Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-41214 State: PUBLISHED Published: 2021-11-05T20:50:11 Last Updated: 2024-08-04T03:08:31.367Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-824 Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` has an undefined behavior due to binding a reference to `nullptr`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Contain
nsorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8 - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-vwhq-49r4-gj9v
CVE ID: CVE-2021-41215 State: PUBLISHED Published: 2021-11-05T20:55:16 Last Updated: 2024-08-04T03:08:31.507Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-476 Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `DeserializeSparse` can trigger a null pointer dereference. This is because the shape inference function assumes that the `serialize_sparse` tensor is a tensor with positive rank (and having `3` as the last dimension). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFl
ension). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-x3v8-c8qx-3j3r - https://github.com/tensorflow/tensorflow/commit/d3738dd70f1c9ceb547258cbb82d853da8771850
CVE ID: CVE-2021-41216 State: PUBLISHED Published: 2021-11-05T22:10:17 Last Updated: 2024-08-04T03:08:31.489Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-120 Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for `Transpose` is vulnerable to a heap buffer overflow. This occurs whenever `perm` contains negative elements. The shape inference function does not validate that the indices in `perm` are all valid. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and Ten
will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3ff2-r28g-w7h9 - https://github.com/tensorflow/tensorflow/commit/c79ba87153ee343401dbe9d1954d7f79e521eb14
CVE ID: CVE-2021-41217 State: PUBLISHED Published: 2021-11-05T20:55:10 Last Updated: 2024-08-04T03:08:31.448Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-476 Description: TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when encountering the second node (e.g., an `Exit` node). When this is not the case, `parent` i
ter` node) always exists when encountering the second node (e.g., an `Exit` node). When this is not the case, `parent` is `nullptr` so dereferencing it causes a crash. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5crj-c72x-m7gq - https://github.com/tensorflow/tensorflow/commit/05cbebd3c6bb8f517a158b0155debb8df79017ff
CVE ID: CVE-2021-41218 State: PUBLISHED Published: 2021-11-05T22:05:20 Last Updated: 2024-08-04T03:08:31.519Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-369 Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `AllToAll` can be made to execute a division by 0. This occurs whenever the `split_count` argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes:
nsorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9crf-c6qr-r273 - https://github.com/tensorflow/tensorflow/commit/a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc
CVE ID: CVE-2021-41219 State: PUBLISHED Published: 2021-11-05T20:50:17 Last Updated: 2024-08-04T03:08:31.583Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-824 Description: TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to `nullptr`. This occurs whenever the dimensions of `a` or `b` are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) b
uld be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4f99-p9c2-3j8x - https://github.com/tensorflow/tensorflow/commit/
hub.com/tensorflow/tensorflow/security/advisories/GHSA-4f99-p9c2-3j8x - https://github.com/tensorflow/tensorflow/commit/e6cf28c72ba2eb949ca950d834dd6d66bb01cfae
CVE ID: CVE-2021-41220 State: PUBLISHED Published: 2021-11-05T22:20:12 Last Updated: 2024-08-04T03:08:31.404Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-416 Description: TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one
e included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gpfh-jvf9-7wg5 - https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75
CVE ID: CVE-2021-41221 State: PUBLISHED Published: 2021-11-05T22:15:11 Last Updated: 2024-08-04T03:08:31.404Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-120 Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have certain values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this co
but code assumes they have certain values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cqv6-3phm-hcwx - https://github.com/tensorflow/tensorflow/commit/af5fcebb37c8b5d71c237f4e59c6477015c78ce6
CVE ID: CVE-2021-41222 State: PUBLISHED Published: 2021-11-05T22:30:11 Last Updated: 2024-08-04T03:08:31.547Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-682 Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies negative arguments. This occurs whenever `size_splits` contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also
7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cpf4-wx82-gxp6 - https://github.com/tensorflow/tensorflow/commit/25d622ffc432acc736b14ca3904177579e733cc6
CVE ID: CVE-2021-41223 State: PUBLISHED Published: 2021-11-05T20:20:16 Last Updated: 2024-08-04T03:08:31.474Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://githu
so affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f54p-f6jp-4rhr - https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda
CVE ID: CVE-2021-41224 State: PUBLISHED Published: 2021-11-05T20:20:11 Last Updated: 2024-08-04T03:08:31.580Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to trigger a heap OOB access. This occurs whenever the size of `indices` does not match the size of `values`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported ra
commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rg3m-hqc5-344v - https://github.com/tensorflow/tensorflow/commit/67bfd9feeecfb3c61d80f0e46d89c170fbee682b
CVE ID: CVE-2021-41225 State: PUBLISHED Published: 2021-11-05T22:30:17 Last Updated: 2024-08-04T03:08:31.609Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-908 Description: TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow
included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7r94-xv9v-63jw - https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3
CVE ID: CVE-2021-41226 State: PUBLISHED Published: 2021-11-05T20:20:22 Last Updated: 2024-08-04T03:08:31.504Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. This is because of missing validation between the elements of the `values` argument and the shape of the sparse output. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affec
We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-374m-jm66-3vj8 - https://github.com/tensorflow/tensorflow/commit/f410212e373eb2aec4c9e60bf3702eba99a38aba
CVE ID: CVE-2021-41227 State: PUBLISHED Published: 2021-11-05T22:30:23 Last Updated: 2024-08-04T03:08:31.590Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be tricked into reading arbitrary memory contents. This is because the `tstring` TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on Tens
any support for this datatype. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j8c8-67vp-6mx7 - https://github.com/tensorflow/tensorflow/commit/1cb6bb6c2a6019417c9adaf9e6843ba75ee2580b - https://github.com/tensorflow/tensorflow/commit/3712a2d3455e6ccb924daa5724a3652a86f6b585
CVE ID: CVE-2021-41228 State: PUBLISHED Published: 2021-11-05T22:25:11 Last Updated: 2024-08-04T03:08:31.343Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-78 Description: TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True
ays run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3rcw-9p9x-582v - https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7
CVE ID: CVE-2021-41229 State: PUBLISHED Published: 2021-11-12T00:00:00.000Z Last Updated: 2025-11-04T16:09:18.907Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: bluez Products: bluez Problem Types: CWE-400 Description: BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash. Additional An
an attacker continuously sending sdp packets and this may cause the service of the target device to crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bluez/bluez/security/advisories/GHSA-3fqg-r8j5-f5xq - https://lists.debian.org/debian-lts-announce/2021/11/msg00022.html - https://security.netapp.com/advisory/ntap-20211203-0004/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html
CVE ID: CVE-2021-41230 State: PUBLISHED Published: 2021-11-05T22:40:12 Last Updated: 2024-08-04T03:08:31.639Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: pomerium Products: pomerium Problem Types: CWE-863 Description: Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service
tion decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pomerium/pomerium/security/advisories/GHSA-j6wp-3859-vxfg - https://github.com/pomerium/pomerium/pull/2724
CVE ID: CVE-2021-41231 State: PUBLISHED Published: 2023-01-27T18:12:01.408Z Last Updated: 2025-03-10T21:18:26.133Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenMage Products: magento-lts Problem Types: CWE-77 Description: OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenMage/magento-lts/security/advisories
VE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-h632-p764-pjqm - https://github.com/OpenMage/magento-lts/commit/d16fc6c5a1e66c6f0d9f82020f11702a7ddd78e4 - https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22 - https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19
CVE ID: CVE-2021-41232 State: PUBLISHED Published: 2021-11-02T17:55:10 Last Updated: 2024-08-04T03:08:31.613Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: StevenWeathers Products: thunderdome-planning-poker Problem Types: CWE-90, CWE-74 Description: Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use. Additional Analyst Notes: - CV
ion 1.16.3. If users are unable to update they should disable the LDAP feature if in use. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/StevenWeathers/thunderdome-planning-poker/security/advisories/GHSA-26cm-qrc6-mfgj - https://github.com/github/securitylab/issues/464#issuecomment-957094994 - https://github.com/StevenWeathers/thunderdome-planning-poker/commit/f1524d01e8a0f2d6c3db5461c742456c692dd8c1
CVE ID: CVE-2021-41233 State: PUBLISHED Published: 2022-03-10T20:30:11.000Z Last Updated: 2025-04-23T18:55:44.362Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-862 Description: Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or
quires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the Nextcloud Text application in the application settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-26c8-35cm-xq9m - https://github.com/nextcloud/text/pull/1884
CVE ID: CVE-2021-41236 State: PUBLISHED Published: 2022-01-04T19:00:12.000Z Last Updated: 2025-04-23T19:15:32.884Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: oroinc Products: platform Problem Types: CWE-79 Description: OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible. Addit
te. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/oroinc/platform/security/advisories/GHSA-qv7g-j98v-8pp7 - https://github.com/oroinc/platform/commit/2a089c971fc70bc63baf8770d29ee515ce5a415a