Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-29154 State: PUBLISHED Published: 2022-08-02T14:22:52 Last Updated: 2024-08-03T06:10:59.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file). Additional Analyst Notes: - CVE Program
ctory and subdirectories (for example, overwrite the .ssh/authorized_keys file). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WayneD/rsync/tags - http://www.openwall.com/lists/oss-security/2022/08/02/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/
CVE ID: CVE-2022-29155 State: PUBLISHED Published: 2022-05-04T19:06:09 Last Updated: 2024-08-03T06:10:59.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.openldap.org/show_bug.cgi?id=9815 - https://www.debian.org/security/2022/dsa-5140 - https://lists.debian.org/debian-lts-announce/2022/05/msg00032.html - ht
https://www.debian.org/security/2022/dsa-5140 - https://lists.debian.org/debian-lts-announce/2022/05/msg00032.html - https://security.netapp.com/advisory/ntap-20220609-0007/
CVE ID: CVE-2022-29156 State: PUBLISHED Published: 2022-04-13T06:12:01 Last Updated: 2024-08-03T06:10:59.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.12 - https://github.com/torvalds/linux/commit/8700af2cc18c919b2a83e74e0479038fd113c15d - https://security.netapp.com/advisory/ntap-20220602-0002/
CVE ID: CVE-2022-29158 State: PUBLISHED Published: 2022-09-02T07:10:20 Last Updated: 2024-08-03T06:10:59.432Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-1333 Description: Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599 Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/7k92rg1o4ql2yw3o0vttkcl2jhq7j928 - http://www.openwall.com/lists/oss-security/2022/09/02/5
CVE ID: CVE-2022-29159 State: PUBLISHED Published: 2022-05-20T15:40:10.000Z Last Updated: 2025-04-22T18:01:04.377Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-639 Description: Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move stacks with cards from their own board to a board of another user. The Nextcloud Deck app contains a patch for this issue in versions 1.4.8, 1.5.6, and 1.6.1. There are no known currently-known workarounds available. Additional Analyst Notes: - CVE Program Container: -
nd 1.6.1. There are no known currently-known workarounds available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqhf-673w-7r3j - https://github.com/nextcloud/deck/pull/3541 - https://hackerone.com/reports/1450117
CVE ID: CVE-2022-29160 State: PUBLISHED Published: 2022-05-20T15:55:10.000Z Last Updated: 2025-04-22T18:00:43.200Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related details exist after deletion of a user account. This could result in misuse of the former account holder's information. Nextcloud Android version 3.19.0 contains a patch for this issue. There are no known workarounds available. Additional Analyst Notes: - CVE Program Co
.0 contains a patch for this issue. There are no known workarounds available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xcj9-3jch-qr2r - https://github.com/nextcloud/android/pull/9644 - https://hackerone.com/reports/1222873
CVE ID: CVE-2022-29161 State: PUBLISHED Published: 2022-05-05T23:35:28.000Z Last Updated: 2025-04-23T18:30:05.026Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-327 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. The problem has been patched in XWiki version 13.10.6, 14.3.1 and 14.4-rc-1. Since then, the Crypto API will generate X509 cer
oblem has been patched in XWiki version 13.10.6, 14.3.1 and 14.4-rc-1. Since then, the Crypto API will generate X509 certificates signed by default using SHA256 with RSA. Administrators are advised to upgrade their XWiki installation to one of the patched versions. If the upgrade is not possible, it is possible to patch the module xwiki-platform-crypto in a local installation by applying the change exposed in 26728f3 and re-compiling the module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h8v5-p258-pqf4 - https://github.com/xwiki/xwiki-platform/commit/26728f3f23658288683667a5182a916
security/advisories/GHSA-h8v5-p258-pqf4 - https://github.com/xwiki/xwiki-platform/commit/26728f3f23658288683667a5182a916c7ecefc52 - https://jira.xwiki.org/browse/XWIKI-19676
CVE ID: CVE-2022-29162 State: PUBLISHED Published: 2022-05-17T00:00:00.000Z Last Updated: 2025-04-23T18:25:42.249Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: opencontainers Products: runc Problem Types: CWE-276 Description: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the
able file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
ted example OCI spec (`config.json`) file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 - https://github.com/opencontainers/runc/commit/d04de3a9b72d7a2455c1885fc75eb36d02cd17b5 - https://github.com/opencontainers/runc/releases/tag/v1.1.2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D77CKD3AXPMU4PMQIQI5Q74SI4JATNND/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GPQU4YC4AAY54JDXGDQHJEYKSXXG5T2Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists
t.org/message/GPQU4YC4AAY54JDXGDQHJEYKSXXG5T2Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVPZBV7ISA7QKRPTC7ZXWKMIQI2HZEBB/ - https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html
CVE ID: CVE-2022-29163 State: PUBLISHED Published: 2022-05-20T16:00:15.000Z Last Updated: 2025-04-23T18:24:51.245Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-671 Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
ssue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwjv-h37v-c4fx - https://github.com/nextcloud/circles/pull/866 - https://github.com/nextcloud/circles/pull/926 - https://hackerone.com/reports/1406926
CVE ID: CVE-2022-29164 State: PUBLISHED Published: 2022-05-05T23:15:12.000Z Last Updated: 2025-04-23T18:30:26.977Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: argoproj Products: argo-workflows Problem Types: CWE-269 Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the sc
er emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the script has access to the Argo Server API (as the victim), so may read information about the victim’s workflows, or create and delete workflows. Note the attacker must be an insider: they must have access to the same cluster as the victim and must already be able to run their own workflows. The attacker must have an understanding of the victim’s system. We have seen no evidence of this in the wild. We urge all users to upgrade to the fixed versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-workfl
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cmv8-6362-r5w9 - https://github.com/argoproj/argo-workflows/pull/8585 - https://github.com/argoproj/argo-workflows/commit/87470e1c2bf703a9110e97bb755614ce8757fdcc
CVE ID: CVE-2022-29165 State: PUBLISHED Published: 2022-05-20T14:15:11.000Z Last Updated: 2025-04-23T18:24:58.163Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-200, CWE-287, CWE-290 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions 2.1.15, 2.2.9, and 2.3.4 which would allow unauthenticated users to impersonate as any Argo CD user or role, including the `admin` user, by sending a specifically crafted JSON Web Token (JWT) along with the request. In order for this vulnera
e `admin` user, by sending a specifically crafted JSON Web Token (JWT) along with the request. In order for this vulnerability to be exploited, anonymous access to the Argo CD instance must have been enabled. In a default Argo CD installation, anonymous access is disabled. The vulnerability can be exploited to impersonate as any user or role, including the built-in `admin` account regardless of whether it is enabled or disabled. Also, the attacker does not need an account on the Argo CD instance in order to exploit this. If anonymous access to the instance is enabled, an attacker can escalate their privileges, effectively allowing them to gain the same privileges on the cluster as the Argo C
tacker can escalate their privileges, effectively allowing them to gain the same privileges on the cluster as the Argo CD instance, which is cluster admin in a default installation. This will allow the attacker to create, manipulate and delete any resource on the cluster. They may also exfiltrate data by deploying malicious workloads with elevated privileges, thus bypassing any redaction of sensitive data otherwise enforced by the Argo CD API. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. As a workaround, one may disable anonymous access, but upgrading to a patched version is preferable. Additional Analyst Notes: - CVE Program Container: - CIS
ymous access, but upgrading to a patched version is preferable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/releases/tag/v2.1.15 - https://github.com/argoproj/argo-cd/releases/tag/v2.2.9 - https://github.com/argoproj/argo-cd/releases/tag/v2.3.4 - https://github.com/argoproj/argo-cd/security/advisories/GHSA-r642-gv9p-2wjj
CVE ID: CVE-2022-29166 State: PUBLISHED Published: 2022-05-05T23:05:14.000Z Last Updated: 2025-04-23T18:30:37.402Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: matrix-org Products: matrix-appservice-irc Problem Types: CWE-74 Description: matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue. Addit
o messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-37hr-348p-rmf4 - https://matrix.org/blog/2022/05/04/0-34-0-security-release-for-matrix-appservice-irc-high-severity
CVE ID: CVE-2022-29167 State: PUBLISHED Published: 2022-05-05T22:55:10.000Z Last Updated: 2025-04-23T18:30:44.456Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: mozilla Products: hawk Problem Types: CWE-400 Description: Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input incre
ost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq - https://github.com/mozilla/hawk/pull/286
CVE ID: CVE-2022-29168 State: PUBLISHED Published: 2022-06-25T07:05:09.000Z Last Updated: 2025-04-23T18:08:54.718Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: wireapp Products: wire-webapp Problem Types: CWE-79, CWE-80 Description: Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim allowing the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version a
ttacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-05-04-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-05-04-production.0-v0.29.7-0-a6f2ded or wire-server 2022-05-04 (chart/4.11.0) or later. No known workarounds exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wireapp/wire-webapp/security/advisories/GHSA-jgv3-4j56-fvh6
CVE ID: CVE-2022-29169 State: PUBLISHED Published: 2022-06-01T22:20:12.000Z Last Updated: 2025-04-23T18:20:31.969Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-20 Description: BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUser
seragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using `SmartWatch`. The maintainers removed `htmlclient/useragent` from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rwrv-p665-4vwp - https://github.
: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rwrv-p665-4vwp - https://github.com/bigbluebutton/bigbluebutton/pull/14886 - https://github.com/bigbluebutton/bigbluebutton/pull/14896
CVE ID: CVE-2022-29170 State: PUBLISHED Published: 2022-05-20T16:10:12.000Z Last Updated: 2025-04-23T18:24:44.628Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: grafana Products: grafana Problem Types: CWE-601 Description: Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host
6 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
ssue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grafana/grafana/security/advisories/GHSA-9rrr-6fq2-4f99 - https://github.com/grafana/grafana/pull/49240 - https://github.com/grafana/grafana/releases/tag/v7.5.16 - https://github.com/grafana/grafana/releases/tag/v8.5.3 - https://security.netapp.com/advisory/ntap-20220707-0005/
CVE ID: CVE-2022-29171 State: PUBLISHED Published: 2022-05-05T23:25:09.000Z Last Updated: 2025-04-23T18:30:20.108Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: sourcegraph Products: sourcegraph Problem Types: CWE-74 Description: Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserver service. The Gitolite code host integration with Phabricator allows Sourcegraph site admins to specify a `callsignCommand`, which is used to obtain the Phabricator metadata for a Gitolite repository. An administrator who is able to edit or add a Gitolite code host and has administr
r metadata for a Gitolite repository. An administrator who is able to edit or add a Gitolite code host and has administrative access to Sourcegraph’s bundled Grafana instance can change this command arbitrarily and run it remotely. This grants direct access to the infrastructure underlying the Sourcegraph installation. The attack requires: site-admin privileges on the instance of Sourcegraph, Administrative privileges on the bundled Grafana monitoring instance, Knowledge of the gitserver IP address or DNS name (if running in Kubernetes). This can be found through Grafana. The issue is patched in version 3.38.0. You may disable Gitolite code hosts. We still highly encourage upgrading regardle
he issue is patched in version 3.38.0. You may disable Gitolite code hosts. We still highly encourage upgrading regardless of workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-r2m9-hfg8-4c38
CVE ID: CVE-2022-29172 State: PUBLISHED Published: 2022-05-05T22:50:09.000Z Last Updated: 2025-04-23T18:30:53.070Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: auth0 Products: lock Problem Types: CWE-79 Description: Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (