Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1000656 State: PUBLISHED Published: 2018-08-20T19:00:00 Last Updated: 2024-08-05T12:40:47.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20190221-0001/ - https://gith
st Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20190221-0001/ - https://github.com/pallets/flask/pull/2691 - https://github.com/pallets/flask/releases/tag/0.12.3 - https://lists.debian.org/debian-lts-announce/2019/08/msg00025.html - https://usn.ubuntu.com/4378-1/
CVE ID: CVE-2018-1000657 State: PUBLISHED Published: 2018-08-20T19:00:00 Last Updated: 2024-08-05T12:40:47.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in std::collections::vec_deque::VecDeque::reserve() function that can result in Arbitrary code execution, but no proof-of-concept exploit is currently published.. This vulnerability appears to have been fixed in after commit fdfafb510b1a38f727e920dccbeeb638d39a8e60; stable release 1.22.0 and later. Additional Analyst Notes: - CVE Program Co
it fdfafb510b1a38f727e920dccbeeb638d39a8e60; stable release 1.22.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rust-lang/rust/commit/f71b37bc28326e272a37b938e835d4f99113eec2 - http://www.securityfocus.com/bid/105188 - https://github.com/rust-lang/rust/issues/44800
CVE ID: CVE-2018-1000658 State: PUBLISHED Published: 2018-09-06T17:00:00Z Last Updated: 2024-09-16T23:16:07.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that can be called under certain circumstances. This vulnerability appears to have been fixed in after commit 91d143230eb357260a19c8424b3005deb49a47f7 / version 3.14.4. Additional Analyst Notes: - CVE Program Container: References: - http
0eb357260a19c8424b3005deb49a47f7 / version 3.14.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LimeSurvey/LimeSurvey/commit/91d143230eb357260a19c8424b3005deb49a47f7 - https://github.com/LimeSurvey/LimeSurvey/commit/20fc85edccc80e7e7f162613542792380c44446a
CVE ID: CVE-2018-1000659 State: PUBLISHED Published: 2018-09-06T17:00:00Z Last Updated: 2024-09-16T22:35:29.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upload functionality that can result in remote code execution as authenticated user. This attack appear to be exploitable via An authenticated user can upload a specially crafted zip file to get remote code execution. This vulnerability appears to have been fixed in after commit 72a02ebaaf95a80e26127ee7ee2b123cccce05a7 / version 3.14.4. Additional Analyst Notes: - CVE Program Container: R
r commit 72a02ebaaf95a80e26127ee7ee2b123cccce05a7 / version 3.14.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LimeSurvey/LimeSurvey/commit/72a02ebaaf95a80e26127ee7ee2b123cccce05a7
CVE ID: CVE-2018-1000660 State: PUBLISHED Published: 2018-09-06T17:00:00Z Last Updated: 2024-09-16T17:27:53.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vulnerability in Function get_package_name in the file kernel/src/tbfheader.rs, variable "pub package_name: &'static str," in the file process.rs that can result in A tock capsule (untrusted driver) could access arbitrary memory by using only safe code. This vulnerability appears to have been fixed in commit 42f7f36e74088036068d62253e1d8fb26605feed. Additional Analyst N
. This vulnerability appears to have been fixed in commit 42f7f36e74088036068d62253e1d8fb26605feed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tock/tock/issues/1147
CVE ID: CVE-2018-1000661 State: PUBLISHED Published: 2018-09-06T17:00:00Z Last Updated: 2024-09-17T03:58:46.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: jsish version 2.4.67 contains a CWE-476: NULL Pointer Dereference vulnerability in Jsi_LogMsg (jsiUtils.c:196) that can result in Crash due to segmentation fault. This attack appear to be exploitable via the victim executing specially crafted javascript code. This vulnerability appears to have been fixed in 2.4.69. Additional Analyst Notes: - CVE Program Container: References: - https://jsish.org/fossil/jsi/tktview/2adeb066894695b38309d92771aea11c8e0a56a8
CVE ID: CVE-2018-1000662 State: REJECTED Published: 2018-09-05T06:00:00Z Last Updated: 2024-09-16T23:16:56.298Z Description: No description available.
CVE ID: CVE-2018-1000663 State: PUBLISHED Published: 2018-09-06T17:00:00Z Last Updated: 2024-09-16T22:46:48.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: jsish version 2.4.70 2.047 contains a Buffer Overflow vulnerability in function _jsi_evalcode from jsiEval.c that can result in Crash due to segmentation fault. This attack appear to be exploitable via The victim must execute crafted javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://jsish.org/fossil/jsi/tktview/c253f6d80c9018d841e857b69e7ad6436ed95cb9
CVE ID: CVE-2018-1000664 State: PUBLISHED Published: 2018-09-06T17:00:00Z Last Updated: 2024-09-17T03:48:23.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: daneren2005 DSub for Subsonic (Android client) version 5.4.1 contains a CWE-295: Improper Certificate Validation vulnerability in HTTPS Client that can result in Any non-CA signed server certificate, including self signed and expired, are accepted by the client. This attack appear to be exploitable via The victim connects to a server that's MITM/Proxied by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daneren2005/Subsonic/issues/60
CVE ID: CVE-2018-1000665 State: PUBLISHED Published: 2018-09-06T17:00:00Z Last Updated: 2024-09-17T01:00:37.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliver malware, steal HTTP cookies, bypass CORS trust. This attack appear to be exploitable via Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploi
ypically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. This vulnerability appears to have been fixed in 1.14. Additional Analyst Notes: - CVE Program Container: References: - https://dojotoolkit.org/blog/dojo-1-14-released - https://github.com/dojo/dojo/pull/307
CVE ID: CVE-2018-1000666 State: PUBLISHED Published: 2018-09-06T17:00:00 Last Updated: 2024-08-05T12:40:47.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: notifySpaceModification; that can result in Improper validation of parameters results in command execution. This attack appear to be exploitable via Network connectivity, required minimal auth privileges (everyone can register an account). This vulnerability appears to have been fixed in After
uired minimal auth privileges (everyone can register an account). This vulnerability appears to have been fixed in After commit 15443122ed2b1cbfd7bdefc048bf106f075becdb. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca - https://github.com/jumpscale7/jumpscale_portal/pull/108 - https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315 - https://github.com/0-complexity/openvcloud/issues/1207 - https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23
CVE ID: CVE-2018-1000667 State: PUBLISHED Published: 2018-09-06T17:00:00 Last Updated: 2024-08-05T12:40:47.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: NASM nasm-2.13.03 nasm- 2.14rc15 version 2.14rc15 and earlier contains a memory corruption (crashed) of nasm when handling a crafted file due to function assemble_file(inname, depend_ptr) at asm/nasm.c:482. vulnerability in function assemble_file(inname, depend_ptr) at asm/nasm.c:482. that can result in aborting/crash nasm program. This attack appear to be exploitable via a specially crafted asm file.. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cyrillos/nasm/issues/3 - https://bugzil
itional Analyst Notes: - CVE Program Container: References: - https://github.com/cyrillos/nasm/issues/3 - https://bugzilla.nasm.us/show_bug.cgi?id=3392507 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html
CVE ID: CVE-2018-1000668 State: PUBLISHED Published: 2018-09-06T17:00:00Z Last Updated: 2024-09-17T04:09:38.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: jsish version 2.4.70 2.047 contains a CWE-125: Out-of-bounds Read vulnerability in function jsi_ObjArrayLookup (jsiObj.c:274) that can result in Crash due to segmentation fault. This attack appear to be exploitable via The victim must execute crafted javascript code. This vulnerability appears to have been fixed in 2.4.71. Additional Analyst Notes: - CVE Program Container: References: - https://jsish.org/fossil/jsi/tktview?name=9602dbd997
CVE ID: CVE-2018-1000669 State: PUBLISHED Published: 2018-09-06T19:00:00Z Last Updated: 2024-09-16T23:46:44.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments as paid for certain users on behalf of Administrators. This attack appear to be exploitable via The victim must be socially engineered into clicking a link, usually via email. This vulnerability appears to have been fixed in 1
must be socially engineered into clicking a link, usually via email. This vulnerability appears to have been fixed in 17.11. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19117
CVE ID: CVE-2018-1000670 State: PUBLISHED Published: 2018-09-06T19:00:00Z Last Updated: 2024-09-16T16:18:56.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability in Multiple fields on multiple pages including /cgi-bin/koha/acqui/supplier.pl?op=enter , /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number] , /cgi-bin/koha/serials/subscription-add.pl that can result in Privilege escalation by taking control of higher privileged users browser sessions. This attack appear to be exploitable via Victims must be socially engineered to visit a vulne
ed users browser sessions. This attack appear to be exploitable via Victims must be socially engineered to visit a vulnerable webpage containing malicious payload. This vulnerability appears to have been fixed in 17.11. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19086
CVE ID: CVE-2018-1000671 State: PUBLISHED Published: 2018-09-06T18:00:00 Last Updated: 2024-08-05T12:40:47.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sympa-community/sympa/issues/26
ble. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sympa-community/sympa/issues/268 - https://lists.debian.org/debian-lts-announce/2018/09/msg00023.html - https://usn.ubuntu.com/4442-1/ - https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html
CVE ID: CVE-2018-1000672 State: REJECTED Published: 2018-09-05T06:00:00Z Last Updated: 2024-09-17T04:20:45.370Z Description: No description available.
CVE ID: CVE-2018-1000673 State: REJECTED Published: 2018-09-06T12:00:00 Last Updated: 2018-09-06T15:57:01 Description: No description available.
CVE ID: CVE-2018-1000773 State: PUBLISHED Published: 2018-09-06T16:00:00 Last Updated: 2024-08-05T12:40:47.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/GePBmsNJw6Y?t=1763 - https://www.theregister.co.uk/2018/
Notes: - CVE Program Container: References: - https://youtu.be/GePBmsNJw6Y?t=1763 - https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln/ - http://www.securityfocus.com/bid/105306
CVE ID: CVE-2018-1000800 State: PUBLISHED Published: 2018-09-06T17:00:00Z Last Updated: 2024-09-17T01:31:49.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs (system sys_ring_buf_get() and sys_ring_buf_put). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zephyrproject-rtos/zephyr/issues/7638
CVE ID: CVE-2018-1000801 State: PUBLISHED Published: 2018-09-06T18:00:00 Last Updated: 2024-08-05T12:40:47.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1 Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00027.html - https://cgit.kde.org/okular
ontainer: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00027.html - https://cgit.kde.org/okular.git/commit/?id=8ff7abc14d41906ad978b6bc67e69693863b9d47 - https://security.gentoo.org/glsa/201811-08 - https://bugs.kde.org/show_bug.cgi?id=398096 - https://www.debian.org/security/2018/dsa-4303
CVE ID: CVE-2018-1000802 State: PUBLISHED Published: 2018-09-18T00:00:00 Last Updated: 2024-08-05T12:40:47.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace. A
the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4306 - https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html - https://usn.ubuntu.com/3817-2/ - https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace - https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig - https://github.com/python/cpython/pull/8985 - https://usn.ubuntu.com/3817-1/ - https://bugs.python.org/issue34540 - https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html - http://li
1/ - https://bugs.python.org/issue34540 - https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html - https://security.netapp.com/advisory/ntap-20230309-0002/
CVE ID: CVE-2018-1000803 State: PUBLISHED Published: 2018-10-08T15:00:00Z Last Updated: 2024-09-16T20:36:30.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/go-gitea/gitea/pull/4664/files#diff-146e0c2b5bb1ea96c9fb73d509456e57 - http
Container: References: - https://github.com/go-gitea/gitea/pull/4664/files#diff-146e0c2b5bb1ea96c9fb73d509456e57 - https://github.com/go-gitea/gitea/pull/4664
CVE ID: CVE-2018-1000804 State: PUBLISHED Published: 2018-10-08T15:00:00Z Last Updated: 2024-09-16T16:42:43.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker can perform Remote Code Execution on device using Contiki-NG operating system. This attack appear to be exploitable via Attacker must be able to run malicious AQL code (e.g. via SQL-like Injection attack). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/issues/594 - https://github.com/contiki-ng/contiki-ng/pull/624
CVE ID: CVE-2018-1000805 State: PUBLISHED Published: 2018-10-08T15:00:00 Last Updated: 2024-08-05T12:40:47.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3347 - https://access.redhat.com/errata/RHSA-2018:3406 - https://github.com/paramiko/paramiko/issues/1283 - https://usn.ubuntu.com/3796-3/ - https://access.redhat.com/errata/RHSA-2018:3505 - https://list
o/paramiko/issues/1283 - https://usn.ubuntu.com/3796-3/ - https://access.redhat.com/errata/RHSA-2018:3505 - https://lists.debian.org/debian-lts-announce/2018/10/msg00018.html - https://access.redhat.com/errata/RHBA-2018:3497 - https://usn.ubuntu.com/3796-2/ - https://usn.ubuntu.com/3796-1/ - https://herolab.usd.de/wp-content/uploads/sites/4/usd20180023.txt - https://lists.debian.org/debian-lts-announce/2021/12/msg00025.html
CVE ID: CVE-2018-1000806 State: REJECTED Published: 2018-10-06T15:00:00Z Last Updated: 2024-09-17T03:55:06.324Z Description: No description available.
CVE ID: CVE-2018-1000807 State: PUBLISHED Published: 2018-10-08T00:00:00 Last Updated: 2024-08-05T12:47:56.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pyca/pyopenssl/pull/
ixed in 17.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pyca/pyopenssl/pull/723 - https://access.redhat.com/errata/RHSA-2019:0085 - https://usn.ubuntu.com/3813-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html - https://github.com/pyca/pyopenssl/commit/e73818600065821d588af475b024f4eb518c3509
CVE ID: CVE-2018-1000808 State: PUBLISHED Published: 2018-10-08T15:00:00 Last Updated: 2024-08-05T12:47:57.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed i
e the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pyca/pyopenssl/pull/723 - https://access.redhat.com/errata/RHSA-2019:0085 - https://usn.ubuntu.com/3813-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html
CVE ID: CVE-2018-1000809 State: PUBLISHED Published: 2018-10-08T15:00:00Z Last Updated: 2024-09-16T23:15:58.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/privacyidea/privacyidea/commit/a3edc09beffa2104f357fe24971ea3211ce40751 - https://github.com/privacyidea/privacyidea/issues/1227