Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/ - https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6 - https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4
CVE ID: CVE-2022-36077 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-04-23T16:40:13.698Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: electron Products: electron Problem Types: CWE-522, CWE-200 Description: The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the red
RLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround. Additional Analyst Notes
le:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2v
CVE ID: CVE-2022-36078 State: PUBLISHED Published: 2022-09-02T12:15:14.000Z Last Updated: 2025-04-22T17:40:53.728Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gagliardetto Products: binary Problem Types: CWE-789 Description: Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices in memory with (arbitrary) excessive size value, which can either exhaust available memory or crash the whole program. When using `github.com/gagliardetto/binary` to parse unchecked (or wrong type of) data from untrusted sources of input (e.g. the blockchain) into slices, it's pos
` to parse unchecked (or wrong type of) data from untrusted sources of input (e.g. the blockchain) into slices, it's possible to allocate memory with excessive size. When `dec.Decode(&val)` method is used to parse data into a structure that is or contains slices of values, the length of the slice was previously read directly from the data itself without any checks on the size of it, and then a slice was allocated. This could lead to an overflow and an allocation of memory with excessive size value. Users should upgrade to `v0.7.1` or higher. A workaround is not to rely on the `dec.Decode(&val)` function to parse the data, but to use a custom `UnmarshalWithDecoder()` method that reads and che
he `dec.Decode(&val)` function to parse the data, but to use a custom `UnmarshalWithDecoder()` method that reads and checks the length of any slice. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gagliardetto/binary/security/advisories/GHSA-4p6f-m4f9-ch88 - https://github.com/gagliardetto/binary/pull/7 - https://github.com/gagliardetto/binary/releases/tag/v0.7.1
CVE ID: CVE-2022-36079 State: PUBLISHED Published: 2022-09-07T20:40:13.000Z Last Updated: 2025-04-23T17:13:55.464Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-200 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (user defined) can be used as query constraints. Internal and protected fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by
e only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server, prior to versions 4.10.14 or 5.2.5, returns a response object. The patch available in versions 4.10.14 and 5.2.5 requires the maser key to use internal and protected fields as query constraints. As a workaround, implement a Parse Cloud Trigger `beforeFind` and manually remove the query constraints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-2m6g-crv8-p3c6 - https://github.com/parse-community/parse-server/issues/8143 - https
rse-server/security/advisories/GHSA-2m6g-crv8-p3c6 - https://github.com/parse-community/parse-server/issues/8143 - https://github.com/parse-community/parse-server/issues/8144 - https://github.com/parse-community/parse-server/commit/634c44acd18f6ee6ec60fac89a2b602d92799bec - https://github.com/parse-community/parse-server/commit/e39d51bd329cd978589983bd659db46e1d45aad4 - https://github.com/parse-community/parse-server/releases/tag/4.10.14 - https://github.com/parse-community/parse-server/releases/tag/5.2.5
CVE ID: CVE-2022-36080 State: PUBLISHED Published: 2022-09-07T21:00:18.000Z Last Updated: 2025-04-23T17:13:36.748Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Linbreux Products: wikmd Problem Types: CWE-79 Description: Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, an attacker could capture user's session cookies or execute malicious Javascript when a victim edits a markdown file. Version 1.7.1 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Linbreux/wikmd/security/advisories/GHSA-9m4m-6gqx-gfj3 - https://github.com/Linbreux/wikmd/commit/259412c47d64d5b
ub.com/Linbreux/wikmd/security/advisories/GHSA-9m4m-6gqx-gfj3 - https://github.com/Linbreux/wikmd/commit/259412c47d64d5b85980f95345179fbf05927798
CVE ID: CVE-2022-36081 State: PUBLISHED Published: 2022-09-07T21:00:13.000Z Last Updated: 2025-04-23T17:13:43.244Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Linbreux Products: wikmd Problem Types: CWE-23, CWE-22 Description: Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Linbreux/wikmd/security/advisories/GHSA-w4cf-92x9-v8w2 - https://gith
ADP Vulnrichment: References: - https://github.com/Linbreux/wikmd/security/advisories/GHSA-w4cf-92x9-v8w2 - https://github.com/Linbreux/wikmd/commit/8d1f94ec86b5b6c3df8ef10051facfb511a78450
CVE ID: CVE-2022-36082 State: PUBLISHED Published: 2022-09-07T21:35:09.000Z Last Updated: 2025-04-23T17:13:31.228Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mansuf Products: mangadex-downloader Problem Types: CWE-20 Description: mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http, https), mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
.7.2 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mansuf/mangadex-downloader/security/advisories/GHSA-r9x7-2xmr-v8fw - https://github.com/mansuf/mangadex-downloader/commit/439cc2825198ebc12b3310c95c39a8c7710c9b42
CVE ID: CVE-2022-36083 State: PUBLISHED Published: 2022-09-07T21:55:09.000Z Last Updated: 2025-04-22T17:23:31.988Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: panva Products: jose Problem Types: CWE-400 Description: JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down th
s must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. Under certain conditions, it is possible to have the user's environment consume unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric
me unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `algorithms` in v1.x) decryption option or through other means. The `v1.28.2`, `v2.0.6`, `v3.20.4`, and `v4.9.2` releases limit the maximum PBKDF2 iteration count to `10000` by default. It is possible to adjust this limit with a newly introduced `maxPBES2Count` decryption option. If users are unable to upgrade their required library version, they have two options depending on whether they expect to recei
rs are unable to upgrade their required library version, they have two options depending on whether they expect to receive JWEs using any of the three PBKDF2-based JWE key management algorithms. They can use the `keyManagementAlgorithms` decryption option to disable accepting PBKDF2 altogether, or they can inspect the JOSE Header prior to using the decryption API and limit the PBKDF2 iteration count (`p2c` Header Parameter). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/panva/jose/security/advisories/GHSA-jv3g-j58f-9mq9 - https://github.com/panva/jose/commit/03d6d013bf6e070e85adfe5731f526978e3e8e4d - https://github.com/panva/jose
58f-9mq9 - https://github.com/panva/jose/commit/03d6d013bf6e070e85adfe5731f526978e3e8e4d - https://github.com/panva/jose/releases/tag/v4.9.2
CVE ID: CVE-2022-36084 State: PUBLISHED Published: 2022-09-08T21:15:13.000Z Last Updated: 2025-04-23T17:12:43.338Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: AEB-labs Products: cruddl Problem Types: CWE-943, CWE-74 Description: cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attac
will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AEB-labs/cruddl/security/advisories/GHSA-qm4w-4995-vg7f - https://github.com/AEB-labs/cruddl/pull/253 - https://github.com/AEB-labs/cruddl/commit/13b9233733ed6fc822718a07bc90a80cd3492698
CVE ID: CVE-2022-36085 State: PUBLISHED Published: 2022-09-08T13:30:16.000Z Last Updated: 2025-04-22T17:23:14.762Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: open-policy-agent Products: opa Problem Types: CWE-693, CWE-20 Description: Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in fu
lation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr - https://github.com/open-policy-agent/opa/pull/4540 - https://github.com/open-policy
ity/advisories/GHSA-f524-rf33-2jjr - https://github.com/open-policy-agent/opa/pull/4540 - https://github.com/open-policy-agent/opa/pull/4616 - https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823 - https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8 - https://github.com/open-policy-agent/opa/releases/tag/v0.43.1
CVE ID: CVE-2022-36086 State: PUBLISHED Published: 2022-09-07T22:50:09.000Z Last Updated: 2025-04-22T17:23:22.210Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: rust-osdev Products: linked-list-allocator Problem Types: CWE-119, CWE-787 Description: linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap`
usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::<usize>` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::<usize>()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::<usize>()`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
(and stays) a multiple of `2 * size_of::<usize>()`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rust-osdev/linked-list-allocator/security/advisories/GHSA-xg8p-34w2-j49j - https://github.com/rust-osdev/linked-list-allocator/commit/013b0758643943e8df5b17bbb495460ff47e8bbf
CVE ID: CVE-2022-36087 State: PUBLISHED Published: 2022-09-09T00:00:00.000Z Last Updated: 2025-04-22T17:22:22.677Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: oauthlib Products: oauthlib Problem Types: CWE-20 Description: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There a
h2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7 - https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd - https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py - https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 - https://github.com/oauthlib/oauthlib/releases/tag/v3.2.
98cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 - https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRYLYHE5HWF6R2CRLJFUK4PILR47WXOE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2CQZM5CKOUM4GW2GTAPQEQFPITQ6F7S/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBCQJR3ZF7FVNTJYRVPVSQEQRAYZIUHU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXOPIA6M57CFQPUT6HHSNXCTV6QA3UDI/
CVE ID: CVE-2022-36088 State: PUBLISHED Published: 2022-09-07T22:55:10.000Z Last Updated: 2025-04-23T17:13:25.278Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: gocd Products: gocd Problem Types: CWE-284, CWE-269 Description: GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or Agent are installed on to modify executables or components of the installation. This does not affect zip file-based installs, installations to o
o modify executables or components of the installation. This does not affect zip file-based installs, installations to other platforms, or installations inside `Program Files` or `Program Files (x86)`. This issue is fixed in GoCD 22.2.0 installers. As a workaround, if the server or agent is installed outside of `Program Files (x86)`, verify the the permission of the Server or Agent installation directory to ensure the `Everyone` user group does not have `Full Control`, `Modify` or `Write` permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gocd/gocd/security/advisories/GHSA-gpv4-xqhc-5vcj - https://github.com/gocd/gocd/com
t: References: - https://github.com/gocd/gocd/security/advisories/GHSA-gpv4-xqhc-5vcj - https://github.com/gocd/gocd/commit/96add9605096ab50c5cd4c229be1d503aff506a6 - https://github.com/gocd/gocd/releases/tag/22.2.0 - https://www.gocd.org/releases/#22-2-0
CVE ID: CVE-2022-36089 State: PUBLISHED Published: 2022-09-07T23:00:15.000Z Last Updated: 2025-04-23T17:13:19.449Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: kubevela Products: kubevela Problem Types: CWE-294 Description: KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to generate the JWT tokens for users. Another API called `getSystemInfo` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass
o` exposes the platformID. This vulnerability allows users to use the platformID to re-generate the JWT tokens to bypass the authentication. Versions 1.4.11 and 1.5.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubevela/kubevela/security/advisories/GHSA-cq42-w295-r29q - https://github.com/kubevela/kubevela/pull/4634
CVE ID: CVE-2022-36090 State: PUBLISHED Published: 2022-09-08T14:45:13.000Z Last Updated: 2025-04-22T17:23:08.040Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-285 Description: XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a check for inactive (not yet activated or disabled) users in XWiki, including the REST service. This means a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default, so an inactive user could
l. On the same way some resources handler created by extensions are not protected by default, so an inactive user could perform actions for such extensions. This issue has existed since at least version 1.1 of XWiki for instance configured with the email activation required for new users. Now it's more critical for versions 11.3-rc-1 and later since the maintainers provided the capability to disable user without deleting them and encouraged using that feature. XWiki 14.3-rc-1 and XWiki 13.10.5 contain a patch. There is no workaround for this other than upgrading XWiki. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-pla
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jgc8-gvcx-9vfx - https://github.com/xwiki/xwiki-platform/commit/e074d226d9b2b96a0a1ba4349d1b73a802842986 - https://jira.xwiki.org/browse/XWIKI-19559
CVE ID: CVE-2022-36091 State: PUBLISHED Published: 2022-09-08T16:10:09.000Z Last Updated: 2025-04-23T17:13:13.134Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-862, CWE-359 Description: XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 and 14.2. This includes private personal information like email addresses and salted password hashes of registered users but also other information stored in properties of objects. Sensitive c