Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23330 State: PUBLISHED Published: 2024-01-23T17:22:25.503Z Last Updated: 2025-05-30T14:19:01.910Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: tutao Products: tutanota Problem Types: CWE-918 Description: Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be loaded by default only after confirmation by the user. However, it could be recognized that certain embedded images (see PoC) are loaded, even thoug
confirmation by the user. However, it could be recognized that certain embedded images (see PoC) are loaded, even though the "Automatic Reloading of Images" function is disabled by default. The reloading is also done unencrypted via HTTP and redirections are followed. This behavior is unexpected for the user, since the user assumes that external content will only be loaded after explicit manual confirmation. The loading of external content in e-mails represents a risk, because this makes the sender aware that the e-mail address is used, when the e-mail was read, which device is used and expose the user's IP address. Version 119.10 contains a patch for this issue. Additional Analyst Notes: -
ce is used and expose the user's IP address. Version 119.10 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tutao/tutanota/security/advisories/GHSA-32w8-v5fc-vpp7
CVE ID: CVE-2024-23331 State: PUBLISHED Published: 2024-01-19T19:43:17.404Z Last Updated: 2025-06-17T21:19:25.323Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: vitejs Products: vite Problem Types: CWE-178, CWE-200, CWE-284 Description: Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file se
o hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw - https://github.com/vitejs/vi
ent: References: - https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw - https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5 - https://vitejs.dev/config/server-options.html#server-fs-deny
CVE ID: CVE-2024-23332 State: PUBLISHED Published: 2024-01-19T22:19:37.013Z Last Updated: 2025-05-30T14:24:46.463Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:L) Vendors: notaryproject Products: specifications Problem Types: CWE-672 Description: The Notary Project is a set of specifications and tools intended to provide a cross-industry standard for securing software supply chains by using authentic container images and other OCI artifacts. An external actor with control of a compromised container registry can provide outdated versions of OCI artifacts, such as Images. This could lead artifact consumers with relaxed trust policies (such as `permissive` instead of `str
ts, such as Images. This could lead artifact consumers with relaxed trust policies (such as `permissive` instead of `strict`) to potentially use artifacts with signatures that are no longer valid, making them susceptible to any exploits those artifacts may contain. In Notary Project, an artifact publisher can control the validity period of artifact by specifying signature expiry during the signing process. Using shorter signature validity periods along with processes to periodically resign artifacts, allows artifact producers to ensure that their consumers will only receive up-to-date artifacts. Artifact consumers should correspondingly use a `strict` or equivalent trust policy that enforces
up-to-date artifacts. Artifact consumers should correspondingly use a `strict` or equivalent trust policy that enforces signature expiry. Together these steps enable use of up-to-date artifacts and safeguard against rollback attack in the event of registry compromise. The Notary Project offers various signature validation options such as `permissive`, `audit` and `skip` to support various scenarios. These scenarios includes 1) situations demanding urgent workload deployment, necessitating the bypassing of expired or revoked signatures; 2) auditing of artifacts lacking signatures without interrupting workload; and 3) skipping of verification for specific images that might have undergone vali
atures without interrupting workload; and 3) skipping of verification for specific images that might have undergone validation through alternative mechanisms. Additionally, the Notary Project supports revocation to ensure the signature freshness. Artifact publishers can sign with short-lived certificates and revoke older certificates when necessary. This revocation serves as a signal to inform artifact consumers that the corresponding unexpired artifact is no longer approved by the publisher. This enables the artifact publisher to control the validity of the signature independently of their ability to manage artifacts in a compromised registry. Additional Analyst Notes: - CVE Program Contain
endently of their ability to manage artifacts in a compromised registry. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/notaryproject/specifications/security/advisories/GHSA-57wx-m636-g3g8 - https://github.com/notaryproject/specifications/commit/cdabdd1042de2999c685fa5d422a785ded9c983a
CVE ID: CVE-2024-23333 State: PUBLISHED Published: 2024-03-18T21:07:09.513Z Last Updated: 2024-08-21T15:04:56.308Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H) Vendors: LDAPAccountManager Products: lam Problem Types: CWE-74 Description: LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to this file. When the file is then accessed via web the code would be executed. The issue is mitigated by the following: An attacker needs to know LAM's maste
essed via web the code would be executed. The issue is mitigated by the following: An attacker needs to know LAM's master configuration password to be able to change the main settings; and the webserver needs write access to a directory that is accessible via web. LAM itself does not provide any such directories. The issue has been fixed in 8.7. As a workaround, limit access to LAM configuration pages to authorized users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-fm9w-7m7v-wxqv - https://github.com/LDAPAccountManager/lam/releases/tag/8.7
CVE ID: CVE-2024-23334 State: PUBLISHED Published: 2024-01-29T22:41:39.584Z Last Updated: 2025-11-03T20:36:48.167Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: aio-libs Products: aiohttp Problem Types: CWE-22 Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within t
tic root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f - https://github.com/aio-libs/aiohttp/pull/8079 - https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f
s://github.com/aio-libs/aiohttp/pull/8079 - https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514b - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/
CVE ID: CVE-2024-23335 State: PUBLISHED Published: 2024-05-01T06:27:42.162Z Last Updated: 2024-08-01T22:59:32.211Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: mybb Products: mybb Problem Types: CWE-20 Description: MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gi
this vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mybb/mybb/security/advisories/GHSA-94xr-g4ww-j47r - https://github.com/mybb/mybb/commit/450259e501b94c9d483efb167cb2bf875605e111.patch - https://mybb.com/versions/1.8.38
CVE ID: CVE-2024-23336 State: PUBLISHED Published: 2024-05-01T06:27:37.987Z Last Updated: 2024-08-01T22:59:32.176Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: mybb Products: mybb Problem Types: CWE-918, CWE-184 Description: MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default
address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h - https://github.com/mybb/mybb/commit/d6
erences: - https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h - https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630 - https://docs.mybb.com/1.8/administration/configuration-file - https://mybb.com/versions/1.8.38
CVE ID: CVE-2024-23337 State: PUBLISHED Published: 2025-05-21T14:34:51.007Z Last Updated: 2025-05-21T14:57:18.378Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: jqlang Products: jq Problem Types: CWE-190 Description: jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46 - https://github.com
DP Vulnrichment: References: - https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46 - https://github.com/jqlang/jq/issues/3262 - https://github.com/jqlang/jq/commit/de21386681c0df0104a99d9d09db23a9b2a78b1e
CVE ID: CVE-2024-23338 State: REJECTED Published: N/A Last Updated: 2025-03-28T21:57:05.324Z Description: No description available.
CVE ID: CVE-2024-23339 State: PUBLISHED Published: 2024-01-22T22:54:53.096Z Last Updated: 2025-06-17T21:19:25.952Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: elijahharry Products: hoolock Problem Types: CWE-1321 Description: hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties. Addi
et`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/elijahharry/hoolock/security/advisories/GHSA-4c2g-hx49-7h25 - https://github.com/elijahharry/hoolock/commit/97ae80e856774335d92743c635ffeae2f652b982
CVE ID: CVE-2024-23340 State: PUBLISHED Published: 2024-01-22T23:00:34.510Z Last Updated: 2025-05-30T14:21:51.423Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: honojs Products: node-server Problem Types: CWE-22 Description: @hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called "double dots", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/stati
lved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/honojs/node-server/security/advisories/GHSA-rjq5-w47x-x359 - h
- CISA ADP Vulnrichment: References: - https://github.com/honojs/node-server/security/advisories/GHSA-rjq5-w47x-x359 - https://github.com/honojs/node-server/commit/dd9b9a9b23e3896403c90a740e7f1f0892feb402 - https://github.com/honojs/node-server/blob/8cea466fd05e6d2e99c28011fc0e2c2d3f3397c9/src/request.ts#L43-L45
CVE ID: CVE-2024-23341 State: PUBLISHED Published: 2024-01-23T17:22:39.159Z Last Updated: 2024-09-11T19:27:27.515Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: i3thuan5 Products: TuiTse-TsuSin Problem Types: CWE-79 Description: TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation. Additio
bility. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/i3thuan5/TuiTse-TsuSin/security/advisories/GHSA-m4m5-j36m-8x72 - https://github.com/i3thuan5/TuiTse-TsuSin/pull/22 - https://github.com/i3thuan5/TuiTse-TsuSin/commit/9d21d99d7cfcd7c42aade251fab98ec102e730ea
CVE ID: CVE-2024-23342 State: PUBLISHED Published: 2024-01-22T23:09:35.775Z Last Updated: 2025-05-30T14:21:45.651Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: tlsfuzzer Products: python-ecdsa Problem Types: CWE-203, CWE-208, CWE-385 Description: The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists. Additional Analyst Notes: - CVE Program
the Minerva attack. As of time of publication, no known patched version exists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp - https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md - https://minerva.crocs.fi.muni.cz/ - https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/
CVE ID: CVE-2024-23344 State: PUBLISHED Published: 2024-02-06T15:58:19.781Z Last Updated: 2025-05-09T16:26:14.004Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-200 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a process validates the permissions of multiple users (e.g. mail notifications). This issue has been patched in version 15.4.99.140 of Tuleap Community Edition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/s
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-m3v5-2j5q-x85w - https://github.com/Enalean/tuleap/commit/0329e21d268510bc00fed707406103edabf10e42 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0329e21d268510bc00fed707406103edabf10e42 - https://tuleap.net/plugins/tracker/?aid=35862
CVE ID: CVE-2024-23345 State: PUBLISHED Published: 2024-01-22T23:14:52.596Z Last Updated: 2025-05-30T14:21:39.846Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L) Vendors: nautobot Products: nautobot Problem Types: CWE-79 Description: Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fi
cluding are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nautobot/nautobot/security/advisories/GHSA-v4xv-795h-rv4h - https://github.com/nautobot/nautobot/pull/5133 - https://github.com/nautobot/nautobot/pull/5134 - https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80 - https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce
CVE ID: CVE-2024-23346 State: PUBLISHED Published: 2024-02-21T16:13:25.498Z Last Updated: 2024-08-19T07:47:59.282Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: materialsproject Products: pymatgen Problem Types: CWE-77 Description: Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue. A
ocessing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f - https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a - https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108
CVE ID: CVE-2024-23347 State: PUBLISHED Published: 2024-01-16T17:57:20.308Z Last Updated: 2025-06-20T17:54:46.578Z Vendors: Meta Platforms, Inc Products: Meta Spark Studio Problem Types: CWE-99: Improper Control of Resource Identifiers ('Resource Injection') Description: Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2024-23347
CVE ID: CVE-2024-23348 State: PUBLISHED Published: 2024-01-23T09:39:14.190Z Last Updated: 2025-05-30T14:19:38.246Z Vendors: appleple inc. Products: a-blog cms Ver.3.1.x series, a-blog cms Ver.3.0.x series, a-blog cms Ver.2.11.x series, a-blog cms Ver.2.10.x series, a-blog cms Problem Types: Improper input validation Description: Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary JavaScript code by uploading a special
Ver.2.9.0 and earlier allows a remote authenticated attacker to execute arbitrary JavaScript code by uploading a specially crafted SVG file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.a-blogcms.jp/blog/news/JVN-34565930.html - https://jvn.jp/en/jp/JVN34565930/
CVE ID: CVE-2024-23349 State: PUBLISHED Published: 2024-02-22T09:48:20.873Z Last Updated: 2025-03-28T19:39:55.576Z Vendors: Apache Software Foundation Products: Apache Answer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. XSS attack when user enters summary. A logged-in user, when modifying their own submitted question, can input malicious code in the summary to create such an attack. Users are recommended to upgrade to version [1.2.5], which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen