Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
atched, and is believed to have never been exploited, based on an extensive review of logs and existing gems by rubygems. The easiest way to ensure that an application has not been exploited by this vulnerability is to verify all downloaded .gems checksums match the checksum recorded in the RubyGems.org database. RubyGems.org has been patched and is no longer vulnerable to this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rubygems/rubygems.org/security/advisories/GHSA-2jmx-8mh8-pm8w - https://security.netapp.com/advisory/ntap-20220629-0010/
CVE ID: CVE-2022-29219 State: PUBLISHED Published: 2022-05-24T14:15:14.000Z Last Updated: 2025-04-23T18:22:36.298Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: ChainSafe Products: lodestar Problem Types: CWE-190 Description: Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously-crafted `AttesterSlashing` or `ProposerSlashing` being included on-chain. Because the developers represent `uint64` values as native javascript `number`s, there is an issue when those variables with large (greater than 2^53) `uint64` values are included on chain. In those cases,
is an issue when those variables with large (greater than 2^53) `uint64` values are included on chain. In those cases, Lodestar may view valid_`AttesterSlashing` or `ProposerSlashing` as invalid, due to rounding errors in large `number` values. This causes a consensus split, where Lodestar nodes are forked away from the main network. Similarly, Lodestar may consider invalid `ProposerSlashing` as valid, thus including in proposed blocks that will be considered invalid by the network. Version 0.36.0 contains a fix for this issue. As a workaround, use `BigInt` to represent `Slot` and `Epoch` values in `AttesterSlashing` and `ProposerSlashing` objects. `BigInt` is too slow to be used in all `Sl
lot` and `Epoch` values in `AttesterSlashing` and `ProposerSlashing` objects. `BigInt` is too slow to be used in all `Slot` and `Epoch` cases, so one may carefully use `BigInt` just where necessary for consensus. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChainSafe/lodestar/security/advisories/GHSA-cvj7-5f3c-9vg9 - https://github.com/ChainSafe/lodestar/pull/3977 - https://github.com/ChainSafe/lodestar/releases/tag/v0.36.0
CVE ID: CVE-2022-29220 State: PUBLISHED Published: 2022-05-31T16:10:10.000Z Last Updated: 2025-04-23T18:21:19.523Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: fastify Products: github-action-merge-dependabot Problem Types: CWE-283 Description: github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action
to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action in the pipeline can check if the PR is created by dependabot and if their own action has enough permissions to modify the PR in the pipeline. If so, they can modify the PR by adding a second seemingly valid and legit commit to the PR, as they can set arbitrarily the username and email in for commits in git. Because the bot only checks if the actor is valid, it would pass the malicious changes through and merge the PR automatically, without getting noticed by project maintainers. It would probably not be possible to determine where the malicious commit came from, as it woul
by project maintainers. It would probably not be possible to determine where the malicious commit came from, as it would only say `dependabot[bot]` and the corresponding email-address. Version 3.2.0 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fastify/github-action-merge-dependabot/security/advisories/GHSA-v5vr-h3xq-8v6w - https://github.com/fastify/github-action-merge-dependabot/commit/309f39539c5d918d8a47075587aa8720a9c127f7 - https://hackerone.com/bugs?report_id=1564530
CVE ID: CVE-2022-29221 State: PUBLISHED Published: 2022-05-24T00:00:00.000Z Last Updated: 2025-04-23T18:22:54.999Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: smarty-php Products: smarty Problem Types: CWE-94 Description: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds. Additional Analyst Note
ons 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c - https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd - https://github.com/smarty-php/smarty/releases/tag/v3.1.45 - https://github.com/smarty-php/smarty/releases/tag/v4.1.1 - https://lists.debian.org/debian-lts-announce/2022/05/msg00044.html - https://www.debian.org/security/2022/dsa-5151 - https://security.gentoo.org/glsa/202209-09 - https://lists.fedoraproject.org/archives/list/package-announce%40l
a-5151 - https://security.gentoo.org/glsa/202209-09 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/
CVE ID: CVE-2022-29222 State: PUBLISHED Published: 2022-05-21T00:00:15.000Z Last Updated: 2025-04-23T18:23:10.716Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: pion Products: dtls Problem Types: CWE-295 Description: Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade
ificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh - https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412 - https://github.com/pion/dtls/releases/tag/v2.1.5
CVE ID: CVE-2022-29223 State: PUBLISHED Published: 2022-05-24T14:25:10.000Z Last Updated: 2025-04-23T18:22:28.758Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: azure-rtos Products: usbx Problem Types: CWE-120 Description: Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. In versions prior to 6.1.10, an attacker can cause a buffer overflow by providing the Azure RTOS USBX host stack a HUB descriptor with `bNbPorts` set to a value greater than `UX_MAX_TT` which defaults to 8. For a `bNbPorts` value of 255, the implementation of `ux_host_class_hub_descriptor_get` function will modify the contents of `hub` -> `ux_host_class_hub_device`
entation of `ux_host_class_hub_descriptor_get` function will modify the contents of `hub` -> `ux_host_class_hub_device` -> `ux_device_hub_tt` array violating the end boundary by 255 - `UX_MAX_TT` items. The USB host stack needs to validate the number of ports reported by the hub, and if the value is larger than UX_MAX_TT, USB stack needs to reject the request. This fix has been included in USBX release 6.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/azure-rtos/usbx/security/advisories/GHSA-2qc5-385m-x862 - https://github.com/azure-rtos/usbx/releases/tag/v6.1.10_rel
CVE ID: CVE-2022-29224 State: PUBLISHED Published: 2022-06-09T19:10:10.000Z Last Updated: 2025-04-23T18:17:59.159Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-476 Description: Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can “hold” (prevent removal) upstream hosts obtained via service discovery until configured active health checking fails. If an attacker controls an upstream host and also contr
service discovery until configured active health checking fails. If an attacker controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.), an attacker can crash Envoy by forcing removal of the host from service discovery, and then failing the gRPC health check request. This will crash Envoy via a null pointer dereference. Users are advised to upgrade to resolve this vulnerability. Users unable to upgrade may disable gRPC health checking and/or replace it with a different health checking type as a mitigation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advis
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-m4j9-86g3-8f49 - https://github.com/envoyproxy/envoy/commit/9b1c3962172a972bc0359398af6daa3790bb59db
CVE ID: CVE-2022-29225 State: PUBLISHED Published: 2022-06-09T19:15:14.000Z Last Updated: 2025-04-22T17:54:27.865Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-400, CWE-409 Description: Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users una
y constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-75hv-2jjj-89hh - https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343
CVE ID: CVE-2022-29226 State: PUBLISHED Published: 2022-06-09T19:25:11.000Z Last Updated: 2025-04-23T18:17:43.822Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-306 Description: Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users
ess tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 - https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh
CVE ID: CVE-2022-29227 State: PUBLISHED Published: 2022-06-09T19:30:15.000Z Last Updated: 2025-04-23T18:17:37.517Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-416 Description: Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there’s a lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the redirect headers are processed, the downstream state indicates that the downstream stream is not complete. On sending the local r
headers are processed, the downstream state indicates that the downstream stream is not complete. On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually complete, and deleted, this result in a use-after-free. Users are advised to upgrade. Users unable to upgrade are advised to disable internal redirects if crashes are observed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-rm2p-qvf6-pvr6 - https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab
CVE ID: CVE-2022-29228 State: PUBLISHED Published: 2022-06-09T19:20:13.000Z Last Updated: 2025-04-23T18:17:53.066Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-617 Description: Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in newer versions and corrupts memory on earlier versions. continueDecoding() shouldn’t ever be called from filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds for this issue. Additi
s after a local reply has been sent. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-rww6-8h7g-8jf6 - https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360
CVE ID: CVE-2022-29229 State: PUBLISHED Published: 2022-05-18T20:55:09.000Z Last Updated: 2025-04-23T18:25:19.216Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: cassproject Products: CASS Problem Types: CWE-325 Description: CaSS is a Competency and Skills System. CaSS Library, (npm:cassproject) has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalone username/password authentication, which uses a method that expects e2e cryptographic security of authorization credentials. The issue has been patched in 1.5.8, however, the vulne
expects e2e cryptographic security of authorization credentials. The issue has been patched in 1.5.8, however, the vulnerable accounts are only resecured when the user next logs in using standalone authentication, as the data required to resecure the account is not available to the server. The issue may be mitigated by using SSO or client side certificates to log in. Please note that SSO and client side certificate authentication does not have this expectation of no-knowledge credential access, and cryptographic keys are available to the server administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cassproject/CASS/security
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cassproject/CASS/security/advisories/GHSA-7qcx-4p32-qcmx - https://github.com/cassproject/CASS/releases/tag/1.5.8
CVE ID: CVE-2022-29230 State: PUBLISHED Published: 2022-05-18T20:30:13.000Z Last Updated: 2025-04-23T18:25:24.537Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Shopify Products: hydrogen Problem Types: CWE-79 Description: Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from version 0.10.0 to 0.18.0. This vulnerability is exploitable in applications whose hydrating data is user controlled. All Hydrogen users should
0. This vulnerability is exploitable in applications whose hydrating data is user controlled. All Hydrogen users should upgrade their project to version 0.19.0. There is no current workaround, and users should update as soon as possible. Additionally, the Content Security Policy is not an effective mitigation for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Shopify/hydrogen/security/advisories/GHSA-6j22-wv8g-894f - https://github.com/Shopify/hydrogen/pull/1272 - https://github.com/Shopify/hydrogen/releases/tag/%40shopify/hydrogen%400.19.0
CVE ID: CVE-2022-29232 State: PUBLISHED Published: 2022-06-01T22:25:12.000Z Last Updated: 2025-04-23T18:20:24.731Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-200 Description: BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a meeting on the server. BigBlueButton versions 2.3.9 and 2.4-beta-1 contain a patch for this issue. There are currently no known workar
server. BigBlueButton versions 2.3.9 and 2.4-beta-1 contain a patch for this issue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3fqh-p4qr-vfm9 - https://github.com/bigbluebutton/bigbluebutton/pull/12861 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.9 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-beta-1
CVE ID: CVE-2022-29233 State: PUBLISHED Published: 2022-06-01T23:15:15.000Z Last Updated: 2025-04-23T18:20:17.607Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-285 Description: BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no know
cation of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33 - https://github.com/bigbluebutton/bigbluebutton/pull/13117 - https://github.com/bigbluebutton/bigbluebutton/pull/14265 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1
CVE ID: CVE-2022-29234 State: PUBLISHED Published: 2022-06-01T23:20:14.000Z Last Updated: 2025-04-23T18:20:10.802Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-285 Description: BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds. Additional Analyst Notes: - CVE
3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-36vc-c338-6xjv - https://github.com/bigbluebutton/bigbluebutton/pull/13850 - https://github.com/bigbluebutton/bigbluebutton/pull/14265 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.1
CVE ID: CVE-2022-29235 State: PUBLISHED Published: 2022-06-01T23:25:18 Last Updated: 2024-08-03T06:17:54.233Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-200 Description: BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in
The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x82p-j22f-v4q6 - https://github.com/bigbluebutton/bigbluebutton/pull/13788 - https://github.com/bigbluebutton/bigbluebutton/pull/14265 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6
CVE ID: CVE-2022-29236 State: PUBLISHED Published: 2022-06-01T23:25:12 Last Updated: 2024-08-03T06:17:54.254Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-285 Description: BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced grace period. The attacker must be a meeting participant. The problem has been patched in versions 2.3.18 and 2.4-rc-6. There are currently
tacker must be a meeting participant. The problem has been patched in versions 2.3.18 and 2.4-rc-6. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-p93g-r9gm-9v6r - https://github.com/bigbluebutton/bigbluebutton/pull/13803 - https://github.com/bigbluebutton/bigbluebutton/pull/14265 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6