Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24008 State: PUBLISHED Published: 2025-05-13T09:38:30.444Z Last Updated: 2025-05-13T19:02:28.353Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Siemens Products: SIRIUS 3RK3 Modular Safety System (MSS), SIRIUS Safety Relays 3SK2 Problem Types: CWE-311 Description: A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). The affected devices do not encrypt data in transit. An attacker with network access could eavesdrop the connection and retrieve sensitive information, including obfuscated safety passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
eve sensitive information, including obfuscated safety passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-222768.html
CVE ID: CVE-2025-24009 State: PUBLISHED Published: 2025-05-13T09:38:31.772Z Last Updated: 2025-05-13T19:01:18.488Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: SIRIUS 3RK3 Modular Safety System (MSS), SIRIUS Safety Relays 3SK2 Problem Types: CWE-732 Description: A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). The affected devices do not require authentication to access critical resources. An attacker with network access could retrieve sensitive information from certain data records, including obfuscated safety passwords. Additional Analyst Notes: - C
ve sensitive information from certain data records, including obfuscated safety passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-222768.html
CVE ID: CVE-2025-24010 State: PUBLISHED Published: 2025-01-20T15:53:30.929Z Last Updated: 2025-01-21T14:52:53.680Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: vitejs Products: vite Problem Types: CWE-346, CWE-350, CWE-1385 Description: Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and 4.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vitejs/vite/security/advisories/GHSA-
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6
CVE ID: CVE-2025-24011 State: PUBLISHED Published: 2025-01-21T15:27:30.090Z Last Updated: 2025-02-12T20:41:21.417Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-200 Description: Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com
No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hmg4-wwm5-p999 - https://github.com/umbraco/Umbraco-CMS/commit/559c6c9f312df1d6eb1bde82c4b81c0896da6382 - https://github.com/umbraco/Umbraco-CMS/commit/839b6816f2ae3e5f54459a0f09dad6b17e2d1e07
CVE ID: CVE-2025-24012 State: PUBLISHED Published: 2025-01-21T15:32:43.910Z Last Updated: 2025-02-12T20:41:21.301Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-79 Description: Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 contain a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wv8v-rmw2-25wc - https://github.com/umbraco/Umbraco-CMS/commit/d4f8754f933895b3a329296e25ddea6f84a0aea2
CVE ID: CVE-2025-24013 State: PUBLISHED Published: 2025-01-20T15:57:37.975Z Last Updated: 2025-01-21T14:51:01.754Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: codeigniter4 Products: CodeIgniter4 Problem Types: CWE-436 Description: CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web applicat
d HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application. This vulnerability is fixed in 4.5.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-x5mq-jjr3-vmx6 - https://github.com/codeigniter4/CodeIgniter4/commit/5f8aa24280fb09947897d6b322bf1f0e038b13b6 - https://datatracker.ietf.org/doc/html/rfc7230#section-3.2 - https://github.com/advisories/GHSA-wxmh-65f7-jcvw
CVE ID: CVE-2025-24014 State: PUBLISHED Published: 2025-01-20T22:53:14.325Z Last Updated: 2025-03-14T10:03:09.511Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: vim Products: vim Problem Types: CWE-787 Description: Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access
binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955 - https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919
CVE ID: CVE-2025-24015 State: PUBLISHED Published: 2025-06-03T22:48:52.906Z Last Updated: 2025-06-04T19:15:04.623Z Vendors: denoland Products: deno Problem Types: CWE-347 Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Older versions of Deno correctly threw errors in such cases, as does Node.js. Without authentication tag verification, AES-GCM degrades to essentially CTR mode, removing integrity prot
does Node.js. Without authentication tag verification, AES-GCM degrades to essentially CTR mode, removing integrity protection. Authenticated data set with set_aad is also affected, as it is incorporated into the GCM hash (ghash) but this too is not validated, rendering AAD checks ineffective. Version 2.1.7 includes a patch that addresses this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/denoland/deno/security/advisories/GHSA-2x3r-hwv5-p32x - https://github.com/denoland/deno/commit/0d1beed - https://github.com/denoland/deno/commit/4f27d7cdc02e3edfb9d36275341fb8185d6e99ed - https://github.com/denoland/deno/commit/a4003a5292bd0affefad3ecb24a8732886
it/4f27d7cdc02e3edfb9d36275341fb8185d6e99ed - https://github.com/denoland/deno/commit/a4003a5292bd0affefad3ecb24a8732886900f67
CVE ID: CVE-2025-24016 State: PUBLISHED Published: 2025-02-10T19:08:09.058Z Last Updated: 2025-10-21T22:55:29.801Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: wazuh Products: wazuh Problem Types: CWE-502 Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAP
object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh
CVE ID: CVE-2025-24017 State: PUBLISHED Published: 2025-01-21T15:37:58.654Z Last Updated: 2025-02-12T20:41:21.167Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: YesWiki Products: yeswiki Problem Types: CWE-79 Description: YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki's pages which is triggered when a user clicks on a malicious link. The vulnerability makes use of the search by tag feature. When a tag doesn't exist, the tag is reflected on the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will tri
the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client's side when clicked. This vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wphc-5f2j-jhvg - https://github.com/YesWiki/
: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wphc-5f2j-jhvg - https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b
CVE ID: CVE-2025-24018 State: PUBLISHED Published: 2025-01-21T17:02:04.924Z Last Updated: 2025-01-21T17:15:37.955Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: YesWiki Products: yeswiki Problem Types: CWE-79 Description: YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded. The vulnerability makes use of the content edition feature and more specifically of the `{{attach}}` component allowing users to attach files/medias to a page. When a file is attached usin
specifically of the `{{attach}}` component allowing users to attach files/medias to a page. When a file is attached using the `{{attach}}` component, if the resource contained in the `file` attribute doesn't exist, then the server will generate a file upload button containing the filename. This vulnerability allows any malicious authenticated user that has the right to create a comment or edit a page to be able to steal accounts and therefore modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
YesWiki instance. Version 4.5.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w59h-3x3q-3p6j - https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b - https://github.com/YesWiki/yeswiki/blob/v4.4.5/tools/attach/libs/attach.lib.php#L660
CVE ID: CVE-2025-24019 State: PUBLISHED Published: 2025-01-21T17:36:10.367Z Last Updated: 2025-02-12T20:41:22.176Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: YesWiki Products: yeswiki Problem Types: CWE-22 Description: YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager (FPM) on the host without any limitation on the filesystem's scope. This vulnerability allows any authenticated user to arbitrarily remove content from the Wiki resulting in partial loss of data and defacement/det
any authenticated user to arbitrarily remove content from the Wiki resulting in partial loss of data and defacement/deterioration of the website. In the context of a container installation of YesWiki without any modification, the `yeswiki` files (for example .php) are not owned by the same user (root) as the one running the FPM process (www-data). However in a standard installation, www-data may also be the owner of the PHP files, allowing a malicious user to completely cut the access to the wiki by deleting all important PHP files (like index.php or core files of YesWiki). Version 4.5.0 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
. Version 4.5.0 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-43c9-gw4x-pcx6 - https://github.com/YesWiki/yeswiki/commit/3ddd833d22703caf9025659eb174f7765df7147c
CVE ID: CVE-2025-24020 State: PUBLISHED Published: 2025-01-21T17:51:16.698Z Last Updated: 2025-02-12T20:41:21.848Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-601 Description: WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the `nextPage` parameter to be manipulated, redirecting authenticated users to arbitrary external URLs without validation. The issue stems from the lack of validation for the `nextPage` parameter, which accepts external URLs as redirection destinations. This vulnerability can be exploited
the `nextPage` parameter, which accepts external URLs as redirection destinations. This vulnerability can be exploited to perform phishing attacks or redirect users to malicious websites. Version 3.2.11 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-27g8-5q48-xmw6 - https://github.com/LabRedesCefetRJ/WeGIA/commit/89d98bf074cebf6c4ed95fca6f64e325c0b1d2f0 - https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/v3.2.11
CVE ID: CVE-2025-24021 State: PUBLISHED Published: 2025-05-14T14:48:42.694Z Last Updated: 2025-08-26T13:44:18.910Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-862 Description: iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-c8hm-h9gv-8jpj - https://github.com/Combodo/iTop/commit/44290db
https://github.com/Combodo/iTop/security/advisories/GHSA-c8hm-h9gv-8jpj - https://github.com/Combodo/iTop/commit/44290db312901fc5918cc537c74561487fb3713b
CVE ID: CVE-2025-24022 State: PUBLISHED Published: 2025-05-14T14:57:37.960Z Last Updated: 2025-05-14T15:12:14.705Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-78 Description: iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-rhv2-wfrr-4j2j
CVE ID: CVE-2025-24023 State: PUBLISHED Published: 2025-03-03T15:25:55.437Z Last Updated: 2025-03-03T18:41:23.427Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dpgaspar Products: Flask-AppBuilder Problem Types: CWE-204 Description: Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwp
CVE ID: CVE-2025-24024 State: PUBLISHED Published: 2025-01-21T19:21:56.038Z Last Updated: 2025-01-21T19:32:21.204Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: matrix-org Products: mjolnir Problem Types: CWE-671 Description: Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature that introduced the bug, and version 1.9.2 reintroduces the feature safely. Downgrading to version 1.8.3 is recommended if upgrading to 1.9.1
g, and version 1.9.2 reintroduces the feature safely. Downgrading to version 1.8.3 is recommended if upgrading to 1.9.1 or higher isn't possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/mjolnir/security/advisories/GHSA-3jq6-xc85-m394 - https://github.com/matrix-org/mjolnir/commit/b437fa16b5425985715df861987c836affd51eea - https://github.com/matrix-org/mjolnir/commit/d0ef527a9e3eb45e17143d5295a64b775ccaa23d
CVE ID: CVE-2025-24025 State: PUBLISHED Published: 2025-01-24T16:46:04.276Z Last Updated: 2025-01-24T21:01:40.445Z Vendors: coollabsio Products: coolify Problem Types: CWE-116 Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site scripting. Version 4.0.0-beta.380 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/security/advisories/GHSA-f2gf-jvmh-vq73
CVE ID: CVE-2025-24026 State: PUBLISHED Published: 2025-05-14T14:59:47.581Z Last Updated: 2025-05-14T15:10:59.790Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-1333 Description: iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop app_root_url is defined in the configuration file, then there is no possible way to exploit this ReDoS. Additional Analyst Notes: - CISA ADP Vulnrichme
configuration file, then there is no possible way to exploit this ReDoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-9g7f-jmc3-rrmf
CVE ID: CVE-2025-24027 State: PUBLISHED Published: 2025-01-22T14:26:42.830Z Last Updated: 2025-02-12T20:41:23.646Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H) Vendors: PrestaShop Products: ps_contactinfo Problem Types: CWE-79 Description: ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up to and including 3.3.2. This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned. For example, if the shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored cross-site scripting
p has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored cross-site scripting in formatting objects. Commit d60f9a5634b4fc2d3a8831fb08fe2e1f23cbfa39 keeps formatted addresses from displaying a XSS stored in the database, and the fix is expected to be available in version 3.3.3. No workarounds are available aside from applying the fix and keeping all modules maintained and update. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PrestaShop/ps_contactinfo/security/advisories/GHSA-35pq-7pv2-2rfw - https://github.com/PrestaShop/ps_contactinfo/commit/d60f9a5634b4fc2d3a8831fb08fe2e1f23cbfa39
CVE ID: CVE-2025-24028 State: PUBLISHED Published: 2025-02-07T22:23:07.275Z Last Updated: 2025-02-10T17:17:41.159Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: laurent22 Products: joplin Problem Types: CWE-79 Description: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Text Editor and the Markdown viewer. However, unlike the Rich Text Editor, the Markdown viewer is `cross-origin isolated`, which prevents JavaScript
viewer. However, unlike the Rich Text Editor, the Markdown viewer is `cross-origin isolated`, which prevents JavaScript from directly accessing functions/variables in the toplevel Joplin `window`. This issue is not present in Joplin 3.1.24 and may have been introduced in `9b50539`. This is an XSS vulnerability that impacts users that open untrusted notes in the Rich Text Editor. This vulnerability has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92 - https://github.com/laurent
: References: - https://github.com/laurent22/joplin/security/advisories/GHSA-5w3c-wph9-hq92 - https://github.com/laurent22/joplin/commit/2a058ed8097c2502e152b26394dc1917897f5817 - https://github.com/laurent22/joplin/commit/9b505395918bc923f34fe6f3b960bb10e8cf234e - https://joplinapp.org/help/dev/spec/note_viewer_isolation