Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24367 State: PUBLISHED Published: 2025-01-27T17:12:40.174Z Last Updated: 2025-11-03T21:12:40.550Z Vendors: Cacti Products: cacti Problem Types: CWE-144 Description: Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq - https://github.com/Cacti/cacti/commit/c7e4ee79
https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq - https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
CVE ID: CVE-2025-24368 State: PUBLISHED Published: 2025-01-27T17:16:17.236Z Last Updated: 2025-11-03T21:12:41.976Z Vendors: Cacti Products: cacti Problem Types: CWE-89 Description: Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c - https://github.com/Cacti/cacti/
: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c - https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
CVE ID: CVE-2025-24369 State: PUBLISHED Published: 2025-01-27T22:57:26.728Z Last Updated: 2025-01-28T15:18:44.746Z Vendors: Xe Products: x Problem Types: CWE-807 Description: Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scraping from multiple IP addresses. Anubis allows attackers to bypass the bot protection by requesting a challenge, formulates any nonce (such as 42069), and then passes the challenge with difficulty zero. Commit e09d0226a628f04b1d80fd83bee777894a45cd02 fixes this behavior by not using a client-specified difficulty value. Additional Analyst Notes: - CISA ADP Vulnric
5cd02 fixes this behavior by not using a client-specified difficulty value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Xe/x/security/advisories/GHSA-56w8-8ppj-2p4f - https://github.com/Xe/x/commit/7bd7b209f4f1b897de85ec8973458dc8be606a8b - https://github.com/Xe/x/commit/e09d0226a628f04b1d80fd83bee777894a45cd02 - https://xeiaso.net/notes/2025/GHSA-56w8-8ppj-2p4f
CVE ID: CVE-2025-24370 State: PUBLISHED Published: 2025-02-03T21:07:28.844Z Last Updated: 2025-02-04T15:35:12.748Z Vendors: adamghill Products: django-unicorn Problem Types: CWE-915 Description: Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality `set_property_value`, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of second and third parameter to the vulnerable function, leading to arbitrary changes to the python runtime status. With this finding at least five wa
o the vulnerable function, leading to arbitrary changes to the python runtime status. With this finding at least five ways of vulnerability exploitation have been observed, stably resulting in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application. This issue has been addressed in version 0.62.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/adamghill/django-unicorn/security/advisories/GHSA-g9wf-5777-gq43 - https://github.com/adamghill/django-unicorn/commit/17614200f27174f789d4af54cc3
security/advisories/GHSA-g9wf-5777-gq43 - https://github.com/adamghill/django-unicorn/commit/17614200f27174f789d4af54cc3a1f2b0df7870c
CVE ID: CVE-2025-24371 State: PUBLISHED Published: 2025-02-03T21:20:56.024Z Last Updated: 2025-02-04T19:16:21.174Z Vendors: cometbft Products: cometbft Problem Types: CWE-703 Description: CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the lates
t the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn't check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X > Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.
lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4 - https://github.com/cometbft/cometbft/releases/tag/v0.38.17 - https://github.com/cometbft/cometbft/releases/tag/v1.0.1
CVE ID: CVE-2025-24372 State: PUBLISHED Published: 2025-02-05T18:12:09.355Z Last Updated: 2025-02-05T19:27:38.534Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: ckan Products: ckan Problem Types: CWE-79 Description: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulne
of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the `ckan.upload.user.mimetypes` / `ckan.upload.user.types` and `ckan.upload.group.mimetypes` / `ckan.upload.group.types` config options. To entirely disable file uploads users can use: `ckan.upload.user.types = none` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ckan/ckan/security/advisories/GHSA-7pq5-qcp6-mcww - https
tes: - CISA ADP Vulnrichment: References: - https://github.com/ckan/ckan/security/advisories/GHSA-7pq5-qcp6-mcww - https://github.com/ckan/ckan/commit/7da6a26c6183e0a97a356d1b1d2407f3ecc7b9c8 - https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-mimetypes - https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-types - https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-mimetypes - https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-types
CVE ID: CVE-2025-24373 State: PUBLISHED Published: 2025-02-04T18:45:51.078Z Last Updated: 2025-02-12T20:51:28.697Z Vendors: wpovernight Products: woocommerce-pdf-invoices-packing-slips Problem Types: CWE-200 Description: woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orders. This vulnerability allows unauthorized users to access any PDF document from a store if they: 1. Have access to a guest document link and 2. Replace the URL variable `my-account` with `bulk`. The issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerabilit
he issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerability compromises the confidentiality of sensitive documents, affecting all stores using the plugin with the guest access option enabled. This issue has been addressed in version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wpovernight/woocommerce-pdf-invoices-packing-slips/security/advisories/GHSA-3j9m-cp35-94fr - https://github.com/wpovernight/woocommerce-pdf-invoices-packing-slips/commit/6daeff87f8a7f941f0f7cf4637f41d22c4428c30
CVE ID: CVE-2025-24374 State: PUBLISHED Published: 2025-01-29T15:22:34.012Z Last Updated: 2025-01-29T15:44:49.358Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: twigphp Products: Twig Problem Types: CWE-74 Description: Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr - https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
CVE ID: CVE-2025-24375 State: PUBLISHED Published: 2025-04-09T22:21:37.858Z Last Updated: 2025-04-10T15:55:01.617Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: canonical Products: mysql-k8s-operator Problem Types: CWE-256 Description: Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary script file containing the full URI, with user and password. The file can be read by a unprivileged user during the operator runtime,
ntaining the full URI, with user and password. The file can be read by a unprivileged user during the operator runtime, due it being created with read permissions (0x644). On other cases, when calling mysql cli, for one specific case when creating the operator users, the DDL contains said users credentials, which can be leak through the same mechanism of a temporary file. All versions prior to revision 221 for kubernetes and revision 338 for machine operators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/mysql-k8s-operator/security/advisories/GHSA-g83v-7694-2hf7 - https://github.com/canonical/mysql-k8s-operator/pull/553 - https://github.com/ca
curity/advisories/GHSA-g83v-7694-2hf7 - https://github.com/canonical/mysql-k8s-operator/pull/553 - https://github.com/canonical/mysql-operator/pull/579 - https://github.com/canonical/mysql-k8s-operator/commit/7c6b1206fcbc7324b72f413c5e63216e742a71a1 - https://github.com/canonical/mysql-operator/commit/1fb61c1ee3e396cdce13d5e8155f2f32a860f89e
CVE ID: CVE-2025-24376 State: PUBLISHED Published: 2025-01-30T15:51:46.184Z Last Updated: 2025-02-12T19:51:11.773Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: kubewarden Products: kubewarden-controller Problem Types: CWE-285, CWE-155 Description: kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and AdmissionPolicyGroup can evaluate only namespaced resources. The resources to be evaluated are determined by the rules provided by the user when defining the policy. There might be Kubernetes namespaced resources that should not be validated by AdmissionPolicy and
defining the policy. There might be Kubernetes namespaced resources that should not be validated by AdmissionPolicy and by the AdmissionPolicyGroup policies because of their sensitive nature. For example, PolicyReport are namespaced resources that contain the list of non compliant objects found inside of a namespace. An attacker can use either an AdmissionPolicy or an AdmissionPolicyGroup to prevent the creation and update of PolicyReport objects to hide non-compliant resources. Moreover, the same attacker might use a mutating AdmissionPolicy to alter the contents of the PolicyReport created inside of the namespace. Starting from the 1.21.0 release, the validation rules applied to Admission
olicyReport created inside of the namespace. Starting from the 1.21.0 release, the validation rules applied to AdmissionPolicy and AdmissionPolicyGroup have been tightened to prevent them from validating sensitive types of namespaced resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubewarden/kubewarden-controller/security/advisories/GHSA-fc89-jghx-8pvg - https://github.com/kubewarden/kubewarden-controller/commit/8124039b5f0c955d0ee8c8ca12d4415282f02d2c
CVE ID: CVE-2025-24377 State: PUBLISHED Published: 2025-03-28T02:16:19.788Z Last Updated: 2025-03-29T03:55:30.255Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-f
- CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2025-24378 State: PUBLISHED Published: 2025-03-28T02:12:41.231Z Last Updated: 2025-03-29T03:55:31.604Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-updat
CVE ID: CVE-2025-24379 State: PUBLISHED Published: 2025-03-28T02:09:15.383Z Last Updated: 2025-03-29T03:55:32.921Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-updat
CVE ID: CVE-2025-24380 State: PUBLISHED Published: 2025-03-28T02:05:27.721Z Last Updated: 2025-03-29T03:55:35.734Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-updat
CVE ID: CVE-2025-24381 State: PUBLISHED Published: 2025-03-28T02:23:29.145Z Last Updated: 2025-03-29T03:55:47.239Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-601 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information. Exploitation may allow for s
by attackers to conduct phishing attacks that cause users to divulge sensitive information. Exploitation may allow for session theft. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2025-24382 State: PUBLISHED Published: 2025-03-28T01:45:19.353Z Last Updated: 2025-03-29T03:55:41.393Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-uni
CVE ID: CVE-2025-24383 State: PUBLISHED Published: 2025-03-28T01:24:02.790Z Last Updated: 2025-03-29T03:55:27.193Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to delete arbitrary files. This vulnerability is considered critical as it can be leveraged to delete critical system files as root. Dell recommends customers to upgrade at the earliest opportuni
can be leveraged to delete critical system files as root. Dell recommends customers to upgrade at the earliest opportunity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2025-24385 State: PUBLISHED Published: 2025-03-28T01:57:49.188Z Last Updated: 2025-03-29T03:55:44.188Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-update-f
CVE ID: CVE-2025-24386 State: PUBLISHED Published: 2025-03-28T02:19:41.497Z Last Updated: 2025-03-29T03:55:28.876Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-78 Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300090/dsa-2025-116-security-updat
CVE ID: CVE-2025-24387 State: PUBLISHED Published: 2025-03-10T09:28:31.053Z Last Updated: 2025-03-10T13:12:40.237Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-1275 Description: A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.x Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
RS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.x Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2025-05/
CVE ID: CVE-2025-24388 State: PUBLISHED Published: 2025-06-16T11:29:20.295Z Last Updated: 2025-06-16T15:01:06.130Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-184 Description: A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin user. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected Additional Analyst Notes: - CISA ADP Vulnrichment
ased on the ((OTRS)) Community Edition also very likely to be affected Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2025-06/
CVE ID: CVE-2025-24389 State: PUBLISHED Published: 2025-01-27T05:59:01.064Z Last Updated: 2025-02-12T20:41:31.676Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-532 Description: Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected Additional Analyst Notes: - CISA ADP Vulnrichment:
sed on the ((OTRS)) Community Edition also very likely to be affected Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2025-03/