Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-1001004 State: PUBLISHED Published: 2017-11-27T14:00:00Z Last Updated: 2024-09-16T17:13:51.673Z Vendors: typed-function Products: typed-function Problem Types: CWE-94 Description: typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe - https://github.com/josdejong/typed-function/blob/master/HISTORY.md#2017-11-18-version-0106
CVE ID: CVE-2017-1002000 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.587Z Vendors: jenova12345 Products: mobile-friendly-app-builder-by-easytouch Problem Types: Unrestricted File Upload Description: Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96905 - http://www.securityfocus.com/bid/96899 - https://wordpress.org/plugins-wp/mobile-friendly-app-builder-by-easytouch
905 - http://www.securityfocus.com/bid/96899 - https://wordpress.org/plugins-wp/mobile-friendly-app-builder-by-easytouch/ - https://www.exploit-db.com/exploits/41540/ - http://www.vapidlabs.com/advisory.php?v=179
CVE ID: CVE-2017-1002001 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.659Z Vendors: Invedion Products: mobile-app-builder-by-wappress Problem Types: Unrestricted File Upload Description: Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins-wp/mobile-app-builder-by-wappress/ - https://www.exploit-db.com/exploits/41540/ - http://www.vapidlabs.com/advisory.php?v=180
CVE ID: CVE-2017-1002002 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.767Z Vendors: Invedion Products: webapp-builder Problem Types: Unrestricted File Upload Description: Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/ Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96906 - https://wordpress.org/plugins-wp/webapp-builder/ - http://www.vapidlabs.com/advisory.php?v=181 - https://www.exploit-db.com/exploits/41540/
CVE ID: CVE-2017-1002003 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.577Z Vendors: invedion Products: wp2android-turn-wp-site-into-android-app Problem Types: Unrestricted File Upload Description: Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=182 - http://www.securityfocus.com/bid/96908 - https://www.exploit-db.com/exploits/41540/ - https://wordpress.org/plugins-wp/wp2android-turn-wp-site-into-android-app/
CVE ID: CVE-2017-1002004 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.666Z Vendors: ITFlux Products: DTracker Problem Types: SQL Injection Description: Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96781 - http://www.vapidlabs.com/advisory.php?v=183 - https://wordpress.org/plugins/dtracker/
CVE ID: CVE-2017-1002005 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.643Z Vendors: ITFlux Products: DTracker Problem Types: SQL Injection Description: Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96781 - http://www.vapidlabs.com/advisory.php?v=183 - https://wordpress.org/plugins/dtracker/
CVE ID: CVE-2017-1002006 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.607Z Vendors: ITFlux Products: DTracker Problem Types: Content Injection Description: Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96890 - http://www.vapidlabs.com/advisory.php?v=186 - https://wordpress.org/plugins/dtracker/
CVE ID: CVE-2017-1002007 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.655Z Vendors: ITFlux Products: DTracker Problem Types: Content Injection Description: Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96890 - http://www.vapidlabs.com/advisory.php?v=186 - https://wordpress.org/plugins/dtracker/
CVE ID: CVE-2017-1002008 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.659Z Vendors: William DeAngelis Products: membership-simplified-for-oap-members-only Problem Types: Path Traversal Description: Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/membership-simplified-for-oap-members-only - http://www.vapidlabs.com/advisory.php?v=187 - https://www.exploit-db.com/exploits/
hip-simplified-for-oap-members-only - http://www.vapidlabs.com/advisory.php?v=187 - https://www.exploit-db.com/exploits/41622/ - https://wpvulndb.com/vulnerabilities/8777
CVE ID: CVE-2017-1002009 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-17T01:32:04.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=188 - http://membership.officeautopilot.com/get-it-now/
CVE ID: CVE-2017-1002010 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T23:36:54.951Z Vendors: ontraport Products: Membership Simplified Problem Types: SQL Injection Description: Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=188 - http://membership.officeautopilot.com/get-it-now/
CVE ID: CVE-2017-1002011 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-17T01:11:37.871Z Vendors: Anblik Products: image-gallery-with-slideshow Problem Types: Stored XSS Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/image-gallery-with-slideshow/ - http://www.vapidlabs.com/advisory.php?v=189
CVE ID: CVE-2017-1002012 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T18:02:47.121Z Vendors: Anblik Products: image-gallery-with-slideshow Problem Types: SQL Injection Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/image-gallery-with-slideshow/ - http://www.vapidlabs.com/advisory.php?v=189
CVE ID: CVE-2017-1002013 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-17T02:36:37.985Z Vendors: Anblik Products: image-gallery-with-slideshow Problem Types: SQL Injection Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/image-gallery-with-slideshow/ - http://www.vapidlabs.com/advisory.php?v=189
CVE ID: CVE-2017-1002014 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T19:31:36.228Z Vendors: Anblik Products: image-gallery-with-slideshow Problem Types: SQL Injection Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/image-gallery-with-slideshow/ - http://www.vapidlabs.com/advisory.php?v=189
CVE ID: CVE-2017-1002015 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T16:58:09.543Z Vendors: Anblik Products: image-gallery-with-slideshow Problem Types: SQL Injection Description: Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/image-gallery-with-slideshow/ - http://www.vapidlabs.com/advisory.php?v=189
CVE ID: CVE-2017-1002016 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T23:01:31.057Z Vendors: daozhao Products: flickr-picture-backup Problem Types: Path Traversal Description: Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=190 - https://wordpress.org/plugins/flickr-picture-backup/
CVE ID: CVE-2017-1002017 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T17:18:46.421Z Vendors: Bob Cares Products: gift-certificate-creator Problem Types: Stored XSS Description: Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.vapidlabs.com/advisory.php?v=191 - https://wordpress.org/plugins/gift-certificate-creator/
CVE ID: CVE-2017-1002018 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T23:56:37.044Z Vendors: Binny V A Products: eventr Problem Types: SQL Injection Description: Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/eventr/ - http://www.vapidlabs.com/advisory.php?v=192
CVE ID: CVE-2017-1002019 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T20:32:31.909Z Vendors: Binny V A Products: eventr Problem Types: SQL Injection Description: Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/eventr/ - http://www.vapidlabs.com/advisory.php?v=192
CVE ID: CVE-2017-1002020 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.629Z Vendors: Binny V A Products: surveys Problem Types: SQL Injection Description: Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8833 - http://www.vapidlabs.com/advisory.php?v=193 - https://wordpress.org/plugins/surveys/
CVE ID: CVE-2017-1002021 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.635Z Vendors: Binny V A Products: surveys Problem Types: SQL Injection Description: Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8833 - http://www.vapidlabs.com/advisory.php?v=193 - https://wordpress.org/plugins/surveys/
CVE ID: CVE-2017-1002022 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.645Z Vendors: Binny V A Products: surveys Problem Types: SQL Injection Description: Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8833 - http://www.vapidlabs.com/advisory.php?v=193 - https://wordpress.org/plugins/surveys/
CVE ID: CVE-2017-1002023 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-17T02:52:29.319Z Vendors: Daisy Themes Products: Easy Team Manager Problem Types: SQL Injection Description: Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/easy-team-manager/ - http://www.vapidlabs.com/advisory.php?v=194
CVE ID: CVE-2017-1002024 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-17T04:23:59.944Z Vendors: Kind Editor Inc. Products: Kind Editor Problem Types: Arbitrary File Upload Description: Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/upload_json.php does not check authentication before allow users to upload files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kindsoft/kindeditor - http://www.vapidlabs.com/advisory.php?v=195 - http://kindeditor.org
CVE ID: CVE-2017-1002025 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T17:49:03.342Z Vendors: Romal Patel Products: add-edit-delete-listing-for-member-module Problem Types: SQL Injection Description: Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/add-edit-delete-listing-for-member-module/ - http://www.vapidlabs.com/advisory.php?v=196
CVE ID: CVE-2017-1002026 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T22:45:10.290Z Vendors: Event Espresso Products: Event Expresso Free Problem Types: SQL Injection Description: Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/event-espresso-free/ - http://www.vapidlabs.com/advisory.php?v=197
CVE ID: CVE-2017-1002027 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.634Z Vendors: rkdevelopers Products: rk-responsive-contact-form Problem Types: SQL Injection Description: Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/rk-responsive-contact-form/ - https://wpvulndb.com/vulnerabilities/8889 - http://www.vapidlabs.com/advisory.php?v=198
CVE ID: CVE-2017-1002028 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:00:41.632Z Vendors: Angry Byte Products: wordpress-gallery-transformation Problem Types: SQL Injection Description: Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/8888 - http://www.vapidlabs.com/advisory.php?v=199 - https://wordpress.org/plugins/wordpress-gallery-transformation/
CVE ID: CVE-2017-1002100 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-16T16:53:57.251Z Vendors: Kubernetes Products: Kubernetes Problem Types: Insecure Permissions Description: Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/d/msg/kubernetes-security-announce/n3VBg_W
alyst Notes: - CVE Program Container: References: - https://groups.google.com/d/msg/kubernetes-security-announce/n3VBg_WJZic/-ddIqKXqAAAJ - https://github.com/kubernetes/kubernetes/issues/47611
CVE ID: CVE-2017-1002101 State: PUBLISHED Published: 2018-03-13T17:00:00 Last Updated: 2024-08-05T22:00:41.667Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kubernetes Products: Kubernetes Problem Types: handled symbolic links insecurely Description: In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0475
system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0475 - https://github.com/kubernetes/kubernetes/issues/60813 - https://github.com/bgeesaman/subpath-exploit/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
CVE ID: CVE-2017-1002102 State: PUBLISHED Published: 2018-03-13T17:00:00 Last Updated: 2024-08-05T22:00:41.652Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Kubernetes Products: Kubernetes Problem Types: handled symbolic links insecurely Description: In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0475 - https://github.com/kubernetes/kubernetes/i
am Container: References: - https://access.redhat.com/errata/RHSA-2018:0475 - https://github.com/kubernetes/kubernetes/issues/60814
CVE ID: CVE-2017-1002150 State: PUBLISHED Published: 2017-09-14T13:00:00 Last Updated: 2024-08-05T22:08:11.474Z Vendors: Fedora Project Infrastructure Products: Python-Fedora Problem Types: CWE-601 Description: python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fedora-infra/python-fedora/commit/b27f38a67573f4c989710c9bfb726dd4c1eeb929.patch - https://github.com/fedora-infra/python-fedora/commit/b27f38a67573f4c989710c9bfb726dd4c1eeb929
CVE ID: CVE-2017-1002151 State: PUBLISHED Published: 2017-09-14T13:00:00Z Last Updated: 2024-09-17T02:36:30.343Z Vendors: Pagure Project Products: Pagure Problem Types: CWE-285 Description: Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/pagure/pull-request/2426 - https://pagure.io/pagure/c/c92108097e8ae4702c115ae4702b63d960838e75.patch
CVE ID: CVE-2017-1002152 State: PUBLISHED Published: 2019-01-10T21:00:00Z Last Updated: 2024-09-16T20:27:46.322Z Vendors: Fedora Project Infrastructure Products: Bodhi Problem Types: CWE-94 Description: Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fedora-infra/bodhi/issues/1740
CVE ID: CVE-2017-1002153 State: PUBLISHED Published: 2017-10-06T17:00:00Z Last Updated: 2024-09-16T19:10:06.222Z Vendors: Koji Project Products: Koji Problem Types: CWE-20 Description: Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission. Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/koji/issue/563
CVE ID: CVE-2017-1002157 State: PUBLISHED Published: 2019-01-10T21:00:00Z Last Updated: 2024-09-16T16:47:59.756Z Vendors: Fedora Modularity Products: modulemd Problem Types: CWE-242 Description: modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/modulemd/issue/55
CVE ID: CVE-2017-1002201 State: PUBLISHED Published: 2019-10-15T17:35:57 Last Updated: 2024-08-05T22:08:11.499Z Vendors: http://haml.info/ Products: haml Problem Types: Cross-site Scripting (XSS) Description: In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2 - https://snyk.io/vuln/SNYK-RUBY-HAML-20362 - https://
hub.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2 - https://snyk.io/vuln/SNYK-RUBY-HAML-20362 - https://lists.debian.org/debian-lts-announce/2019/11/msg00007.html - https://security.gentoo.org/glsa/202007-27 - https://lists.debian.org/debian-lts-announce/2021/12/msg00028.html