Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-39079 State: PUBLISHED Published: 2022-02-14T17:30:12.634725Z Last Updated: 2024-09-16T18:49:33.228Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/I:L/AV:N/S:C/PR:L/UI:R/C:L/A:N/AC:L/RC:C/E:H/RL:O) Vendors: IBM Products: Cognos Analytics Mobile Problem Types: Cross-Site Scripting Description: IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215592. Additional Analyst Notes: - CVE Program Container: References: -
sure within a trusted session. IBM X-Force ID: 215592. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6555140 - https://exchange.xforce.ibmcloud.com/vulnerabilities/215592
CVE ID: CVE-2021-39080 State: PUBLISHED Published: 2022-02-14T17:30:14.400969Z Last Updated: 2024-09-16T22:56:47.755Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/I:L/S:U/AV:N/UI:N/PR:N/AC:H/A:N/C:L/RL:O/E:U/RC:C) Vendors: IBM Products: Cognos Analytics Mobile Problem Types: Obtain Information Description: Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used. IBM X-Force ID: 215593. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node
orce ID: 215593. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6555140 - https://exchange.xforce.ibmcloud.com/vulnerabilities/215593
CVE ID: CVE-2021-39081 State: PUBLISHED Published: 2024-12-19T00:22:15.460Z Last Updated: 2024-12-19T16:38:54.983Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Analytics Mobile for Android Problem Types: CWE-319 Description: IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6555140
CVE ID: CVE-2021-39082 State: PUBLISHED Published: 2022-04-29T16:00:16.386678Z Last Updated: 2024-09-17T00:51:40.163Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AC:H/PR:N/AV:N/C:H/UI:N/I:N/A:N/S:U/RL:O/E:U/RC:C) Vendors: IBM Products: UrbanCode Deploy Problem Types: Obtain Information Description: IBM UrbanCode Deploy (UCD) 7.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6576179 - https://exchange.xforce.ibmcloud.com/vulnerabilities/215693
CVE ID: CVE-2021-39085 State: PUBLISHED Published: 2022-08-16T18:45:33.266571Z Last Updated: 2024-09-17T00:42:18.234Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/I:L/A:L/UI:N/AC:L/AV:N/C:L/S:U/PR:L/E:U/RL:O/RC:C) Vendors: IBM Products: Sterling B2B Integrator Problem Types: Data Manipulation Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 215888. Additional Analyst Notes: - CVE Program Container: Reference
formation in the back-end database. IBM X-Force ID: 215888. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6612505 - https://exchange.xforce.ibmcloud.com/vulnerabilities/215888
CVE ID: CVE-2021-39086 State: PUBLISHED Published: 2022-08-16T18:45:48.196675Z Last Updated: 2024-09-16T19:45:45.375Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AC:L/UI:N/A:N/I:N/PR:L/S:U/AV:N/C:L/E:U/RL:O/RC:C) Vendors: IBM Products: Sterling File Gateway Problem Types: Obtain Information Description: IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 215889. Additional Analyst Notes: - CVE Program Container: References: - https://ww
against the system. IBM X-Force ID: 215889. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6612537 - https://exchange.xforce.ibmcloud.com/vulnerabilities/215889
CVE ID: CVE-2021-39087 State: PUBLISHED Published: 2022-08-16T18:46:04.273996Z Last Updated: 2024-09-17T03:17:43.317Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AC:L/UI:N/A:N/I:N/PR:L/S:U/C:L/AV:N/RC:C/RL:O/E:U) Vendors: IBM Products: Sterling B2B Integrator Problem Types: Obtain Information Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow an authenticated user to obtain sensitive information due to improper permission controls. IBM X-Force ID: 216109. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6612541 - https://exchange.xforce.ibmcloud.com/
Program Container: References: - https://www.ibm.com/support/pages/node/6612541 - https://exchange.xforce.ibmcloud.com/vulnerabilities/216109
CVE ID: CVE-2021-39088 State: PUBLISHED Published: 2022-07-28T22:15:13.524048Z Last Updated: 2024-09-16T19:30:48.153Z Severity: HIGH (CVSS 7.4 CVSS:3.0/I:H/A:H/PR:N/C:H/AC:H/S:U/AV:L/UI:N/E:U/RL:O/RC:C) Vendors: IBM Products: QRadar SIEM Problem Types: Gain Privileges Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unknown vulnerabilities then privilege escalation could be performed. IBM X-Force ID: 216111. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6607129 - https://exchange.xforce.ibmcloud.com/vulnerabilities/216111
CVE ID: CVE-2021-39089 State: PUBLISHED Published: 2023-01-20T18:14:59.231Z Last Updated: 2025-03-31T14:59:42.233Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cloud Pak for Security Problem Types: CWE-200 Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request. IBM X-Force ID: 216387. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6856405 - https://exchange.xforce.ibmcloud.com/vulnerabilities/216387
CVE ID: CVE-2021-39090 State: PUBLISHED Published: 2024-02-29T02:35:40.645Z Last Updated: 2024-08-04T01:58:17.672Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cloud Pak for Security Problem Types: CWE-311 Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 216388. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
BM X-Force ID: 216388. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6856407 - https://exchange.xforce.ibmcloud.com/vulnerabilities/216388
CVE ID: CVE-2021-39109 State: PUBLISHED Published: 2021-09-01T05:20:10.119792Z Last Updated: 2024-10-11T19:08:51.789Z Vendors: Atlassian Products: Atlasboard Problem Types: Path Traversal Description: The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bitbucket.org/atlassian/atlasboard/commits/9c03df09f09399e2601010466e8ba3a28236eb9c
CVE ID: CVE-2021-39111 State: PUBLISHED Published: 2021-08-30T06:30:15.787184Z Last Updated: 2024-10-11T17:20:26.330Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross Site Scripting (XSS) Description: The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such as from a PDF when pasted into a field such as the description field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ji
description field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72716
CVE ID: CVE-2021-39112 State: PUBLISHED Published: 2021-08-25T02:30:10.338013Z Last Updated: 2024-10-11T17:19:59.439Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: CWE-1022 Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-724
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72433
CVE ID: CVE-2021-39113 State: PUBLISHED Published: 2021-08-30T06:30:17.310271Z Last Updated: 2024-10-11T19:09:34.976Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Broken Access Control Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72573
CVE ID: CVE-2021-39114 State: PUBLISHED Published: 2022-04-05T04:00:18.966826Z Last Updated: 2024-10-04T19:06:17.769Z Vendors: Atlassian Products: Confluence Server, Confluence Data Center Problem Types: Remote Code Execution Description: Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
.11.6, and from version 7.12.0 before 7.12.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CONFSERVER-68844
CVE ID: CVE-2021-39115 State: PUBLISHED Published: 2021-09-01T23:00:09.591646Z Last Updated: 2024-10-11T19:19:10.750Z Vendors: Atlassian Products: Jira Service Desk Server, Jira Service Desk Data Center Problem Types: CWE-96 Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
sion 4.14.0 before 4.18.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JSDSERVER-8665
CVE ID: CVE-2021-39116 State: PUBLISHED Published: 2021-09-08T00:05:10.122277Z Last Updated: 2024-10-10T15:04:07.423Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Denial of Service Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF Image Reader component. The affected versions are before version 8.13.14, and from version 8.14.0 before 8.19.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72738
CVE ID: CVE-2021-39117 State: PUBLISHED Published: 2021-08-30T06:30:18.840611Z Last Updated: 2024-10-11T17:21:15.424Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross Site Scripting (XSS) Description: The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72597
CVE ID: CVE-2021-39118 State: PUBLISHED Published: 2021-09-14T04:55:09.602733Z Last Updated: 2024-10-10T15:29:16.913Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: User Enumeration Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the /rest/api/1.0/render endpoint. The affected versions are before version 8.19.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72736
CVE ID: CVE-2021-39119 State: PUBLISHED Published: 2021-09-01T22:50:08.590435Z Last Updated: 2024-10-11T19:07:45.328Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is revoked, via a Broken Access Control vulnerability in the issue notification feature. The affected versions are before version 8.19.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72737
CVE ID: CVE-2021-39121 State: PUBLISHED Published: 2021-09-08T01:45:10.564063Z Last Updated: 2024-10-10T15:05:06.059Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from version 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlas
ore 8.18.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72715
CVE ID: CVE-2021-39122 State: PUBLISHED Published: 2021-09-08T02:05:10.176915Z Last Updated: 2024-10-10T15:17:51.221Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72293
CVE ID: CVE-2021-39123 State: PUBLISHED Published: 2021-09-14T04:30:10.955180Z Last Updated: 2024-10-10T15:24:15.097Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Denial of Service Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the /rest/gadget/1.0/createdVsResolved/generate endpoint. The affected versions are before version 8.16.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72237
CVE ID: CVE-2021-39124 State: PUBLISHED Published: 2021-09-14T04:20:09.865280Z Last Updated: 2024-10-10T15:21:04.763Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross-Site Request Forgery (CSRF) Description: The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able to trick a user into retrying a request to bypass CSRF protection and replay a crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72761
CVE ID: CVE-2021-39125 State: PUBLISHED Published: 2021-09-14T06:15:09.714620Z Last Updated: 2024-10-09T16:42:05.731Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumeration vulnerability in the password reset page. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72009
CVE ID: CVE-2021-39126 State: PUBLISHED Published: 2021-10-21T02:45:15.829448Z Last Updated: 2024-10-10T16:06:08.753Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross-Site Request Forgery (CSRF), Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
8.5.10, and from version 8.6.0 before 8.13.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-71806
CVE ID: CVE-2021-39127 State: PUBLISHED Published: 2021-10-21T02:35:10.353652Z Last Updated: 2024-10-10T16:05:21.853Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Improper Authorization Description: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72003
CVE ID: CVE-2021-39128 State: PUBLISHED Published: 2021-09-16T05:20:10.512566Z Last Updated: 2024-10-10T16:00:53.918Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: CWE-1336 Description: Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira Server or Data Center are before version 8.13.12, and from version 8.14.0 before 8.19.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jir
4.0 before 8.19.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72804
CVE ID: CVE-2021-39131 State: PUBLISHED Published: 2021-08-17T19:55:09 Last Updated: 2024-08-04T01:58:17.881Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: sonicdoe Products: ced Problem Types: CWE-241 Description: ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a `Buffer` using `Buffer.isBuffer(obj)`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sonicdoe/ced/security/advisories/GHSA-27wq-qx3q-fxm9 - h
otes: - CVE Program Container: References: - https://github.com/sonicdoe/ced/security/advisories/GHSA-27wq-qx3q-fxm9 - https://github.com/sonicdoe/ced/commit/a4d9f10b6bf1cd468d1a5b9a283cdf437f8bb7b3 - https://github.com/sonicdoe/ced/releases/tag/v1.0.0
CVE ID: CVE-2021-39132 State: PUBLISHED Published: 2021-08-30T19:35:10 Last Updated: 2024-08-04T01:58:17.769Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: rundeck Products: rundeck Problem Types: CWE-502 Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can ma
that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthoriz
o a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rundeck/rundeck/security/advisories/GHSA-q4rf-3fhx-88pf - https://github.com/rundeck/rundeck/commit/850d12e21d22833bc148b7f458d7cb5949f829b6