Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-wx5m-cj97-4wwg - https://github.com/pjsip/pjproject/commit/d2acb9af4e27b5ba75d658690406cec9c274c5cc - https://security.gentoo.org/glsa/202210-37 - https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html - https://www.debian.org/security/2023/dsa-5358
CVE ID: CVE-2022-39270 State: PUBLISHED Published: 2022-10-06T00:00:00.000Z Last Updated: 2025-04-23T16:52:41.608Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: discourse Products: DiscoTOC Problem Types: CWE-79 Description: DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories (and have sufficient trust level - configured in component's settings) are able to inject arbitrary HTML on that topic's page. The issue has been fixed on the `main` branch. Admins can update the theme component through the admin UI (Customize -> Themes -> Components -> DiscoTOC -> Check for Upda
ins can update the theme component through the admin UI (Customize -> Themes -> Components -> DiscoTOC -> Check for Updates). Alternatively, admins can temporarily disable the DiscoTOC theme component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/DiscoTOC/security/advisories/GHSA-m44p-w923-w32h - https://github.com/discourse/DiscoTOC/commit/f80c215a283cd045d2a371403e6eba88b2911192
CVE ID: CVE-2022-39271 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-04-23T16:51:43.774Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: traefik Products: traefik Problem Types: CWE-400 Description: Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no kno
o cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/traefik/traefik/security/advisories/GHSA-c6hx-pjc3-7fqr - https://github.com/traefik/traefik/releases/tag/v2.8.8 - https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5
CVE ID: CVE-2022-39272 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-04-23T16:45:22.608Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: fluxcd Products: flux2 Problem Types: CWE-1284 Description: Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched i
structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fluxcd/flux2/security/advisories/GHSA-f4p5-x4vc-mh4v - https://github.com/kubernetes/apimachinery/issues/131
CVE ID: CVE-2022-39273 State: PUBLISHED Published: 2022-10-06T00:00:00.000Z Last Updated: 2025-04-23T16:52:33.820Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: flyteorg Products: flyteadmin Problem Types: CWE-798 Description: FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication easier for Flyte administrators, the default configuration for Flyte Admin allows access for Flyte Propeller even after turning on authentication via a hardcoded hashed password
n for Flyte Admin allows access for Flyte Propeller even after turning on authentication via a hardcoded hashed password. This password is also set on the default Flyte Propeller configmap in the various Flyte Helm charts. Users who enable auth but do not override this setting in Flyte Admin’s configuration may unbeknownst to them be allowing public traffic in by way of this default password with attackers effectively impersonating propeller. This only applies to users who have not specified the ExternalAuthorizationServer setting. Usage of an external auth server automatically turns off this default configuration and are not susceptible to this vulnerability. This issue has been addressed i
ally turns off this default configuration and are not susceptible to this vulnerability. This issue has been addressed in version 1.1.44. Users should manually set the staticClients in the selfAuthServer section of their configuration if they intend to rely on Admin’s internal auth server. Again, users who use an external auth server are automatically protected from this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-67x4-qr35-qvrm - https://github.com/flyteorg/flyteadmin/pull/478 - https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authoriz
lyteorg/flyteadmin/pull/478 - https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server
CVE ID: CVE-2022-39274 State: PUBLISHED Published: 2022-10-06T00:00:00.000Z Last Updated: 2025-04-22T17:19:43.579Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lora-net Products: LoRaMac-node Problem Types: CWE-120 Description: LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable to a buffer overflow. Improper size validation of the incoming radio frames can lead to an 65280-byte out-of-bounds write. The function `ProcessRadioRxDone` implicitly expects incoming radio frames to have at least a payload of one byte or more. An empty payload leads to a 1-byte out-of-bounds re
ncoming radio frames to have at least a payload of one byte or more. An empty payload leads to a 1-byte out-of-bounds read of user controlled content when the payload buffer is reused. This allows an attacker to craft a FRAME_TYPE_PROPRIETARY frame with size -1 which results in an 65280-byte out-of-bounds memcopy likely with partially controlled attacker data. Corrupting a large part if the data section is likely to cause a DoS. If the large out-of-bounds write does not immediately crash the attacker may gain control over the execution due to now controlling large parts of the data section. Users are advised to upgrade either by updating their package or by manually applying the patch commit
the data section. Users are advised to upgrade either by updating their package or by manually applying the patch commit `e851b079`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Lora-net/LoRaMac-node/security/advisories/GHSA-7vv8-73pc-63c2 - https://github.com/Lora-net/LoRaMac-node/commit/e851b079c82ba1bcf3f4d291ab69a571b0bf458a - https://github.com/Lora-net/LoRaMac-node/releases/tag/v4.7.0
CVE ID: CVE-2022-39275 State: PUBLISHED Published: 2022-10-06T00:00:00.000Z Last Updated: 2025-04-23T16:52:27.439Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: saleor Products: saleor Problem Types: CWE-863 Description: Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name
e row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the `assignNavigation()` mutation. This issue has been patched in main and backported to multiple releases (3.7.17, 3.6.18, 3.5.23, 3.4.24, 3.3.26, 3.2.14, 3.1.24). Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/saleor/saleor/security/advisories/GHSA-xhq8-8c5v-w8ff - https://github.com/saleor/saleor/commit/96e04c092ddcac17b14f2e31554aa02d9006d0ce
CVE ID: CVE-2022-39276 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-04-22T16:08:44.482Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-918 Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote script returns a redirect response, the redirect target URL is not checked against the URL allow list defined by administrator. This issue has bee
response, the redirect target URL is not checked against the URL allow list defined by administrator. This issue has been patched, please upgrade to 10.0.4. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-8vwg-7x42-7v6p - https://huntr.dev/bounties/7a88f92b-1ee2-4ca8-9cf8-05fcf6cfe73f/
CVE ID: CVE-2022-39277 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-04-22T16:08:34.091Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79, CWE-80 Description: GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting (XSS) attack. This issue has been patched, please upgrade to GLPI 10.0.4. There are currently no known workarounds. Additional Analyst Notes:
sue has been patched, please upgrade to GLPI 10.0.4. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-rhcw-8r7g-8pwc - https://huntr.dev/bounties/8e047ae1-7a7c-48e0-bee3-d1c36e52ff42/
CVE ID: CVE-2022-39278 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-04-23T16:50:32.655Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: istio Products: istio Problem Types: CWE-400 Description: Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is expo
d message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go. Additional Analyst Notes: - CVE Program Container: - CI
pgrading. This bug is due to an error in `regexp.Compile` in Go. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w - https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/ - https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/ - https://istio.io/news/releases/1.14.x/announcing-1.14.5/
CVE ID: CVE-2022-39279 State: PUBLISHED Published: 2022-10-06T00:00:00.000Z Last Updated: 2025-04-23T16:52:20.133Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: discourse Products: discourse-chat Problem Types: CWE-79 Description: discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them. Version 0.9 has addressed this issue. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Note
dressed this issue. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-chat/security/advisories/GHSA-qp62-8m3c-9jgj - https://github.com/discourse/discourse-chat/commit/25737733af48e5b9fa60b0561d7fde14bea13cce
CVE ID: CVE-2022-39280 State: PUBLISHED Published: 2022-10-06T00:00:00.000Z Last Updated: 2025-04-23T16:52:14.285Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pyupio Products: dparse Problem Types: CWE-400 Description: dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the
dvised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS - https://github.com/pyupio/dparse/security/advisories/GHSA-8fg9-p83m-x5pq - https://github.com/pyupio/dparse/commit/8c990170bbd6c0cf212f1151e9025486556062d5 - https://github.com/pyupio/dparse/commit/d87364f9db9ab916451b1b036cfeb039e726e614
CVE ID: CVE-2022-39281 State: PUBLISHED Published: 2022-10-08T00:00:00.000Z Last Updated: 2025-04-23T16:52:02.830Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: fatfreecrm Products: fat_free_crm Problem Types: CWE-20 Description: fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for t
elease `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-p75c-5x3h-cxcg - https://github.com/fatfreecrm/fat_free_crm/commit/c85a2546348c2692d32f952c753f7f0b43d1ca71 - https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.20.1
CVE ID: CVE-2022-39282 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-11-03T20:34:55.910Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-908 Description: FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a worka
ssue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c45q-wcpg-mxjq - https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1 - https://security.gentoo.org/glsa/202210-24 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/ - https://lists.fedoraproject.org/archive
e-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html
CVE ID: CVE-2022-39283 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-11-03T20:34:57.300Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: FreeRDP Products: FreeRDP Problem Types: CWE-125 Description: FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
cannot upgrade do not use the `/video` switch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FreeRDP/FreeRDP/releases/tag/2.8.1 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6cf9-3328-qrvh - https://security.gentoo.org/glsa/202210-24 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLZCF7YHNC5BECDPEJNAZUYGNNM7NFME/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEWWYMGWIMD4RDCOGHWMZXUMBGZHC5NW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/ - https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html
CVE ID: CVE-2022-39284 State: PUBLISHED Published: 2022-10-06T00:00:00.000Z Last Updated: 2025-04-22T17:19:34.229Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: codeigniter4 Products: CodeIgniter4 Problem Types: CWE-665 Description: CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to man
not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp - https://github.com/codeigniter4/CodeIgniter4/issues/6540 - https://github.com/codeigniter4/CodeIgniter4/pull/6544 - https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie - https://codeigniter4.github.io/userguide/
tps://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie - https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter%5CHTTP%5CResponse::setCookie - https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
CVE ID: CVE-2022-39285 State: PUBLISHED Published: 2022-10-07T00:00:00.000Z Last Updated: 2025-04-22T17:19:26.192Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-79 Description: ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded
e "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-h6xp-cvwv-q433 - https://github.com/ZoneMinder/zoneminder/commit/c0a4c05e84eea0f6ccf7169c014efe
security/advisories/GHSA-h6xp-cvwv-q433 - https://github.com/ZoneMinder/zoneminder/commit/c0a4c05e84eea0f6ccf7169c014efe5422c9ba0d - https://github.com/ZoneMinder/zoneminder/commit/d289eb48601a76e34feea3c1683955337b1fae59 - http://packetstormsecurity.com/files/171498/Zoneminder-Log-Injection-XSS-Cross-Site-Request-Forgery.html
CVE ID: CVE-2022-39286 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-04-23T16:43:15.864Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: jupyter Products: jupyter_core Problem Types: CWE-269, CWE-250 Description: Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds. Additional Analyst Notes: - CVE Progra