Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-33940 State: PUBLISHED Published: 2023-05-24T13:55:23.431Z Last Updated: 2024-10-22T15:52:33.662Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940
CVE ID: CVE-2023-33941 State: PUBLISHED Published: 2023-05-24T14:36:07.977Z Last Updated: 2024-10-22T15:52:26.805Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/se
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941
CVE ID: CVE-2023-33942 State: PUBLISHED Published: 2023-05-24T14:49:17.472Z Last Updated: 2024-10-22T15:52:20.409Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerab
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33942
CVE ID: CVE-2023-33943 State: PUBLISHED Published: 2023-05-24T14:57:46.177Z Last Updated: 2024-10-22T15:52:13.867Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lifera
tle text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943
CVE ID: CVE-2023-33944 State: PUBLISHED Published: 2023-05-24T15:07:14.026Z Last Updated: 2024-10-22T15:52:07.008Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/securi
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944
CVE ID: CVE-2023-33945 State: PUBLISHED Published: 2023-05-24T15:22:39.081Z Last Updated: 2024-10-22T15:51:59.026Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-89 Description: SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the appli
chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33945
CVE ID: CVE-2023-33946 State: PUBLISHED Published: 2023-05-24T15:28:28.713Z Last Updated: 2024-10-22T15:51:52.390Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-284 Description: The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/k
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946
CVE ID: CVE-2023-33947 State: PUBLISHED Published: 2023-05-24T15:34:37.132Z Last Updated: 2024-10-22T15:51:45.231Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-284 Description: The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/porta
ion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33947
CVE ID: CVE-2023-33948 State: PUBLISHED Published: 2023-05-24T15:42:39.906Z Last Updated: 2024-10-22T15:51:37.861Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-862 Description: The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/conte
A ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33948
CVE ID: CVE-2023-33949 State: PUBLISHED Published: 2023-05-24T16:01:55.501Z Last Updated: 2024-10-22T15:51:31.464Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-1188 Description: In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
s.verify` should be set to true. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33949
CVE ID: CVE-2023-33950 State: PUBLISHED Published: 2023-05-24T16:10:10.701Z Last Updated: 2024-10-22T15:51:22.703Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Liferay Products: Portal, DXP Problem Types: CWE-1333 Description: Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulne
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950
CVE ID: CVE-2023-33951 State: PUBLISHED Published: 2023-07-24T15:19:24.967Z Last Updated: 2025-11-07T13:04:21.334Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-200 Description: A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allo
handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6583 - https://access.redhat.com/errata/RHSA-2023:6901 - https://access.redhat.com/errata/RHSA-2023:7077 - https://access.redhat.com/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2024:4823 - https://access.redhat.com/errata/RHSA-2024:4831 - https://access.redhat.com/security/cve/CVE-2023-33951 - https://bugzilla.redhat.com/show_bug.cgi?id=2218195 -
024:4831 - https://access.redhat.com/security/cve/CVE-2023-33951 - https://bugzilla.redhat.com/show_bug.cgi?id=2218195 - https://www.zerodayinitiative.com/advisories/ZDI-CAN-20110/
CVE ID: CVE-2023-33952 State: PUBLISHED Published: 2023-07-24T15:19:18.913Z Last Updated: 2025-11-07T13:04:26.826Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-415 Description: A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free oper
kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6583 - https://access.redhat.com/errata/RHSA-2023:6901 - https://access.redhat.com/errata/RHSA-2023:7077 - https://access.redhat.com/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2024:4823 - https://access.redhat.com/errata/RHSA-2024:4831 - https://access.redhat.com/security/cve/CVE-2023-33952 - https://bugzilla.redhat.com
s.redhat.com/errata/RHSA-2024:4831 - https://access.redhat.com/security/cve/CVE-2023-33952 - https://bugzilla.redhat.com/show_bug.cgi?id=2218212 - https://www.zerodayinitiative.com/advisories/ZDI-CAN-20292
CVE ID: CVE-2023-33953 State: PUBLISHED Published: 2023-08-09T12:54:47.415Z Last Updated: 2024-09-27T18:40:52.297Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Google Products: gRPC Problem Types: CWE-834, CWE-789 Description: gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be un
he unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client. The unbounded memory buffering bugs: - The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following seq
l of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc… Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins#gcp-2023-022
CVE ID: CVE-2023-33955 State: PUBLISHED Published: 2023-05-30T06:34:08.578Z Last Updated: 2025-01-10T18:59:25.560Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: minio Products: console Problem Types: CWE-200 Description: Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/minio/console/security/advisories/GHSA-jv3f-7m33-qp65 - https://github.com/minio/console/commit/17e791afb90c9ad27c65f63c6be14f2f6a3a9d60 - https://githu
s/GHSA-jv3f-7m33-qp65 - https://github.com/minio/console/commit/17e791afb90c9ad27c65f63c6be14f2f6a3a9d60 - https://github.com/minio/console/releases/tag/v0.28.0
CVE ID: CVE-2023-33956 State: PUBLISHED Published: 2023-06-05T19:34:51.508Z Last Updated: 2025-01-08T16:03:58.295Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-200 Description: Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any other user, regardless of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is imag
ss of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is image uploaded under **/files** directory regard less of uploaded by any user. This vulnerability poses a significant impact and severity to the application's security. By manipulating the URL parameter, an attacker can access sensitive files that should only be available to authorized users. This includes confidential documents or any other type of file stored within the application. The ability to read these files can lead to various detrimental consequences, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure o
, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure of trade secrets. Additionally, it could result in legal and regulatory implications, reputation damage, financial losses, and potential compromise of user trust. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-r36m-44gg-wxg2 - https://github.com/kanboard/kanboard/commit/437b141fa2267df36976814e704517f30d2424bd
CVE ID: CVE-2023-33957 State: PUBLISHED Published: 2023-06-06T18:10:30.416Z Last Updated: 2024-08-02T15:54:14.164Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L) Vendors: notaryproject Products: notation Problem Types: CWE-400 Description: notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation inspect command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to
in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users are advised to upgrade. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/notaryproject/notation/security/advisories/GHSA-9m3v-v4r5-ppx7 - https://github.com/notaryproject/notation/commit/ed22fde52f6d70ae0b53521bd28c9ccafa868c24
CVE ID: CVE-2023-33958 State: PUBLISHED Published: 2023-06-06T18:13:16.926Z Last Updated: 2024-08-02T15:54:14.098Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: notaryproject Products: notation Problem Types: CWE-400 Description: notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upg
ed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/notaryproject/notation/security/advisories/GHSA-rvrx-rrwh-r9p6 - https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6
CVE ID: CVE-2023-33959 State: PUBLISHED Published: 2023-06-06T18:15:14.317Z Last Updated: 2024-08-02T15:54:14.191Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: notaryproject Products: notation-go Problem Types: CWE-347 Description: notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries. Additional Analyst Notes: -
rade may restrict container registries to a set of secure and trusted container registries. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/notaryproject/notation-go/security/advisories/GHSA-xhg5-42rf-296r
CVE ID: CVE-2023-33960 State: PUBLISHED Published: 2023-06-01T16:20:23.714Z Last Updated: 2025-01-08T21:36:47.096Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: opf Products: openproject Problem Types: CWE-200 Description: OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains
e entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available. Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opf/openproject/security/advisories/GHSA-xjfc-fqm3-95q8 - https://github.com/opf/openproject/pull/12708 - https://community.openproject.org/wp/48324 - https://github.com/opf
q8 - https://github.com/opf/openproject/pull/12708 - https://community.openproject.org/wp/48324 - https://github.com/opf/openproject/releases/tag/v12.5.6 - https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/12708.patch
CVE ID: CVE-2023-33961 State: PUBLISHED Published: 2023-05-30T21:34:00.659Z Last Updated: 2025-01-10T16:49:49.901Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Leantime Products: leantime Problem Types: CWE-79 Description: Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time of publication, a patch does not exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.
oes not exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Leantime/leantime/security/advisories/GHSA-359m-fp6q-65r7
CVE ID: CVE-2023-33962 State: PUBLISHED Published: 2023-05-30T21:42:45.681Z Last Updated: 2025-01-10T16:49:18.789Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: jstachio Products: jstachio Problem Types: CWE-79 Description: JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowing an attacker to inject malicious code. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of other users visiting pages that use this template engine. This can lead to various consequences, including session hijacking, defacement of web pages, the