Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ta, with the result that sensitive data could be included in error reports rather than removed automatically by Django. Triggering this requires: A site is using django-registration < 3.1.2, The site has detailed error reports (such as Django's emailed error reports to site staff/developers) enabled and a server-side error (HTTP 5xx) occurs during an attempt by a user to register an account. Under these conditions, recipients of the detailed error report will see all submitted data from the account-registration attempt, which may include the user's proposed credentials (such as a password). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ubernostrum/django
h as a password). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ubernostrum/django-registration/security/advisories/GHSA-58c7-px5v-82hh
CVE ID: CVE-2021-21417 State: PUBLISHED Published: 2021-04-29T17:10:15 Last Updated: 2024-08-03T18:09:16.083Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: FluidSynth Products: fluidsynth Problem Types: CWE-416 Description: fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FluidSynth/fluidsynth/issues/808 - https://github.com/FluidSynth/fluidsynth/pull/810 - https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxh
//github.com/FluidSynth/fluidsynth/pull/810 - https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9 - https://lists.debian.org/debian-lts-announce/2021/06/msg00027.html
CVE ID: CVE-2021-21418 State: PUBLISHED Published: 2021-03-31T17:35:15 Last Updated: 2024-08-03T18:09:16.081Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: PrestaShop Products: ps_emailsubscription Problem Types: CWE-79 Description: ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99 - https://github.com/PrestaShop/ps_email
hub.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99 - https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70 - https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1 - https://packagist.org/packages/prestashop/ps_emailsubscription
CVE ID: CVE-2021-21419 State: PUBLISHED Published: 2021-05-07T14:30:12 Last Updated: 2024-08-03T18:09:16.080Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: eventlet Products: eventlet Problem Types: CWE-400 Description: Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround
around, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5JZP4LZOSP7CUAM3GIRW6PIAWKH5VGB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WJFSBPLCNSZNHYQC4QDRDFRTEZRMD2L/
CVE ID: CVE-2021-21420 State: PUBLISHED Published: 2021-04-01T21:40:10 Last Updated: 2024-08-03T18:09:16.106Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: stripe Products: vscode-stripe Problem Types: CWE-74 Description: vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untrusted source-code repository containing malicious settings. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. The update addresses the vulnerability by modifying the way the extension validates its settings. Additional Analyst Notes: -
pdate addresses the vulnerability by modifying the way the extension validates its settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stripe/vscode-stripe/security/advisories/GHSA-j6x4-4622-8vv3
CVE ID: CVE-2021-21421 State: PUBLISHED Published: 2021-04-01T22:10:13 Last Updated: 2024-08-03T18:09:16.150Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: creharmony Products: node-etsy-client Problem Types: CWE-200 Description: node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/creharmony/node-etsy-client/security/advisories/GHSA-xw22-wv29-3299 - https://github.com/creharmony/node-etsy-client/commit/b4beb8ef
ode-etsy-client/security/advisories/GHSA-xw22-wv29-3299 - https://github.com/creharmony/node-etsy-client/commit/b4beb8ef080366c1a87dbf9e163051a446acaa7d
CVE ID: CVE-2021-21422 State: PUBLISHED Published: 2021-06-21T18:45:12 Last Updated: 2024-08-03T18:09:16.084Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: mongo-express Products: mongo-express Problem Types: CWE-79 Description: mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of di
interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p - https://github.com/mongo-express/mongo-express/issues/5
-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p - https://github.com/mongo-express/mongo-express/issues/577 - https://github.com/mongo-express/mongo-express/commit/f5e0d4931f856f032f22664b5e5901d5950cfd4b
CVE ID: CVE-2021-21423 State: PUBLISHED Published: 2021-04-06T18:35:14 Last Updated: 2024-08-03T18:09:16.091Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: projen Products: projen Problem Types: CWE-527 Description: `projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `NodeProject` project type (including any project type derived from it) include a `.github/workflows/rebuild-bot.yml` workflow that may allow any GitHub user to trigger execution of un-trusted c
clude a `.github/workflows/rebuild-bot.yml` workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the "main" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the "main" repository. The rebuild-bot workflow is triggered by comments including `@projen rebuild` on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an `issue_comment` event, and thus always executes with a `GITHUB_TOKEN` belonging to the repository into which the pull-request is made (this is in contrast with workflows triggere
THUB_TOKEN` belonging to the repository into which the pull-request is made (this is in contrast with workflows triggered by `pull_request` events, which always execute with a `GITHUB_TOKEN` belonging to the repository from which the pull-request is made). Repositories that do not have branch protection configured on their default branch (typically `main` or `master`) could possibly allow an untrusted user to gain access to secrets configured on the repository (such as NPM tokens, etc). Branch protection prohibits this escalation, as the managed `GITHUB_TOKEN` would not be able to modify the contents of a protected branch and affected workflows must be defined on the default branch. Addition
able to modify the contents of a protected branch and affected workflows must be defined on the default branch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projen/projen/security/advisories/GHSA-gg2g-m5wc-vccq - https://github.com/projen/projen/commit/36030c6a4b1acd0054673322612e7c70e9446643 - https://www.npmjs.com/package/projen
CVE ID: CVE-2021-21424 State: PUBLISHED Published: 2021-05-13T00:00:00 Last Updated: 2024-08-03T18:09:16.141Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: symfony Products: symfony Problem Types: CWE-200 Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for th
eturned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68 - https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KENRNLB3FYXYGDWRBH2PDBOZZKOD7VY4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRUS2H2SSOQWNLBD35SKIWIDQEMV2PD3/ - https://lists.fedoraproject.org/archives/list/pac
%40lists.fedoraproject.org/message/VRUS2H2SSOQWNLBD35SKIWIDQEMV2PD3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UC7BND775DVZDQT3RMGD2HVB2PKLJDJW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH7TMM5CHQYBFFGXWRPJDPB3SKCZXI2M/ - https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html
CVE ID: CVE-2021-21425 State: PUBLISHED Published: 2021-04-07T18:20:13 Last Updated: 2024-08-03T18:09:16.154Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N) Vendors: getgrav Products: grav-plugin-admin Problem Types: CWE-284 Description: Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability resul
e creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user. This vulnerability is fixed in version 1.10.8. Blocking access to the `/admin` path from untrusted sources can be applied as a workaround. Additional Analyst Notes: - CVE Program Container: References: - https://pentest.blog/unexpected-journey-7-gravcms-unauthenticate
l Analyst Notes: - CVE Program Container: References: - https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/ - https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-6f53-6qgv-39pj - http://packetstormsecurity.com/files/162283/GravCMS-1.10.7-Remote-Command-Execution.html - http://packetstormsecurity.com/files/162457/GravCMS-1.10.7-Remote-Command-Execution.html
CVE ID: CVE-2021-21426 State: PUBLISHED Published: 2021-04-21T20:15:18 Last Updated: 2024-08-03T18:09:16.157Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenMage Products: magento-lts Problem Types: CWE-502 Description: Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework 3. The vulnerability was assigned CVE-2021-3007 in Zend Framework. Additional Analyst Notes: - CVE Program Container: References: - https:/
y was assigned CVE-2021-3007 in Zend Framework. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m496-x567-f98c
CVE ID: CVE-2021-21427 State: PUBLISHED Published: 2021-04-21T20:55:14 Last Updated: 2024-08-03T18:09:16.095Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenMage Products: magento-lts Problem Types: CWE-89 Description: Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/securit
20.0.9. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fvrf-9428-527m
CVE ID: CVE-2021-21428 State: PUBLISHED Published: 2021-05-10T18:50:12 Last Updated: 2024-08-03T18:09:16.010Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenAPITools Products: openapi-generator Problem Types: CWE-269 Description: Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. Th
secure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-23x4-m842-fmwf - https://github.com/OpenAPITools/openapi-generator/pull/8788
CVE ID: CVE-2021-21429 State: PUBLISHED Published: 2021-04-27T20:00:18 Last Updated: 2024-08-03T18:09:16.096Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OpenAPITools Products: openapi-generator Problem Types: CWE-552 Description: OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. OpenAPI Generator maven plug-in creates insecure temporary files during the process. The issue has been patched with `Files.creat
enerator maven plug-in creates insecure temporary files during the process. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-867q-77cc-98mv - https://github.com/OpenAPITools/openapi-generator/pull/8795
CVE ID: CVE-2021-21430 State: PUBLISHED Published: 2021-05-10T19:25:12 Last Updated: 2024-08-03T18:09:16.157Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenAPITools Products: openapi-generator Problem Types: CWE-269 Description: OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints w
attacks. Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. Affected generators: `java` (jersey2, okhttp-gson (default library)), `scala-finch`. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-cqxr-xf2w-943w - https://github.com/OpenAPITools/openapi-generator/pull/8791 - https://github.com/OpenAPITools/openapi-generator/pull/8787
CVE ID: CVE-2021-21431 State: PUBLISHED Published: 2021-04-09T15:45:15 Last Updated: 2024-08-03T18:16:22.236Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H) Vendors: MirahezeBots Products: sopel-channelmgnt Problem Types: CWE-20, CWE-284 Description: sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from other channels but due to the wonder that is IRC and following RfCs, We have no POC for that. Freenode is not affected. This is fix
els but due to the wonder that is IRC and following RfCs, We have no POC for that. Freenode is not affected. This is fixed in version 2.0.1. As a workaround, do not use this plugin on networks where TARGMAX > 1. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/sopel-plugins.channelmgnt/ - https://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-23c7-6444-399m - https://github.com/MirahezeBots/sopel-channelmgnt/commit/7c96d400358221e59135f0a0be0744f3fad73856
CVE ID: CVE-2021-21432 State: PUBLISHED Published: 2021-04-09T18:10:14 Last Updated: 2024-08-03T18:16:22.403Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: go-vela Products: server Problem Types: CWE-285 Description: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com
ils. This is fixed in version 0.7.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4 - https://pkg.go.dev/github.com/go-vela/server - https://github.com/go-vela/server/releases/tag/v0.7.5 - https://github.com/go-vela/server/pull/337 - https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46
CVE ID: CVE-2021-21433 State: PUBLISHED Published: 2021-04-09T17:55:18 Last Updated: 2024-08-03T18:16:22.283Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: DEMON1A Products: Discord-Recon Problem Types: CWE-94 Description: Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote users to execute commands on the server resulting in serious issues. This flaw is patched in 0.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-65fm-5x64-gv9x - https://github.com/DEMON1A/Discord
- https://github.com/DEMON1A/Discord-Recon/security/advisories/GHSA-65fm-5x64-gv9x - https://github.com/DEMON1A/Discord-Recon/issues/6 - https://github.com/DEMON1A/Discord-Recon/commit/26e2a084679679cccdeeabbb6889ce120eff7e50
CVE ID: CVE-2021-21434 State: PUBLISHED Published: 2021-02-08T10:55:19.064437Z Last Updated: 2024-09-17T03:54:55.677Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: OTRS AG Products: Survey Problem Types: CWE-79 Description: Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wants to make changes in the survey). This issue affects: OTRS AG Survey 6.0.x version 6.0.20 and prior versions; 7.0.x version 7.0.19 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-01/
CVE ID: CVE-2021-21435 State: PUBLISHED Published: 2021-02-08T10:55:19.651769Z Last Updated: 2024-09-16T22:35:33.885Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-200 Description: Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface. This issue affects: OTRS AG OTRS 7.0.x version 7.0.23 and prior versions; 8.0.x version 8.0.10 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-02/
CVE ID: CVE-2021-21436 State: PUBLISHED Published: 2021-02-08T10:55:20.229135Z Last Updated: 2024-09-17T04:00:11.454Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: OTRSCIsInCustomerFrontend Problem Types: CWE-264 Description: Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2021-04/