Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
o mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/pull/10651 - https://github.com/redis/redis/releases/tag/6.2.7 - https://github.com/redis/redis/releases/tag/7.0.0 - https://github.com/redis/redis/security/advisories/GHSA-3qpw-7686-5984 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora
essage/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220715-0003/ - https://security.gentoo.org/glsa/202209-17
CVE ID: CVE-2022-24737 State: PUBLISHED Published: 2022-03-07T23:10:09.000Z Last Updated: 2025-04-22T18:20:30.599Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: httpie Products: httpie Problem Types: CWE-200 Description: HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party
vior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website. Users are advised to upgrade. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/httpie/httpie/security/advisories/GHSA-9w4w-cpc8-h2fq - https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b - https://github.com/httpie/httpie/releases/tag/3.1.0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXFCHGTW3V32GD6GXXJZE5QAOSDT3RTY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe
rg/message/TXFCHGTW3V32GD6GXXJZE5QAOSDT3RTY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5VYSYKEKVZEVEBIWAADGDXG4Y3EWCQ3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QZD2AZOL7XLNZVAV6GDNXYU6MFRU5RS/
CVE ID: CVE-2022-24738 State: PUBLISHED Published: 2022-03-07T21:30:13.000Z Last Updated: 2025-04-23T18:58:57.669Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: tharsis Products: evmos Problem Types: CWE-287 Description: Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for t
an use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tharsis/evmos/security/advisories/GHSA-5jgq-x857-p8xw - https://github.com/tharsis/evmos/commit/28870258d4ee9f1b8aeef5eba891681f89348f71 - https://github.com/tharsis/evmos/releases/tag/v2.0.1
CVE ID: CVE-2022-24739 State: PUBLISHED Published: 2022-03-08T21:40:10.000Z Last Updated: 2025-04-23T18:56:39.899Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Rudloff Products: alltube Problem Types: CWE-601, CWE-918 Description: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for thi
the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Rudloff/alltube/security/advisories/GHSA-75p7-527p-w8wp - https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d - https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a - https://github.com/Rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
CVE ID: CVE-2022-24740 State: PUBLISHED Published: 2022-03-14T22:15:13.000Z Last Updated: 2025-04-23T18:54:04.442Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: plone Products: volto Problem Types: CWE-287 Description: Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not curren
ng an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild. The patch and fix is present in Volto 15.0.0-alpha.0. As a workaround, one may manually upgrade the `react-cookie` package to 4.1.1 and then override all Volto components that use this library. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/plone/volto/security/advisories/GHSA-cfhh-xgwq-5r67 - https://github.com/plone/volto/pull/3051
CVE ID: CVE-2022-24741 State: PUBLISHED Published: 2022-03-09T21:30:13.000Z Last Updated: 2025-04-22T18:19:11.324Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-400 Description: Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag. Ad
22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89 - https://github.com/nextcloud/server/pull/30291 - https://hackerone.com/reports/1261225 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2022-24742 State: PUBLISHED Published: 2022-03-14T19:20:10.000Z Last Updated: 2025-04-23T18:54:10.363Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Sylius Products: Sylius Problem Types: CWE-200 Description: Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, any other user can view the data if browser tab remains unclosed after log out. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. The application must strictly redirect to login page even browser back button is pressed. Another possibility is to set more strict cache policies for restricted content. Additional Anal
back button is pressed. Another possibility is to set more strict cache policies for restricted content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Sylius/Sylius/releases/tag/v1.10.11 - https://github.com/Sylius/Sylius/releases/tag/v1.11.2 - https://github.com/Sylius/Sylius/releases/tag/v1.9.10 - https://github.com/Sylius/Sylius/security/advisories/GHSA-7563-75j9-6h5p
CVE ID: CVE-2022-24743 State: PUBLISHED Published: 2022-03-14T21:00:14.000Z Last Updated: 2025-04-22T18:18:50.307Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: Sylius Products: Sylius Problem Types: CWE-613 Description: Sylius is an open source eCommerce platform. Prior to versions 1.10.11 and 1.11.2, the reset password token was not set to null after the password was changed. The same token could be used several times, which could result in leak of the existing token and unauthorized password change. The issue is fixed in versions 1.10.11 and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with cod
and 1.11.2. As a workaround, overwrite the `Sylius\Bundle\ApiBundle\CommandHandler\ResetPasswordHandler` class with code provided by the maintainers and register it in a container. More information about this workaround is available in the GitHub Security Advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Sylius/Sylius/releases/tag/v1.10.11 - https://github.com/Sylius/Sylius/releases/tag/v1.11.2 - https://github.com/Sylius/Sylius/security/advisories/GHSA-mf3v-f2qq-pf9g
CVE ID: CVE-2022-24744 State: PUBLISHED Published: 2022-03-09T22:25:33.000Z Last Updated: 2025-04-23T18:56:02.954Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: shopware Products: platform Problem Types: CWE-613 Description: Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
measures are also available via a plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-w267-m9c4-8555
CVE ID: CVE-2022-24745 State: PUBLISHED Published: 2022-03-09T22:25:28.000Z Last Updated: 2025-04-23T18:56:09.816Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: shopware Products: platform Problem Types: CWE-384 Description: Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared between customers when HTTP cache is enabled. This can lead to inconsistent experiences for guest users. Setups with Varnish are not affected by this issue. This issue has been resolved in version 6.4.8.2. Users unable to upgrade should disable the HTTP Cache. Additional Analyst Notes
ue has been resolved in version 6.4.8.2. Users unable to upgrade should disable the HTTP Cache. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-jp6h-mxhx-pgqh
CVE ID: CVE-2022-24746 State: PUBLISHED Published: 2022-03-09T22:25:23.000Z Last Updated: 2025-04-23T18:56:15.787Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: shopware Products: platform Problem Types: CWE-79 Description: Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-952p-fqc
Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-952p-fqcp-g8pc - https://github.com/shopware/platform/commit/651598a61073cbe59368e311817bdc6e7fb349c6 - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022
CVE ID: CVE-2022-24747 State: PUBLISHED Published: 2022-03-09T22:25:16.000Z Last Updated: 2025-04-23T18:56:21.421Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: shopware Products: platform Problem Types: CWE-200 Description: Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA
n resolved in version 6.4.8.2. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-6wrh-279j-6hvw - https://github.com/shopware/platform/commit/d51863148f32306aafdbc7f9f48887c69fce206f - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2022
CVE ID: CVE-2022-24748 State: PUBLISHED Published: 2022-03-09T22:25:09.000Z Last Updated: 2025-04-23T18:56:27.344Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: shopware Products: platform Problem Types: CWE-287 Description: Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgrade to version 6.4.8.2. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-83vp-6jqg-6cmr - https://github.com/shopware/core/commit/329e4d7e028dd8081496cf8bd3acc822000b0ec0
CVE ID: CVE-2022-24749 State: PUBLISHED Published: 2022-03-14T21:45:13.000Z Last Updated: 2025-04-22T18:18:36.653Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Sylius Products: Sylius Problem Types: CWE-80, CWE-434 Description: Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload an SVG file containing cross-site scripting (XSS) code in the admin panel. In order to perform a XSS attack, the file itself has to be open in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11,
blem applies both to the files opened on the admin panel and shop pages. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. As a workaround, require a library that adds on-upload file sanitization and overwrite the service before writing the file to the filesystem. The GitHub Security Advisory contains more specific information about the workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Sylius/Sylius/releases/tag/v1.10.11 - https://github.com/Sylius/Sylius/releases/tag/v1.11.2 - https://github.com/Sylius/Sylius/releases/tag/v1.9.10 - https://github.com/Sylius/Sylius/security/advisories/GHSA-4qrp-27r3-66fj
CVE ID: CVE-2022-24750 State: PUBLISHED Published: 2022-03-10T00:00:00.000Z Last Updated: 2025-04-23T18:55:50.634Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: ultravnc Products: UltraVNC Problem Types: CWE-269 Description: UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation (LPE) on a vulnerable system. The vulnerability has been fixed to allow loading of plugins from the installed directory. Affected users should upgrade their UltraVNC to 1.3.8.1. Users unable to upgrade should
s from the installed directory. Affected users should upgrade their UltraVNC to 1.3.8.1. Users unable to upgrade should not install and run UltraVNC server as a service. It is advisable to create a scheduled task on a low privilege account to launch WinVNC.exe instead. There are no known workarounds if winvnc needs to be started as a service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ultravnc/UltraVNC/security/advisories/GHSA-3mvp-cp5x-vj5g - https://github.com/ultravnc/UltraVNC/commit/36a31b37b98f70c1db0428f5ad83170d604fb352 - https://github.com/bowtiejicode/UltraVNC-DSMPlugin-LPE
CVE ID: CVE-2022-24751 State: PUBLISHED Published: 2022-03-16T13:30:15.000Z Last Updated: 2025-04-23T18:53:29.799Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: zulip Products: zulip Problem Types: CWE-362 Description: Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A patch is available in version 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading to a fixed version will, as a side effect, de
on 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading to a fixed version will, as a side effect, deactivate any cached sessions that may have been leaked through this bug. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-6v98-m5x5-phqj - https://github.com/zulip/zulip/commit/62ba8e455d8f460001d9fb486a6dabfd1ed67717 - https://github.com/zulip/zulip/commit/e6eace307ef435eec3395c99247155efed9219e4
CVE ID: CVE-2022-24752 State: PUBLISHED Published: 2022-03-15T14:40:13.000Z Last Updated: 2025-04-23T18:53:49.773Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sylius Products: SyliusGridBundle Problem Types: CWE-89 Description: SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sort
y. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Sylius/SyliusGridBundle/security/advisories/GHSA-2xmm-g482-4439 - https://github.com/Sylius/SyliusGridBundle/pull/222 - https://github.com/Sylius/SyliusGridBundle/commit/73d0791d0575f955e830a3da4c3345f420d2f784 - https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.10.1 - https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.
://github.com/Sylius/SyliusGridBundle/releases/tag/v1.10.1 - https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.11.0-RC.2
CVE ID: CVE-2022-24753 State: PUBLISHED Published: 2022-03-09T22:35:09.000Z Last Updated: 2025-04-23T18:55:56.607Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: stripe Products: stripe-cli Problem Types: CWE-78 Description: Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The
An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.Users are advised to upgrade to version 1.7.13. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stripe/stripe-cli/security/advisories/GHSA-4cx6-fj7j-pjx9 - https://github.com/stripe/stripe-cli/commit/be38da5c0191adb77f661f769ffff2fbc7ddf6cd
CVE ID: CVE-2022-24754 State: PUBLISHED Published: 2022-03-11T00:00:00.000Z Last Updated: 2025-11-04T16:09:35.777Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: pjsip Products: pjproject Problem Types: CWE-120 Description: PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrad
patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662 - https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://security.gentoo.org/glsa/202210-37 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2022-24755 State: PUBLISHED Published: 2022-03-15T14:35:13.000Z Last Updated: 2025-04-22T18:18:15.793Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: bareos Products: bareos Problem Types: CWE-863 Description: Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts with expired passwords can still login. This problem will affect users that have PAM enabled. Currently there is no authorization (e.g. check for