when edit
e in sandboxed groups–could edit SQL snippets. They could edit snippets via the API or, in the application UI, when editing the metadata for a model based on a SQL question, and people in sandboxed groups could edit a SQL snippet used in a query that creates their sandbox. If the snippet contained logic that restricted which data that person could see, they could potentially edit that snippet and change their level of data access. The permissions model for SQL snippets has been fixed in Metabase versions 0.46.3, 0.45.4, 0.44.7, 1.46.3, 1.45.4, and 1.44.7. Users are advised to upgrade. Users unable to upgrade should ensure that SQL queries used to create sandboxes exclude SQL snippets. Additi
to upgrade. Users unable to upgrade should ensure that SQL queries used to create sandboxes exclude SQL snippets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metabase/metabase/security/advisories/GHSA-mw6j-f894-4qxv - https://github.com/metabase/metabase/pull/30852 - https://github.com/metabase/metabase/pull/30853 - https://github.com/metabase/metabase/pull/30854
CVE ID: CVE-2023-32681 State: PUBLISHED Published: 2023-05-26T17:02:52.899Z Last Updated: 2025-02-13T16:54:56.639Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: psf Products: requests Problem Types: CWE-200 Description: Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However
roxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q - https://github.com/psf/requests/commit/74ea7cf
https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q - https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 - https://github.com/psf/requests/releases/tag/v2.31.0 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/ - https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html - https://security.gentoo.org/glsa/202309-08
CVE ID: CVE-2023-32682 State: PUBLISHED Published: 2023-06-06T18:20:14.377Z Last Updated: 2025-02-13T16:54:57.207Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: matrix-org Products: synapse Problem Types: CWE-287 Description: Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the `jwt_config.enabled` configuration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.lo
nfiguration setting. 2. The local password database is enabled via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password is updated via an admin API after a user is deactivated. Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated. Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected. If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This issue has been addressed in version 1.85.0. U
Web Tokens, ensure that deactivated users do not have a password set. This issue has been addressed in version 1.85.0. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/synapse/security/advisories/GHSA-26c5-ppr8-f33p - https://github.com/matrix-org/synapse/pull/15624 - https://github.com/matrix-org/synapse/pull/15634 - https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#create-or-modify-account - https://matrix-org.github.io/synapse/latest/jwt.html - https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#password_config - https://lists.f
ps://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#password_config - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2/
CVE ID: CVE-2023-32683 State: PUBLISHED Published: 2023-06-06T18:24:30.457Z Last Updated: 2025-02-13T16:54:58.218Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: matrix-org Products: synapse Problem Types: CWE-863 Description: Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. Fo
blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. Systems which have URL preview disabled (via the `url_preview_enabled` setting) or have not configured a `url_preview_url_blacklist` are not affected. This issue has been addressed in version 1.85.0. Users are advised to upgrade. User unable to upgrade may also disable URL previews. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/m
previews. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/synapse/security/advisories/GHSA-98px-6486-j7qc - https://github.com/matrix-org/synapse/pull/15601 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2/
CVE ID: CVE-2023-32684 State: PUBLISHED Published: 2023-05-30T17:19:17.148Z Last Updated: 2025-01-10T16:52:10.831Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: lima-vm Products: lima Problem Types: CWE-552 Description: Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The official templates of Lima and the well-known third party products (Colima, Rancher Desktop, and Finch) are unlikely to be affected by this issue. To exploit this issue, the attacker
ucts (Colima, Rancher Desktop, and Finch) are unlikely to be affected by this issue. To exploit this issue, the attacker has to embed the target file path (an absolute or a relative path from the instance directory) in a malicious disk image, as the qcow2 (or vmdk) backing file path string. As Lima refuses to run as the root, it is practically impossible for the attacker to read the entire host disk via `/dev/rdiskN`. Also, practically, the attacker cannot read at least the first 512 bytes (MBR) of the target file. The issue has been patched in Lima in version 0.16.0 by prohibiting using a backing file path in the VM base image. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
hibiting using a backing file path in the VM base image. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lima-vm/lima/security/advisories/GHSA-f7qw-jj9c-rpq9 - https://github.com/lima-vm/lima/commit/01dbd4d9cabe692afa4517be3995771f0ebb38a5 - https://github.com/lima-vm/lima/releases/tag/v0.16.0
CVE ID: CVE-2023-32685 State: PUBLISHED Published: 2023-05-30T04:11:50.569Z Last Updated: 2025-01-10T20:35:42.916Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-79 Description: Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document on a vulnerable Kanboard instance can trick the victim into pasting malicious screenshot data and achieve cross-site scripting if CSP is imp
oard instance can trick the victim into pasting malicious screenshot data and achieve cross-site scripting if CSP is improperly configured. This issue has been patched in version 1.2.29. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-hjmw-gm82-r4gv - https://github.com/kanboard/kanboard/commit/26b6eebb78d4306e48b836a58f7c386251aa2bc7 - https://github.com/kanboard/kanboard/commit/c9c187206700030c43493b80fd599b4d096cb713
CVE ID: CVE-2023-32686 State: PUBLISHED Published: 2023-05-27T03:58:10.152Z Last Updated: 2025-01-14T18:20:14.319Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: kiwitcms Products: Kiwi Problem Types: CWE-79, CWE-434 Description: Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded. The upload validation checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially
ion checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially dangerous file. Exploiting this flaw, a combination of files could be uploaded so that they work together to circumvent the existing Content-Security-Policy and allow execution of arbitrary JavaScript in the browser. This issue has been patched in version 12.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-x7c2-7wvg-jpx7 - https://kiwitcms.org/blog/kiwi-tcms-team/2023/05/22/kiwi-tcms-123/
CVE ID: CVE-2023-32687 State: PUBLISHED Published: 2023-05-29T20:03:05.983Z Last Updated: 2025-01-13T21:00:37.691Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: tgstation Products: tgstation-server Problem Types: CWE-522 Description: tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials pr
at bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp - https://github.com/tgstation/tgstation-server/pull/1487 - https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1
CVE ID: CVE-2023-32688 State: PUBLISHED Published: 2023-05-27T03:21:27.071Z Last Updated: 2025-01-14T18:43:52.475Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: parse-community Products: parse-server-push-adapter Problem Types: CWE-20 Description: parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload. This issue has been patched in version 4.1.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server-push-adapter/security/advisories/GHSA-mxhg-rvwx-
richment: References: - https://github.com/parse-community/parse-server-push-adapter/security/advisories/GHSA-mxhg-rvwx-x993 - https://github.com/parse-community/parse-server-push-adapter/pull/217 - https://github.com/parse-community/parse-server-push-adapter/releases/tag/4.1.3
CVE ID: CVE-2023-32689 State: PUBLISHED Published: 2023-05-30T17:27:18.120Z Last Updated: 2025-01-10T19:07:30.658Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-434 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the th
c API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the the uploaded HTML could be shared for phishing attacks. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain. An additional security issue arises when the Parse JavaScript SDK is used. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker. Th
ould contain a script that retrieves the user's session token from local storage and then share it with the attacker. The fix included in versions 5.4.4 and 6.1.1 adds a new Parse Server option `fileUpload.fileExtensions` to restrict file upload on Parse Server by file extension. It is recommended to restrict file upload for HTML file extensions, which this fix disables by default. If an app requires upload of files with HTML file extensions, the option can be set to `['.*']` or another custom value to override the default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jq
- CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9 - https://github.com/parse-community/parse-server/pull/8537 - https://github.com/parse-community/parse-server/pull/8538
CVE ID: CVE-2023-32690 State: PUBLISHED Published: 2023-06-01T16:15:21.052Z Last Updated: 2025-01-08T21:40:03.246Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: DMTF Products: libspdm Problem Types: CWE-20 Description: libspdm is a sample implementation that follows the DMTF SPDM specifications. Prior to versions 2.3.3 and 3.0, following a successful CAPABILITIES response, a libspdm Requester stores the Responder's CTExponent into its context without validation. If the Requester sends a request message that requires a cryptography operation by the Responder, such as CHALLENGE, libspdm will calculate the timeout value using the Responder's unvalidated CTExp
on by the Responder, such as CHALLENGE, libspdm will calculate the timeout value using the Responder's unvalidated CTExponent. A patch is available in version 2.3.3. A workaround is also available. After completion of VCA, the Requester can check the value of the Responder's CTExponent. If it greater than or equal to 64, then the Requester can stop communication with the Responder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DMTF/libspdm/security/advisories/GHSA-56h8-4gv5-jf2c - https://github.com/DMTF/libspdm/issues/2068 - https://github.com/DMTF/libspdm/pull/2069
CVE ID: CVE-2023-32691 State: PUBLISHED Published: 2023-05-30T03:06:06.080Z Last Updated: 2025-01-10T20:45:20.000Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: ginuerzh Products: gost Problem Types: CWE-203 Description: gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparison function. Untrusted input, sourced from a HTTP header, is compared directly with a secret. Since this comparison is not secure, an attacker can mount a side-channel timing attack to guess the password. As a workaround, this can be easily fixed using a constant time co
t a side-channel timing attack to guess the password. As a workaround, this can be easily fixed using a constant time comparing function such as `crypto/subtle`'s `ConstantTimeCompare`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ginuerzh/gost/security/advisories/GHSA-qjrq-hm79-49ww - https://github.com/ginuerzh/gost/blob/1c62376e0880e4094bd3731e06bd4f7842638f6a/auth.go#L46
CVE ID: CVE-2023-32692 State: PUBLISHED Published: 2023-05-30T03:15:01.363Z Last Updated: 2025-01-10T20:38:42.898Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: codeigniter4 Products: CodeIgniter4 Problem Types: CWE-94 Description: CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5. Additional Analyst Notes: - CVE Program Container: - C
ation library internally. This issue is patched in version 4.3.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj - https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md
CVE ID: CVE-2023-32693 State: PUBLISHED Published: 2023-07-11T17:19:26.138Z Last Updated: 2024-11-04T19:54:10.232Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: decidim Products: decidim Problem Types: CWE-79 Description: Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The external link feature is susceptible to cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no i
logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in versions 0.27.3 and 0.26.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/decidim/decidim/security/advisories/GHSA-469h-mqg8-535r - https://github.com/decidim/decidim/releases/tag/v0.26.7 - https://github.com/decidim/decidim/releases/tag/v0.27.3
CVE ID: CVE-2023-32694 State: PUBLISHED Published: 2023-05-25T14:29:10.217Z Last Updated: 2025-01-16T19:21:54.740Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: saleor Products: saleor Problem Types: CWE-203, CWE-208 Description: Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could affect the database integrity such as marking an order as paid when it is not. This issue has been patched in versions 3.7.68, 3.8.40
tabase integrity such as marking an order as paid when it is not. This issue has been patched in versions 3.7.68, 3.8.40, 3.9.49, 3.10.36, 3.11.35, 3.12.25, and 3.13.16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/saleor/saleor/security/advisories/GHSA-3rqj-9v87-2x3f - https://github.com/saleor/saleor/commit/1328274e1a3d04ab87d7daee90229ff47b3bc35e
CVE ID: CVE-2023-32695 State: PUBLISHED Published: 2023-05-27T15:44:03.235Z Last Updated: 2025-01-13T21:03:34.130Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: socketio Products: socket.io-parser Problem Types: CWE-20 Description: socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/socketio/socket.io-parser/sec
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9 - https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced - https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3 - https://github.com/socketio/socket.io-parser/releases/tag/4.2.3