Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e this template engine. This can lead to various consequences, including session hijacking, defacement of web pages, theft of sensitive information, or even the propagation of malware. Version 1.0.1 contains a patch for this issue. To mitigate this vulnerability, the template engine should properly escape special characters, including single quotes. Common practice is to escape `'` as `&#39`. As a workaround, users can avoid this issue by using only double quotes `"` for HTML attributes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jstachio/jstachio/security/advisories/GHSA-gwxv-jv83-6qjr - https://github.com/jstachio/jstachio/i
- https://github.com/jstachio/jstachio/security/advisories/GHSA-gwxv-jv83-6qjr - https://github.com/jstachio/jstachio/issues/157 - https://github.com/jstachio/jstachio/pull/158 - https://github.com/jstachio/jstachio/commit/7b2f78377d1284df14c580be762a25af5f8dcd66 - https://github.com/jstachio/jstachio/releases/tag/v1.0.1
CVE ID: CVE-2023-33963 State: PUBLISHED Published: 2023-06-01T15:09:14.264Z Last Updated: 2025-01-08T21:47:50.821Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dataease Products: dataease Problem Types: CWE-502 Description: DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/secur
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dataease/dataease/security/advisories/GHSA-m26j-gh4m-xh9f - https://github.com/dataease/dataease/releases/tag/v1.18.7
CVE ID: CVE-2023-33964 State: PUBLISHED Published: 2023-05-31T17:07:21.667Z Last Updated: 2025-01-09T20:24:41.606Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: multiversx Products: mx-chain-go Problem Types: CWE-20 Description: mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would
processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch in version 1.4.16 introduces `processIfTxErrorCrossShard` for the metachain transaction processor. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/multiversx/mx-chain-go/security/advisories/GHSA-7xpv-4pm9-xch2 - https://github.com/multiversx/mx-chain-go/commit/97295471465f4b5f79e51b32f8b7111f8d921606
CVE ID: CVE-2023-33965 State: PUBLISHED Published: 2023-06-01T14:10:54.644Z Last Updated: 2025-01-09T16:57:06.896Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: txthinking Products: brook Problem Types: CWE-78 Description: Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local `tproxy` service leading to remote code execution. A patch is available in version 20230606. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/txthinking/
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/txthinking/brook/security/advisories/GHSA-vfrj-fv6p-3cpf - https://github.com/txthinking/brook/commit/314d7070c37babf6c38a0fe1eada872bb74bf03e
CVE ID: CVE-2023-33966 State: PUBLISHED Published: 2023-05-31T17:15:13.791Z Last Updated: 2025-01-09T20:24:06.794Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: denoland Products: deno Problem Types: CWE-269 Description: Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This proble
vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f - https://github.com/denoland/deno/releases/tag/v1.34.1
CVE ID: CVE-2023-33967 State: PUBLISHED Published: 2023-05-31T17:18:38.317Z Last Updated: 2025-01-09T18:39:23.791Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: megaease Products: easeprobe Problem Types: CWE-89 Description: EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/megaease/easeprobe/security/advisories/GHSA-4c32-w6c7-77x4 - https://github.com/megaease/easeprobe/pull/330 - https://github.com/m
aseprobe/security/advisories/GHSA-4c32-w6c7-77x4 - https://github.com/megaease/easeprobe/pull/330 - https://github.com/megaease/easeprobe/commit/caaf5860df2aaa76acd29bc40ec9a578d0b1d6e1 - https://github.com/megaease/easeprobe/releases/tag/v2.1.0
CVE ID: CVE-2023-33968 State: PUBLISHED Published: 2023-06-05T19:49:17.550Z Last Updated: 2025-01-08T16:02:26.334Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-862 Description: Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks to any project within the software, even if they have not been invited or the project is personal. The vulnerable features are `Duplicate to project` and `Move to project`, which both utilize the `chec
ject is personal. The vulnerable features are `Duplicate to project` and `Move to project`, which both utilize the `checkDestinationProjectValues()` function to check his values. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-gf8r-4p6m-v8vr - https://github.com/kanboard/kanboard/commit/c20be8f5fa26e54005a90c645e80b11481a65053
CVE ID: CVE-2023-33969 State: PUBLISHED Published: 2023-06-05T19:57:11.800Z Last Updated: 2025-01-08T16:00:50.616Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-79 Description: Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an attacker to execute arbitrary Javascript and any user who views the task containing the malicious code will be exposed to the XSS attack. Note: The default CSP header configuration blocks this javascript attack. This issue has been addressed in version 1.2.30. Users are advised to upgrade. Users unabl
locks this javascript attack. This issue has been addressed in version 1.2.30. Users are advised to upgrade. Users unable to upgrade should ensure that they have a restrictive CSP header config. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-8qvf-9847-gpc9 - https://github.com/kanboard/kanboard/commit/05f1d23d821152cd61536d3b09e522c0f7573e3c
CVE ID: CVE-2023-33970 State: PUBLISHED Published: 2023-06-05T19:54:38.686Z Last Updated: 2025-01-08T16:01:46.073Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: kanboard Products: kanboard Problem Types: CWE-862 Description: Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, which allows a User with the lowest privileges to leak all the tasks and projects titles within the software, even if they are not invited or it's a personal project. This could also lead to private/critical information being leaked if such information is in the title. This issue h
ect. This could also lead to private/critical information being leaked if such information is in the title. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-wfch-8rhv-v286 - https://github.com/kanboard/kanboard/commit/b501ef44bc28ee9cf603a4fa446ee121d66f652f
CVE ID: CVE-2023-33971 State: PUBLISHED Published: 2023-05-31T17:56:18.413Z Last Updated: 2025-01-09T20:20:40.283Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pluginsGLPI Products: formcreator Problem Types: CWE-79 Description: Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probable stored cross-site scripting vulnerability is present in Formcreator 2.13.5 and prior via the use of the use of `##FULLFORM##` for rendering. This could result in arbitrary javascript code execution in an admin/tech context. A patch is unavailable as of time of publication. As a workaround, o
javascript code execution in an admin/tech context. A patch is unavailable as of time of publication. As a workaround, one may use a regular expression to remove `< > "` in all fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pluginsGLPI/formcreator/security/advisories/GHSA-777g-3848-8r3g
CVE ID: CVE-2023-33972 State: PUBLISHED Published: 2023-09-27T18:15:18.162Z Last Updated: 2024-09-23T19:08:40.769Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: scylladb Products: scylladb Problem Types: CWE-269 Description: Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of o
. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/scylladb/scylladb/security/advisories/GHSA-ww5v-p45p-3vhq
CVE ID: CVE-2023-33973 State: PUBLISHED Published: 2023-05-30T16:18:04.163Z Last Updated: 2025-01-10T16:54:29.703Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: RIOT-OS Products: RIOT Problem Types: CWE-476 Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send a crafted frame which is forwarded by the device. During encoding of the packet a NULL pointer dereference occurs. This crashes the device leading to denial of service. A patch is available at pull request 19678. There are no known workarounds. Additional An
leading to denial of service. A patch is available at pull request 19678. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-r2pv-3jqc-vh7w - https://github.com/RIOT-OS/RIOT/pull/19678 - https://github.com/RIOT-OS/RIOT/commit/c9d7863e5664a169035038628029bb07e090c5ff - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1067 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1495 - ht
blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1495 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1511 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1644 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L1655
CVE ID: CVE-2023-33974 State: PUBLISHED Published: 2023-05-30T16:50:06.211Z Last Updated: 2025-01-10T16:53:57.110Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: RIOT-OS Products: RIOT Problem Types: CWE-362 Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device to trigger a race condition. The race condition invalidates assumptions about the program state and leads to an invalid memory access resulting in denial of service. This issue is patched in pull request 19679. There are
leads to an invalid memory access resulting in denial of service. This issue is patched in pull request 19679. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-8m3w-mphf-wxm8 - https://github.com/RIOT-OS/RIOT/pull/19679 - https://github.com/RIOT-OS/RIOT/commit/31c6191f6196f1a05c9765cffeadba868e3b0723 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L1717 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/six
r.c#L1717 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L509 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L617 - https://github.com/RIOT-OS/RIOT/blob/master/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L1586 - https://github.com/RIOT-OS/RIOT/blob/master/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L404
CVE ID: CVE-2023-33975 State: PUBLISHED Published: 2023-05-30T17:08:41.903Z Last Updated: 2025-01-10T16:53:00.824Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RIOT-OS Products: RIOT Problem Types: CWE-119, CWE-787 Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully mani
her packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. This issue is fixed in pull request 19680. As a workaround, disable support for fragmented IP datagrams. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-f6ff-g7mh-58q4 - https://github.com/RIOT-OS/RIOT/pull/19680 - https://github.com/RIOT-OS/RIOT/commit/1aeb90ee5555ae78b567a6365ae4ab71bfd1404b - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6a
thub.com/RIOT-OS/RIOT/commit/1aeb90ee5555ae78b567a6365ae4ab71bfd1404b - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L320 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L388 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L463 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L467 - https://
67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L467 - https://github.com/RIOT-OS/RIOT/blob/f41b4b67b6affca0a8b32edced7f51088696869a/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L480
CVE ID: CVE-2023-33976 State: PUBLISHED Published: 2024-07-30T19:27:14.532Z Last Updated: 2024-08-02T15:54:14.208Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-190 Description: TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gjh7-xx4r-x345 - https://github.com
ner: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gjh7-xx4r-x345 - https://github.com/tensorflow/tensorflow/commit/6fa05df43b00038b048f4f0e51ef522da6532fec - https://github.com/tensorflow/tensorflow/commit/915884fdf5df34aaedd00fc6ace33a2cfdefa586
CVE ID: CVE-2023-33977 State: PUBLISHED Published: 2023-06-06T18:03:18.882Z Last Updated: 2025-01-07T18:30:30.909Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: kiwitcms Products: Kiwi Problem Types: CWE-79 Description: Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the pos
definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. This issue has been addressed in version 12.4. Users are advised to upgrade. Users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy should make sure that additional header values are still passed to the client browser. If they aren't redefining them inside the pr
sure that additional header values are still passed to the client browser. If they aren't redefining them inside the proxy configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2fqm-m4r2-fh98 - https://github.com/kiwitcms/Kiwi/commit/d789f4b51025de4f8c747c037d02e1b0da80b034 - https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68 - https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87 - https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96/
CVE ID: CVE-2023-33979 State: PUBLISHED Published: 2023-05-31T18:03:25.468Z Last Updated: 2025-01-09T19:51:39.844Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: binary-husky Products: gpt_academic Problem Types: CWE-200 Description: gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to information disclosure. Since no sensitive files are configured to be off-limits, sensitive information files in some working directories can be read through the `/file` route,
igured to be off-limits, sensitive information files in some working directories can be read through the `/file` route, leading to sensitive information leakage. This affects users that uses file configurations via `config.py`, `config_private.py`, `Dockerfile`. A patch is available at commit 1dcc2873d2168ad2d3d70afcb453ac1695fbdf02. As a workaround, one may use environment variables instead of `config*.py` files to configure this project, or use docker-compose installation to configure this project. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g - https://github.co
: References: - https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g - https://github.com/binary-husky/gpt_academic/commit/1dcc2873d2168ad2d3d70afcb453ac1695fbdf02
CVE ID: CVE-2023-33980 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2025-01-16T15:56:23.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service (repeated application crashes) via a series of long messages to a contact. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://briarproject.org/news/2023-three-security-issues-found-and-fixed/ - https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf
CVE ID: CVE-2023-33981 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2025-01-16T15:51:06.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofed message would need to be an exact duplicate of a legitimate message displayed alongside the spoofed one. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://briarproject.org/news/2023-three-security-issues-found-and-fixed/ - https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_YuanmingSong.pdf