Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
der provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp - https://github.com/containous/traefik/releases/tag/v1.7.26 - https://github.com/containous/traefik/releases/tag/v2.2.8 - https://github.com/containous/traefik/releases/tag/v2.3.0-rc3 - https://github.com/containous/traefik/pull
/tag/v2.2.8 - https://github.com/containous/traefik/releases/tag/v2.3.0-rc3 - https://github.com/containous/traefik/pull/7109 - https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2
CVE ID: CVE-2020-15130 State: PUBLISHED Published: 2020-07-30T15:00:24 Last Updated: 2024-08-04T13:08:22.292Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: simpleledger Products: slpjs Problem Types: CWE-697 Description: In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4. Additional Analyst Notes: - CVE Program Container: Refe
ired by the NFT1 specification. This is fixed in version 0.27.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx - https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c
CVE ID: CVE-2020-15131 State: PUBLISHED Published: 2020-07-30T15:00:17 Last Updated: 2024-08-04T13:08:22.279Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: simpleledger Products: slp-validate.js Problem Types: CWE-697 Description: In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2. Additional Analyst Notes: - CVE P
p token type as is required by the NFT1 specification. This is fixed in version 1.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h - https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c
CVE ID: CVE-2020-15132 State: PUBLISHED Published: 2020-08-05T20:30:13 Last Updated: 2024-08-04T13:08:22.435Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: sulu Products: sulu Problem Types: CWE-209 Description: In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that this user name does not exist. This enables attackers to retrieve valid usernames. Also, the response of the "Forgot Password" request returns the email address to
attackers to retrieve valid usernames. Also, the response of the "Forgot Password" request returns the email address to which the email was sent, if the operation was successful. This information should not be exposed, as it can be used to gather email addresses. This problem was fixed in versions 1.6.35, 2.0.10 and 2.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sulu/sulu/security/advisories/GHSA-wfm4-pq59-wg6r
CVE ID: CVE-2020-15133 State: PUBLISHED Published: 2020-07-31T17:40:21 Last Updated: 2024-08-04T13:08:22.247Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: faye Products: faye-websocket Problem Types: CWE-295 Description: In faye-websocket before version 0.11.0, there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Connection#start_tls` method in EventMachine to implement the TLS handshake whenever a `wss:` URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for th
ification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any `wss:` connection made using this library is vulnerable to a man-in-the-middle attack, since it does not confirm the identity of the server it is connected to. For further background information on this issue, please see the referenced GitHub Advisory. Upgrading `faye-websocket` to v0.11.0 is recommended. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye/ - https://github.com/faye/faye-websocket-ruby/security/advisories/GHSA-2v5c-755p-p4gv
CVE ID: CVE-2020-15134 State: PUBLISHED Published: 2020-07-31T17:40:15 Last Updated: 2024-08-04T13:08:22.211Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: faye Products: faye Problem Types: CWE-295 Description: Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of its client. Those libraries both use the `EM::Connection#start_tls` method in EventMachine to implement the TLS handshake whenever a `wss:` URL is used for the connection. This method does not implement certificate verification by default, meaning that it does not check that the server presents a
ethod does not implement certificate verification by default, meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any `https:` or `wss:` connection made using these libraries is vulnerable to a man-in-the-middle attack, since it does not confirm the identity of the server it is connected to. The first request a Faye client makes is always sent via normal HTTP, but later messages may be sent via WebSocket. Therefore it is vulnerable to the same problem that these underlying libraries are, and we needed both libraries to support TLS verification before Faye could claim to do the same. Your client would still be
we needed both libraries to support TLS verification before Faye could claim to do the same. Your client would still be insecure if its initial HTTPS request was verified, but later WebSocket connections were not. This is fixed in Faye v1.4.0, which enables verification by default. For further background information on this issue, please see the referenced GitHub Advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/faye/faye/security/advisories/GHSA-3q49-h8f9-9fr9 - https://blog.jcoglan.com/2020/07/31/missing-tls-verification-in-faye/
CVE ID: CVE-2020-15135 State: PUBLISHED Published: 2020-08-04T20:25:14 Last Updated: 2024-08-04T13:08:22.257Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Neztore Products: save-server Problem Types: CWE-352 Description: save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). T
you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including uploading/deleting files and adding redirects. If you are logged in as root, this attack is significantly more severe. They can in addition create, delete and update users. If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password. Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. Thi
n policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. This issue has been patched in version 1.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Neztore/save-server/security/advisories/GHSA-wwrj-35w6-77ff - https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f - https://www.npmjs.com/package/save-server
CVE ID: CVE-2020-15136 State: PUBLISHED Published: 2020-08-06T22:45:14 Last Updated: 2024-08-04T13:08:21.951Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: etcd-io Products: etcd Problem Types: CWE-287 Description: In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with impro
rformed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q - https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
CVE ID: CVE-2020-15137 State: PUBLISHED Published: 2020-08-12T16:15:13 Last Updated: 2024-08-04T13:08:21.951Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:H) Vendors: jwise Products: HoRNDIS Problem Types: CWE-190 Description: All versions of HoRNDIS are affected by an integer overflow in the RNDIS packet parsing routines. A malicious USB device can trigger disclosure of unrelated kernel memory to userspace applications on the host, or can cause the kernel to crash. Kernel memory disclosure is especially likely on 32-bit kernels; 64-bit kernels are more likely to crash on attempted exploitation. It is not believed that kernel memory corruption is possible, or that un
more likely to crash on attempted exploitation. It is not believed that kernel memory corruption is possible, or that unattended kernel memory disclosure without the collaboration of a userspace program running on the host is possible. The vulnerability is in `HoRNDIS::receivePacket`. `msg_len`, `data_ofs`, and `data_len` can be controlled by an attached USB device, and a negative value of `data_ofs` can bypass the check for `(data_ofs + data_len + 8) > msg_len`, and subsequently can cause a wild pointer copy in the `mbuf_copyback` call. The software is not maintained and no patches are planned. Users of multi-tenant systems with HoRNDIS installed should only connect trusted USB devices to t
o patches are planned. Users of multi-tenant systems with HoRNDIS installed should only connect trusted USB devices to their system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jwise/HoRNDIS/security/advisories/GHSA-8q4r-m3rh-57jx
CVE ID: CVE-2020-15138 State: PUBLISHED Published: 2020-08-07T16:30:14 Last Updated: 2024-08-04T13:08:21.948Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: PrismJS Products: prism Problem Types: CWE-79 Description: Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, dis
sing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrismJS/prism/security/advisories/GHSA-wvhm-4hhf-97x9 - https://prismjs.com/plugins/previewers/#disabling-a-previewer - https://github.com/PrismJS/prism/pull/2506/commits/7bd7de05edf71112a3a77f87901a2409c9c5c20c
CVE ID: CVE-2020-15139 State: PUBLISHED Published: 2020-08-10T21:35:13 Last Updated: 2024-08-04T13:08:22.286Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MyBB Products: MyBB Problem Types: CWE-79 Description: In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on r
crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. After upgrading MyBB to 1.8.24, make sure to update the version attribute in the `codebuttons` template for non-default themes to serve the latest version of the patched `jscripts/bbcodes_sceditor.js` file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mybb/mybb/security/advisories/GHSA-37h7-vfv6-f8rj - https://github.com/mybb/mybb/commit/37ad29dcd25489a37bdd89ebac761f22492558b0 - https://mybb.com/versions/1.8.24/
CVE ID: CVE-2020-15140 State: PUBLISHED Published: 2020-08-21T16:40:15 Last Updated: 2024-08-04T13:08:22.257Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Cog-Creators Products: Red-DiscordBot Problem Types: CWE-74 Description: In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11. Additional Analyst Notes: - CVE Program Conta
itive information. This critical exploit has been fixed on version 3.3.11. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-55j9-849x-26h4 - https://github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17d7ce26f1cc64482a81
CVE ID: CVE-2020-15141 State: PUBLISHED Published: 2020-08-14T16:20:19 Last Updated: 2024-08-04T13:08:22.282Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: triaxtec Products: openapi-python-client Problem Types: CWE-22 Description: In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13 - https://github.com/triaxtec/openapi-p
ithub.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13 - https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-7wgr-7666-7pwj - https://pypi.org/project/openapi-python-client - https://github.com/triaxtec/openapi-python-client/commit/3e7dfae5d0b3685abf1ede1bc6c086a116ac4746
CVE ID: CVE-2020-15142 State: PUBLISHED Published: 2020-08-14T16:20:13 Last Updated: 2024-08-04T13:08:22.278Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: triaxtec Products: openapi-python-client Problem Types: CWE-94 Description: In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-9x4c-63pf-525f - https://github.com/triaxtec/openapi-python-client/commit/f7
napi-python-client/security/advisories/GHSA-9x4c-63pf-525f - https://github.com/triaxtec/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a - https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13 - https://pypi.org/project/openapi-python-client/
CVE ID: CVE-2020-15143 State: PUBLISHED Published: 2020-08-19T20:40:12 Last Updated: 2024-08-04T13:08:22.247Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: Sylius Products: SyliusResourceBundle Problem Types: CWE-74 Description: In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were n
te Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv
CVE ID: CVE-2020-15145 State: PUBLISHED Published: 2020-08-14T16:35:13 Last Updated: 2024-08-04T13:08:21.821Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N) Vendors: composer Products: windows-setup Problem Types: CWE-276 Description: In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios. 1. A local regular user may modify the existing `C:\ProgramData\ComposerSetup\bin\composer.bat` in order to get elevated command execution when composer is run by an administrator. 2. A local regular user may create a specially crafted dll in the `C:\ProgramData\Com
mposer is run by an administrator. 2. A local regular user may create a specially crafted dll in the `C:\ProgramData\ComposerSetup\bin` folder in order to get Local System privileges. See: https://itm4n.github.io/windows-server-netman-dll-hijacking. 3. If the directory of the php.exe selected by the user is not in the system path, it is added without checking that it is admin secured, as per Microsoft guidelines. See: https://msrc-blog.microsoft.com/2018/04/04/triaging-a-dll-planting-vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/composer/windows-setup/security/advisories/GHSA-wgrx-r3qv-332c - https://github.com/composer/windows-setup/commi
hub.com/composer/windows-setup/security/advisories/GHSA-wgrx-r3qv-332c - https://github.com/composer/windows-setup/commit/ca9f1435d368e3377e82d60ef0c7b795afa9f804
CVE ID: CVE-2020-15146 State: PUBLISHED Published: 2020-08-19T20:20:12 Last Updated: 2024-08-04T13:08:22.235Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Sylius Products: SyliusResourceBundle Problem Types: CWE-74 Description: In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 wer
emote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5
CVE ID: CVE-2020-15147 State: PUBLISHED Published: 2020-08-21T17:15:16 Last Updated: 2024-08-04T13:08:21.944Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Cog-Creators Products: Red-DiscordBot Problem Types: CWE-94 Description: Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can rend
actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-7257-96vg-qf6x - https://github.com/Cog-Creators/Red-DiscordBot/pull/4183 - https://github.com/Cog-Creators/Red-DiscordBot/pull/4183/commits/e269ea0d3bc88417163c18431b1df38a9be92bfc
CVE ID: CVE-2020-15148 State: PUBLISHED Published: 2020-09-15T18:25:12 Last Updated: 2024-08-04T13:08:21.907Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: yiisoft Products: yii2 Problem Types: CWE-502 Description: Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj - https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb
github.com/yiisoft/yii2/security/advisories/GHSA-699q-wcff-g9mj - https://github.com/yiisoft/yii2/commit/9abccb96d7c5ddb569f92d1a748f50ee9b3e2b99
CVE ID: CVE-2020-15149 State: PUBLISHED Published: 2020-08-19T17:50:12 Last Updated: 2024-08-04T13:08:22.245Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: NodeBB Products: NodeBB Problem Types: CWE-269 Description: NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03