Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-26218 State: PUBLISHED Published: 2020-11-11T22:00:14 Last Updated: 2024-08-04T15:49:07.206Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: puncsky Products: touchbase.ai Problem Types: CWE-80, CWE-79 Description: touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-r4w5-gw36-4792
CVE ID: CVE-2020-26219 State: PUBLISHED Published: 2020-11-11T22:05:15 Last Updated: 2024-08-04T15:49:07.257Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: puncsky Products: touchbase.ai Problem Types: CWE-601 Description: touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0. Additional Analyst N
first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x
CVE ID: CVE-2020-26220 State: PUBLISHED Published: 2020-11-11T22:15:14 Last Updated: 2024-08-04T15:49:07.176Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: puncsky Products: touchbase.ai Problem Types: CWE-200 Description: toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc (if present. The issue is fixed in version 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-hh6j-j73p-cp3h - https://github.com/puncsky/touchbase
- https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-hh6j-j73p-cp3h - https://github.com/puncsky/touchbase.ai/pull/400/commits/69de77b163f6debaeb3f8d1a85367310a40d196f
CVE ID: CVE-2020-26221 State: PUBLISHED Published: 2020-11-11T22:20:12 Last Updated: 2024-08-04T15:49:07.286Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: puncsky Products: touchbase.ai Problem Types: CWE-79 Description: touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action. The issue is patched in version 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/puncsky/touchbase.ai/s
version 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-jc3v-h36h-6mx3
CVE ID: CVE-2020-26222 State: PUBLISHED Published: 2020-11-13T16:00:20 Last Updated: 2024-08-04T15:49:07.167Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: dependabot Products: dependabot-core Problem Types: CWE-74 Description: Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following sour
branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dependabot/dependabot-core/security/advisories/GHSA-23f7-99jx-m54r - https://github.com/dependabot/dependabot-core/pull/2727 - https://github.com/dependabot/dependabot-core/commit/e089116abbe284425b976f7920e502b
endabot/dependabot-core/pull/2727 - https://github.com/dependabot/dependabot-core/commit/e089116abbe284425b976f7920e502b8e83a61b5
CVE ID: CVE-2020-26223 State: PUBLISHED Published: 2020-11-13T17:25:20 Last Updated: 2024-08-04T15:49:07.219Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: spree Products: spree Problem Types: CWE-863 Description: Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected. Additional Anal
ns 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spree/spree/security/advisories/GHSA-m2jr-hmc3-qmpr - https://github.com/spree/spree/pull/10573 - https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status
CVE ID: CVE-2020-26224 State: PUBLISHED Published: 2020-11-16T21:25:12 Last Updated: 2024-08-04T15:49:07.168Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-284 Description: In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9m - https://github.com/PrestaShop/PrestaShop
ps://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9m - https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909
CVE ID: CVE-2020-26225 State: PUBLISHED Published: 2020-11-16T21:35:13 Last Updated: 2024-08-04T15:49:07.376Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: PrestaShop Products: productcomments Problem Types: CWE-79 Description: In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/productcomments/security/advisories/GHSA-58w4-w77w-qv3w - https://github.com/PrestaShop/productcomments/commit/c56e3e9495
roductcomments/security/advisories/GHSA-58w4-w77w-qv3w - https://github.com/PrestaShop/productcomments/commit/c56e3e9495c4a0a9c1e7dc43e1bb0fcad2796dbf
CVE ID: CVE-2020-26226 State: PUBLISHED Published: 2020-11-18T21:35:14 Last Updated: 2024-08-04T15:56:03.009Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: semantic-release Products: semantic-release Problem Types: CWE-116 Description: In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3. Additional Analyst Notes: - CVE Program Container: References
ady masked properly. The issue is fixed in version 17.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/semantic-release/semantic-release/security/advisories/GHSA-r2j6-p67h-q639 - https://github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5a
CVE ID: CVE-2020-26227 State: PUBLISHED Published: 2020-11-23T21:05:18 Last Updated: 2024-08-04T15:56:03.033Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-79 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CM
he problem described. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-vqqx-jw6p-q3rf - https://typo3.org/security/advisory/typo3-core-sa-2020-010
CVE ID: CVE-2020-26228 State: PUBLISHED Published: 2020-11-23T21:10:16 Last Updated: 2024-08-04T15:56:03.135Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-312 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Update to TYPO3 versions 9.5.23 or 10.4.10 that fi
like for instance SQL injection in any other component of the system. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-954j-f27r-cj52 - https://typo3.org/security/advisory/typo3-core-sa-2020-011
CVE ID: CVE-2020-26229 State: PUBLISHED Published: 2020-11-23T21:15:18 Last Updated: 2024-08-04T15:56:03.052Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-611 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entiti
supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-q9cp-mc96-m4w2 - https://typo3.org/security/advisory/typo3-core-sa-2020-012
CVE ID: CVE-2020-26230 State: PUBLISHED Published: 2020-11-13T18:30:27 Last Updated: 2024-08-04T15:56:03.112Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: RadarCOVID Products: radar-covid-backend-dp3t-server Problem Types: CWE-200 Description: Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and de-anonymization of COVID-19 positive users when using Radar COVID. The vulnerability is caused by the fact that Radar COVID conn
ization of COVID-19 positive users when using Radar COVID. The vulnerability is caused by the fact that Radar COVID connections to the server (uploading of TEKs to the backend) are only made by COVID-19 positives. Therefore, any on-path observer with the ability to monitor traffic between the app and the server can identify which users had a positive test. Such an adversary can be the mobile network operator (MNO) if the connection is done through a mobile network, the Internet Service Provider (ISP) if the connection is done through the Internet (e.g., a home network), a VPN provider used by the user, the local network operator in the case of enterprise networks, or any eavesdropper with ac
PN provider used by the user, the local network operator in the case of enterprise networks, or any eavesdropper with access to the same network (WiFi or Ethernet) as the user as could be the case of public WiFi hotspots deployed at shopping centers, airports, hotels, and coffee shops. The attacker may also de-anonymize the user. For this additional stage to succeed, the adversary needs to correlate Radar COVID traffic to other identifiable information from the victim. This could be achieved by associating the connection to a contract with the name of the victim or by associating Radar COVID traffic to other user-generated flows containing identifiers in the clear (e.g., HTTP cookies or othe
iating Radar COVID traffic to other user-generated flows containing identifiers in the clear (e.g., HTTP cookies or other mobile flows sending unique identifiers like the IMEI or the AAID without encryption). The former can be executed, for instance, by the Internet Service Provider or the MNO. The latter can be executed by any on-path adversary, such as the network provider or even the cloud provider that hosts more than one service accessed by the victim. The farther the adversary is either from the victim (the client) or the end-point (the server), the less likely it may be that the adversary has access to re-identification information. The vulnerability has been mitigated with the inject
be that the adversary has access to re-identification information. The vulnerability has been mitigated with the injection of dummy traffic from the application to the backend. Dummy traffic is generated by all users independently of whether they are COVID-19 positive or not. The issue was fixed in iOS in version 1.0.8 (uniform distribution), 1.1.0 (exponential distribution), Android in version 1.0.7 (uniform distribution), 1.1.0 (exponential distribution), Backend in version 1.1.2-RELEASE. For more information see the referenced GitHub Security Advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RadarCOVID/radar-covid-backend-dp3t-server/security/a
t Notes: - CVE Program Container: References: - https://github.com/RadarCOVID/radar-covid-backend-dp3t-server/security/advisories/GHSA-w7jx-37x3-w2jx - https://github.com/RadarCOVID/radar-covid-android/commit/09d00e5ede801ca400d45c7feda5a99c34e4176c - https://github.com/RadarCOVID/radar-covid-android/commit/53252773ffa81e116deabcbbea3bac96872b9888 - https://github.com/RadarCOVID/radar-covid-android/commit/7fdc7debeb8a37faa77b53d9f9a1b4bbcff445ce - https://github.com/RadarCOVID/radar-covid-android/commit/8e5d14ec60e0c1847a4733556cf34d232c27102c - https://github.com/RadarCOVID/radar-covid-android/commit/91dcfff6252055637bc9ee0c46b8f003d64a16b9 - https://github.com/RadarCOVID/radar-covid-androi
D/radar-covid-android/commit/91dcfff6252055637bc9ee0c46b8f003d64a16b9 - https://github.com/RadarCOVID/radar-covid-android/commit/9627f4d69705bca68e550eefd3df1b9abe90b215 - https://github.com/RadarCOVID/radar-covid-android/commit/ea0c4cc837f72f58e2b5df1ecf0899743ec3cdf8 - https://github.com/RadarCOVID/radar-covid-backend-dp3t-server/commit/6d30c92cc8fcbde3ded7e9518853ef278080344d - https://github.com/RadarCOVID/radar-covid-backend-dp3t-server/commit/c37f81636250892670750e3989139fd76d4beffe - https://github.com/RadarCOVID/radar-covid-ios/commit/2d1505d4858642995ea09f02f23c953acaa65195 - https://github.com/DP-3T/documents/blob/master/DP3T%20-%20Best%20Practices%20for%20Operation%20Security%20in
acaa65195 - https://github.com/DP-3T/documents/blob/master/DP3T%20-%20Best%20Practices%20for%20Operation%20Security%20in%20Proximity%20Tracing.pdf
CVE ID: CVE-2020-26231 State: PUBLISHED Published: 2020-11-23T20:55:14 Last Updated: 2024-08-04T15:56:03.105Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: octobercms Products: october Problem Types: CWE-862 Description: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247. An authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled i
would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having cms.enableSafeMode enabled, but would be a problem for anyone relying on cms.enableSafeMode to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 470 (v1.0.470) and v1.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octob
ild 470 (v1.0.470) and v1.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/octobercms/october/security/advisories/GHSA-r89v-cgv7-3jhx - https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7
CVE ID: CVE-2020-26232 State: PUBLISHED Published: 2020-11-24T21:10:14 Last Updated: 2024-08-04T15:56:04.399Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: jupyter Products: jupyter_server Problem Types: CWE-601 Description: Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet. Additio
link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v - https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157 - https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18
CVE ID: CVE-2020-26233 State: PUBLISHED Published: 2020-12-08T19:55:15 Last Updated: 2024-08-04T15:56:03.058Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: microsoft Products: Git-Credential-Manager-Core Problem Types: CWE-706 Description: Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, when recursively cloning a Git repository on Windows with submodules, Git will first clone the top-level repository and then recursively clone all submodules by starting new Git processes from the top-level working directory. If a malicious git.ex
cursively clone all submodules by starting new Git processes from the top-level working directory. If a malicious git.exe executable is present in the top-level repository then this binary will be started by Git Credential Manager Core when attempting to read configuration, and not git.exe as found on the %PATH%. This only affects GCM Core on Windows, not macOS or Linux-based distributions. GCM Core version 2.0.289 contains the fix for this vulnerability, and is available from the project's GitHub releases page. GCM Core 2.0.289 is also bundled in the latest Git for Windows release; version 2.29.2(3). As a workaround, users should avoid recursively cloning untrusted repositories with the --r
release; version 2.29.2(3). As a workaround, users should avoid recursively cloning untrusted repositories with the --recurse-submodules option. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/microsoft/Git-Credential-Manager-Core/security/advisories/GHSA-2gq7-ww4j-3m76 - https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt - https://github.com/microsoft/Git-Credential-Manager-Core/releases/tag/v2.0.289-beta - https://github.com/microsoft/Git-Credential-Manager-Core/commit/61c0388e064babb3b4e60d3ec269e8a07ab3bc76 - https://blog.blazeinfosec.com/attack-of-the-clones-2-git-command-client-remote-code-execution-strik
3ec269e8a07ab3bc76 - https://blog.blazeinfosec.com/attack-of-the-clones-2-git-command-client-remote-code-execution-strikes-back/
CVE ID: CVE-2020-26234 State: PUBLISHED Published: 2020-12-08T22:35:13 Last Updated: 2024-08-04T15:56:02.992Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: opencast Products: opencast Problem Types: CWE-346 Description: Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will
This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencast/opencast/security/advisories/GHSA-44cw-p2hm-gpf6 - https://github.com/opencast/opencast/commit/4225bf90af74557deaf8fb6b80b0705c9621acfc
CVE ID: CVE-2020-26235 State: PUBLISHED Published: 2020-11-24T21:20:14 Last Updated: 2024-08-04T15:56:03.095Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: time-rs Products: time Problem Types: CWE-476 Description: In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are time::UtcOffset::local_offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_loc
offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_local_offset, time::OffsetDateTime::now_local and time::OffsetDateTime::try_now_local. Non-Unix targets are unaffected. This includes Windows and wasm. The issue was introduced in version 0.2.7 and fixed in version 0.2.23. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/time-rs/time/security/advisories/GHSA-wcg3-cvx6-7396 - https://github.com/time-rs/time/issues/293 - https://crates.io/crates/time/0.2.23