Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-31028 State: PUBLISHED Published: 2024-04-05T17:46:33.082Z Last Updated: 2024-08-02T14:45:25.817Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: NVIDIA Products: nvJPEG2000 Library Problem Types: CWE-20 Description: NVIDIA nvJPEG2000 Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specially crafted input file. A successful exploit of this vulnerability might lead to a partial denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5517
CVE ID: CVE-2023-31029 State: PUBLISHED Published: 2024-01-12T18:31:32.801Z Last Updated: 2024-10-25T20:15:35.568Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: nvidia Products: DGX A100 Problem Types: CWE-121 Description: NVIDIA DGX A100 baseboard management controller (BMC) contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
ion disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5510
CVE ID: CVE-2023-31030 State: PUBLISHED Published: 2024-01-12T18:31:34.210Z Last Updated: 2025-06-03T14:04:31.296Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: nvidia Products: DGX A100 Problem Types: CWE-121 Description: NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5510
CVE ID: CVE-2023-31031 State: PUBLISHED Published: 2024-01-12T18:31:44.171Z Last Updated: 2025-10-09T19:13:55.867Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: nvidia Products: DGX A100 Problem Types: CWE-122 Description: NVIDIA DGX Station A100 and DGX Station A800 SBIOS contains a vulnerability where a user may cause a heap-based buffer overflow by local access. A successful exploit of this vulnerability may lead to code execution, denial of service, information disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5510
CVE ID: CVE-2023-31032 State: PUBLISHED Published: 2024-01-12T18:31:36.994Z Last Updated: 2025-06-03T14:04:20.919Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: nvidia Products: DGX A100 Problem Types: CWE-627 Description: NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5510
CVE ID: CVE-2023-31033 State: PUBLISHED Published: 2024-01-12T18:31:39.794Z Last Updated: 2025-06-03T14:04:15.648Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: nvidia Products: DGX A100 Problem Types: CWE-306 Description: NVIDIA DGX A100 BMC contains a vulnerability where a user may cause a missing authentication issue for a critical function by an adjacent network . A successful exploit of this vulnerability may lead to escalation of privileges, code execution, denial of service, information disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/det
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5510
CVE ID: CVE-2023-31034 State: PUBLISHED Published: 2024-01-12T18:31:41.194Z Last Updated: 2025-06-17T21:09:17.238Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H) Vendors: nvidia Products: DGX A100 Problem Types: CWE-190 Description: NVIDIA DGX A100 SBIOS contains a vulnerability where a local attacker can cause input validation checks to be bypassed by causing an integer overflow. A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5510
CVE ID: CVE-2023-31035 State: PUBLISHED Published: 2024-01-12T18:31:38.411Z Last Updated: 2024-08-30T19:10:51.835Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: nvidia Products: DGX A100 Problem Types: CWE-20 Description: NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may cause an SMI callout vulnerability that could be used to execute arbitrary code at the SMM level. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/det
CVE ID: CVE-2023-31036 State: PUBLISHED Published: 2024-01-12T17:11:38.579Z Last Updated: 2025-06-17T21:09:17.363Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: nvidia Products: Triton Inference Server Problem Types: CWE-23 Description: NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. Additional Analyst Not
ecution, denial of service, escalation of privileges, information disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5509
CVE ID: CVE-2023-31037 State: PUBLISHED Published: 2024-01-24T02:12:30.123Z Last Updated: 2025-06-09T20:48:11.032Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: NVIDIA Products: Bluefield 2 DPU BMC, BlueField 3 DPU BMC Problem Types: CWE-94 Description: NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful exploit of this vulnerability may lead to code execution on the OS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5511
CVE ID: CVE-2023-31038 State: PUBLISHED Published: 2023-05-08T08:54:10.234Z Last Updated: 2024-10-15T18:24:15.291Z Vendors: Apache Software Foundation Products: Apache Log4cxx Problem Types: CWE-89 Description: SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the database were properly escaped for SQL injection. This has been the case since at least version 0.9.0(released 2003-08-06) Note that Log4cxx is a C++ framework, so only C++ applications are affected. Before version 1.1.0, the ODBC appender was automatically part of Log4cxx if the library was found when compiling the library. As of version 1.1.0, this must be both explicitly
part of Log4cxx if the library was found when compiling the library. As of version 1.1.0, this must be both explicitly enabled in order to be compiled in. Three preconditions must be met for this vulnerability to be possible: 1. Log4cxx compiled with ODBC support(before version 1.1.0, this was auto-detected at compile time) 2. ODBCAppender enabled for logging messages to, generally done via a config file 3. User input is logged at some point. If your application does not have user input, it is unlikely to be affected. Users are recommended to upgrade to version 1.1.0 which properly binds the parameters to the SQL statement, or migrate to the new DBAppender class which supports an ODBC conne
properly binds the parameters to the SQL statement, or migrate to the new DBAppender class which supports an ODBC connection in addition to other databases. Note that this fix does require a configuration file update, as the old configuration files will not configure properly. An example is shown below, and more information may be found in the Log4cxx documentation on the ODBCAppender. Example of old configuration snippet: <appender name="SqlODBCAppender" class="ODBCAppender"> <param name="sql" value="INSERT INTO logs (message) VALUES ('%m')" /> ... other params here ... </appender> The migrated configuration snippet with new ColumnMapping parameters: <appender name="SqlODBCAppender" class=
/appender> The migrated configuration snippet with new ColumnMapping parameters: <appender name="SqlODBCAppender" class="ODBCAppender"> <param name="sql" value="INSERT INTO logs (message) VALUES (?)" /> <param name="ColumnMapping" value="message"/> ... other params here ... </appender> Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/vgjlpdf353vv91gryspwxrzj6p0fbjd9
CVE ID: CVE-2023-31039 State: PUBLISHED Published: 2023-05-08T08:57:14.714Z Last Updated: 2025-02-13T16:49:42.005Z Vendors: Apache Software Foundation Products: Apache bRPC Problem Types: CWE-20 Description: Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process. Solution: 1. upgrade to bRPC >= 1.5.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/ 2. If you are using
ist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2218 https://github.com/apache/brpc/pull/2218 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/jqpttrqbc38yhckgp67xk399hqxnz7jn - http://www.openwall.com/lists/oss-security/2023/05/08/1
CVE ID: CVE-2023-31041 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T16:15:50.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext, which might lead to possible information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/SA-2023047
CVE ID: CVE-2023-31042 State: PUBLISHED Published: 2023-10-02T22:39:02.597Z Last Updated: 2024-09-23T13:48:31.513Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Pure Storage Products: FlashBlade Purity Description: A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.purestorage.com/Employee_Handbooks/Technical_Services/PSIRT/Security_Bulletin_for_FlashBlade_Object_Store_Protocol_CVE-2023-31042
CVE ID: CVE-2023-31043 State: PUBLISHED Published: 2023-04-23T00:00:00.000Z Last Updated: 2025-02-04T16:26:08.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_commands. The fixed versions are 10.23.33, 11.18.29, 12.13.17, 13.9.13, and 14.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.enterprisedb.com/docs/epas/14/epas_rel_notes/epas14_6_0_rel_notes/ - https://www.enterprisedb.com/docs
es: - https://www.enterprisedb.com/docs/epas/14/epas_rel_notes/epas14_6_0_rel_notes/ - https://www.enterprisedb.com/docs/epas/13/epas_rel_notes/epas13_9_13_rel_notes/ - https://www.enterprisedb.com/docs/epas/12/epas_rel_notes/epas12_13_17_rel_notes/ - https://www.enterprisedb.com/docs/epas/11/epas_rel_notes/epas11_18_29_rel_notes/ - https://www.enterprisedb.com/docs/epas/10/epas_rel_notes/epas10_23_33_rel_notes/
CVE ID: CVE-2023-31045 State: PUBLISHED Published: 2023-04-24T00:00:00 Last Updated: 2024-08-02T14:45:25.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere." Additional A
finding because "any administrator that can configure a text format could easily allow Full HTML anywhere." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/backdrop/backdrop/releases/tag/1.24.2 - https://github.com/backdrop/backdrop-issues/issues/6065
CVE ID: CVE-2023-31046 State: PUBLISHED Published: 2023-10-19T00:00:00 Last Updated: 2024-09-13T14:49:14.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could potentially allow an authenticated attacker to achieve read-only access to the server's filesystem, because requests beginning with "GET /ui/static/..//.." reach getStaticContent in UIContentResource.class in the static-content-files servlet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219#security-
Program Container: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219#security-notifications - https://www.papercut.com/kb/Main/SecurityBulletinJune2023 - https://research.aurainfosec.io/disclosure/papercut/ - https://web.archive.org/web/20230814061444/https://research.aurainfosec.io/disclosure/papercut/
CVE ID: CVE-2023-31047 State: PUBLISHED Published: 2023-05-07T00:00:00.000Z Last Updated: 2025-01-29T15:51:24.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/forum/#%21forum/django-announce - https://
m Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.2/releases/security/ - https://www.djangoproject.com/weblog/2023/may/03/security-releases/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD/ - https://security.netapp.com/advisory/ntap-20230609-0008/
CVE ID: CVE-2023-31048 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-10-09T13:26:47.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OPCFoundation/UA-.NETStandard/releases - https://github.com/OPCFoundation/UA-.NETStandard/releases/tag/1.4.371.86 - https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-31048.pdf
CVE ID: CVE-2023-31056 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T19:40:12.691Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employed. The fixed versions are 5.15.4, 5.16.2, 5.17.3, and 6.0.x. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support1.cloverdx.com/hc/en-us/articles/8484869595164-Security-advisory-April-2023
CVE ID: CVE-2023-31058 State: PUBLISHED Published: 2023-05-22T12:54:12.153Z Last Updated: 2024-10-10T20:51:23.077Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7674 https://github.com/apache/inlong/pull/7674 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
/inlong/pull/7674 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/bkcgbn9l61croxfyspf7xd42qb189s3z
CVE ID: CVE-2023-31059 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T19:37:41.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cybir.com/2023/cve/poc-repetier-server-140/ - https://www.repetier-server.com/download-repetier-server/
CVE ID: CVE-2023-31060 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T19:35:51.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: Repetier Server through 1.4.10 executes as SYSTEM. This can be leveraged in conjunction with CVE-2023-31059 for full compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cybir.com/2023/cve/poc-repetier-server-140/ - https://www.repetier-server.com/download-repetier-server/
CVE ID: CVE-2023-31061 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T19:29:05.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Repetier Server through 1.4.10 does not have CSRF protection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cybir.com/2023/cve/poc-repetier-server-140/ - https://www.repetier-server.com/download-repetier-server/
CVE ID: CVE-2023-31062 State: PUBLISHED Published: 2023-05-22T15:47:35.709Z Last Updated: 2024-10-09T19:55:50.624Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-269 Description: Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. When the attacker has access to a valid (but unprivileged) account, the exploit can be executed using Burp Suite by sending a login request and following it with a subsequent HTTP request using the returned cookie. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://gith
s are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/btorjbo9o71h22tcvxzy076022hjdzq0
CVE ID: CVE-2023-31064 State: PUBLISHED Published: 2023-05-22T15:44:22.343Z Last Updated: 2024-10-09T19:53:56.810Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-552 Description: Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. the user in InLong could cancel an application that doesn't belongs to it. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7799 https://github.com/apache/inlong/pull/7799 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ub.com/apache/inlong/pull/7799 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/1osd2k3t3qol2wdsswqtr9gxdkf78n00
CVE ID: CVE-2023-31065 State: PUBLISHED Published: 2023-05-22T15:40:56.183Z Last Updated: 2024-10-09T17:18:40.599Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-613 Description: Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old session can be used by an attacker even after the user has been deleted or the password has been changed. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 , https://github.com/apache/inlong/pull/7884 https://github.com/apache/
/7836 https://github.com/apache/inlong/pull/7836 , https://github.com/apache/inlong/pull/7884 https://github.com/apache/inlong/pull/7884 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/to7o0n2cks0omtwo6mhh5cs2vfdbplqf
CVE ID: CVE-2023-31066 State: PUBLISHED Published: 2023-05-22T15:35:41.768Z Last Updated: 2024-10-09T17:17:20.748Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-552 Description: Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Different users in InLong could delete, edit, stop, and start others' sources! Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7775 https://github.com/apache/inlong/pull/7775 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
github.com/apache/inlong/pull/7775 to solve it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/x7y05wo37sq5l9fnmmsjh2dr9kcjrcxf