Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
l Analyst Notes: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/ - https://support.apple.com/kb/HT213496 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/ - http://seclists.org/fulldisclosure/2022/Nov/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org
org/fulldisclosure/2022/Nov/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMQWGMDLX6KTVWW5JZLVPI7ICAK72TN7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html - http://www.openwall.com/lists/oss-security/2023/02/14/5 - https://security.gentoo.org/glsa/202312-15 - http://www.openwall.com/lists/oss-security/2024/05/14/2
CVE ID: CVE-2022-39254 State: PUBLISHED Published: 2022-09-29T14:35:10.000Z Last Updated: 2025-04-23T16:53:59.840Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: poljar Products: matrix-nio Problem Types: CWE-322, CWE-287 Description: matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack.
is allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh - https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0
CVE ID: CVE-2022-39255 State: PUBLISHED Published: 2022-09-28T20:35:10.000Z Last Updated: 2025-04-23T16:54:34.263Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: matrix-org Products: matrix-ios-sdk Problem Types: CWE-322, CWE-287 Description: Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in
icated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-ios-sdk version 0.23.19 has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires
Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround. To avoid malicious backup attacks, one should not verify one's new logins using emoji/QR verifications methods until patched. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients - https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm - https://github.com/matrix-org/matrix-ios-sdk/co
.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm - https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c - https://github.com/matrix-org/matrix-ios-sdk/releases/tag/v0.23.19
CVE ID: CVE-2022-39256 State: PUBLISHED Published: 2022-09-27T15:00:15.000Z Last Updated: 2025-04-23T16:55:22.696Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Orckestra Products: C1-CMS-Foundation Problem Types: CWE-502 Description: Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.
nknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j - https://github.com/Orckestra/C1-CMS-Foundation/pull/814 - https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13
CVE ID: CVE-2022-39257 State: PUBLISHED Published: 2022-09-28T20:55:10.000Z Last Updated: 2025-04-23T16:54:28.718Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: matrix-org Products: matrix-ios-sdk Problem Types: CWE-322, CWE-287 Description: Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-ios-sdk implementing a too permissive key forwarding strateg
issing in others. This attack is possible due to the matrix-ios-sdk implementing a too permissive key forwarding strategy. The default policy for accepting key forwards has been made more strict in the matrix-ios-sdk version 0.23.19. matrix-ios-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). This at
a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients - https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c - https://github.com/matrix-org/matrix-ios-sdk/releases/tag/v0.23.19 - https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-qxr3-5jmq-xc
atrix-ios-sdk/releases/tag/v0.23.19 - https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-qxr3-5jmq-xcf4
CVE ID: CVE-2022-39258 State: PUBLISHED Published: 2022-09-27T15:10:10.000Z Last Updated: 2025-04-22T17:20:10.592Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: mailcow Products: mailcow-dockerized Problem Types: CWE-451, CWE-200 Description: mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the S
r information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-vjgf-cp5p-wm45 - https://github.com/mailcow/mailcow-dockerized/pull/4766
CVE ID: CVE-2022-39259 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-04-22T17:18:05.407Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: skylot Products: jadx Problem Types: CWE-20 Description: jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. versions prior to 1.4.5 are subject to a Denial of Service when opening zip files with HTML sequences. This issue has been patched in version 1.4.5. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/skylot/jadx/security/advisories/GHSA-3r7j-8mqh-6qhx
CVE ID: CVE-2022-39260 State: PUBLISHED Published: 2022-10-19T00:00:00 Last Updated: 2024-08-03T12:00:43.573Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: git Products: git Problem Types: CWE-787, CWE-122 Description: Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally
y improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround. Additional Ana
to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKFHE4KVD7EKS5J3KTDFVBEKU3CLXGVV/ - https://support.apple.com/kb/HT213496 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHNO2FB55CPX47BAXMBWUBGWHO6N6ZZH/ - http://seclists.org/fulldisclosure/2022/Nov/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5
/2022/Nov/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7B6JPKX5CGGLAHXJVQMIZNNEEB72FHD/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html - https://security.gentoo.org/glsa/202312-15
CVE ID: CVE-2022-39261 State: PUBLISHED Published: 2022-09-28T00:00:00.000Z Last Updated: 2025-04-23T16:54:59.321Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: twigphp Products: Twig Problem Types: CWE-22 Description: Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3
y when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33 - https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b - https://www.drupal.org/sa-core-2022-016 - https://www.debian.org/security/2022/dsa-5248 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR
//lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6
sg00016.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/
CVE ID: CVE-2022-39262 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-04-22T16:08:55.858Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:L) Vendors: glpi-project Products: glpi Problem Types: CWE-83 Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
upgrade to version 10.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-4x48-q2wr-cpg4 - https://huntr.dev/bounties/54fc907e-6983-4c24-b249-1440aac1643c/
CVE ID: CVE-2022-39263 State: PUBLISHED Published: 2022-09-28T21:05:09.000Z Last Updated: 2025-04-23T16:54:22.841Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: nextauthjs Products: next-auth Problem Types: CWE-287 Description: `@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the ema
for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextauthjs/next-auth/security/advisories/GHSA-4rxr-27mm-mxq9 - https://github.com/nextauthjs/ne
es: - https://github.com/nextauthjs/next-auth/security/advisories/GHSA-4rxr-27mm-mxq9 - https://github.com/nextauthjs/next-auth/commit/d16e04848ee703cf797724194d4ad2907fe125a9
CVE ID: CVE-2022-39264 State: PUBLISHED Published: 2022-09-28T00:00:00.000Z Last Updated: 2025-04-23T16:54:53.291Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Nheko-Reborn Products: nheko Problem Types: CWE-295, CWE-287 Description: nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu. Addit
ly, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Nheko-Reborn/nheko/security/advisories/GHSA-8jcp-8jq4-5mm7 - https://github.com/Nheko-Reborn/nheko/commit/67bee15a389f9b8a9f6c3a340558d1e2319e7199 - https://github.com/Nheko-Reborn/nheko/releases/tag/v0.10.2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YBOL6OOQGPZD2RLYT4EHAWTFXNIHLYEN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TA6A5ADUVAYKD3ZFLF2JPZOTIOFJOEU7/
CVE ID: CVE-2022-39265 State: PUBLISHED Published: 2022-10-06T00:00:00.000Z Last Updated: 2025-04-22T17:19:51.525Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: mybb Products: mybb Problem Types: CWE-74 Description: MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resol
CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7 - https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797 - https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338 - https://mybb.com/versions/1.8.31/
CVE ID: CVE-2022-39266 State: PUBLISHED Published: 2022-09-29T18:10:08.000Z Last Updated: 2025-04-23T16:53:54.194Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: laverdet Products: isolated-vm Problem Types: CWE-693, CWE-20 Description: isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user. Additional Analyst Notes: - CV
ocumentation to warn users that they should not accept `cachedData` payloads from a user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/laverdet/isolated-vm/security/advisories/GHSA-2jjq-x548-rhpv - https://github.com/laverdet/isolated-vm/issues/379 - https://github.com/laverdet/isolated-vm/commit/218e87a6d4e8cb818bea76d1ab30cd0be51920e8 - https://github.com/laverdet/isolated-vm/commits/v4.3.7
CVE ID: CVE-2022-39267 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-04-23T16:45:31.308Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: brokercap Products: Bifrost Problem Types: CWE-287 Description: Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With: XMLHttpRequest field in the request header. This issue has been patched in 1.8.8-release. There are no known workarounds. Additional Analyst Note
he request header. This issue has been patched in 1.8.8-release. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/brokercap/Bifrost/security/advisories/GHSA-mxrx-fg8p-5p5j - https://github.com/brockercap/Bifrost/pull/201
CVE ID: CVE-2022-39268 State: PUBLISHED Published: 2022-09-30T20:25:10.000Z Last Updated: 2025-04-23T16:53:18.634Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: orchest Products: orchest Problem Types: CWE-352 Description: ### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end user's account. ### Patch Upgrade to v2022.09.10 to patch this vulnerability. ### Workarounds Rebuild and redeploy the Orchest `auth-server` with
Upgrade to v2022.09.10 to patch this vulnerability. ### Workarounds Rebuild and redeploy the Orchest `auth-server` with this commit: https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d ### References https://en.wikipedia.org/wiki/Cross-site_request_forgery https://cwe.mitre.org/data/definitions/352.html ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/orchest/orchest * Email us at rick@orchest.io Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/orchest/orchest/security/advisories/GHSA-q44f-8jpw-qv4j - https://github.com/orchest/or
References: - https://github.com/orchest/orchest/security/advisories/GHSA-q44f-8jpw-qv4j - https://github.com/orchest/orchest/pull/1324 - https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d - https://github.com/orchest/orchest/releases/tag/v2022.09.10
CVE ID: CVE-2022-39269 State: PUBLISHED Published: 2022-10-06T00:00:00.000Z Last Updated: 2025-04-23T16:52:49.799Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: pjsip Products: pjproject Problem Types: CWE-319 Description: PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advis