Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-32680 State: PUBLISHED Published: 2021-07-12T13:25:16 Last Updated: 2024-08-03T23:25:31.089Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-778 Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is supposed to be logged. This issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/
.13, 20.0.11, and 21.0.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fxpq-wq7c-vppf - https://github.com/nextcloud/server/pull/27024 - https://hackerone.com/reports/1200810 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/ - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32681 State: PUBLISHED Published: 2021-06-17T16:25:11 Last Updated: 2024-08-03T23:25:31.147Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: wagtail Products: wagtail Problem Types: CWE-79 Description: Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`, `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block does not specify a template for rendering, the tag
similar user-defined block derived from `FieldBlock`), and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This could allow users to insert arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author StreamField content (i.e. users with 'editor' access to the Wagtail admin). Patched versions have been released as Wagtail 2.11.8 (for the LTS 2.11 branch), Wagtail 2.12.5, and Wagtail 2.13.2 (for the current 2.13 branch). As a workaround, site implementors who are unable to upgrade to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `Cha
e to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` / `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock, such as a StructBlock, are unaffected). In these cases, the tag can be replaced with Django's `{{ ... }}` syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wagtail/wagtail/security/advisories/GHSA-xfrw-hxr5-ghqf - https://github.com/wagtail/wag
eferences: - https://github.com/wagtail/wagtail/security/advisories/GHSA-xfrw-hxr5-ghqf - https://github.com/wagtail/wagtail/releases/tag/v2.11.8 - https://github.com/wagtail/wagtail/releases/tag/v2.12.5 - https://github.com/wagtail/wagtail/releases/tag/v2.13.2
CVE ID: CVE-2021-32682 State: PUBLISHED Published: 2021-06-14T16:45:11 Last Updated: 2024-08-03T23:25:31.074Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Studio-42 Products: elFinder Problem Types: CWE-918, CWE-22, CWE-78 Description: elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication. Add
issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Studio-42/elFinder/security/advisories/GHSA-wph3-44rj-92pr - https://github.com/Studio-42/elFinder/commit/a106c350b7dfe666a81d6b576816db9fe0899b17 - http://packetstormsecurity.com/files/164173/elFinder-Archive-Command-Injection.html - https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities/
CVE ID: CVE-2021-32683 State: PUBLISHED Published: 2021-06-15T19:11:58 Last Updated: 2024-08-03T23:25:31.067Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: wireapp Products: wire-webapp Problem Types: CWE-79 Description: wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab (right click -> open in new tab, or copy the URL and paste it in the URL bar), an the image payload is executed on the domain hosting the app (app.wire.com). In particular, if an image contains malicious code in addition to
xecuted on the domain hosting the app (app.wire.com). In particular, if an image contains malicious code in addition to the actual picture, this code is executed on app.wire.com. This allows the attacker to fully control the user account. The vulnerability was patched in version 2021-06-01-production.0. As a workaround, users should not try to open image URLs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wireapp/wire-webapp/security/advisories/GHSA-382j-mmc8-m5rw - https://github.com/wireapp/wire-webapp/commit/056e39d327bb10c1b0958dfbea0c39752692a1b0
CVE ID: CVE-2021-32684 State: PUBLISHED Published: 2021-06-14T23:05:09 Last Updated: 2024-08-03T23:25:31.123Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: scandipwa Products: create-magento-app Problem Types: CWE-670 Description: magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems. Additional Analyst Notes: - CVE P
ds, effectively making them unusable. Version 1.5.3 contains patches for the problems. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/scandipwa/create-magento-app/security/advisories/GHSA-52qp-gwwh-qrg4 - https://github.com/scandipwa/create-magento-app/commit/89115db7031e181eb8fb4ec2822bc6cab88e7071
CVE ID: CVE-2021-32685 State: PUBLISHED Published: 2021-06-16T00:25:11 Last Updated: 2024-08-03T23:25:31.108Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TogaTech Products: tEnvoy Problem Types: CWE-347 Description: tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In
-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TogaTech/tEnvoy/security/advisories/GHSA-7r96-8g3x-g36m - https://github.com/TogaTech/tEnvoy/commit/a121b34a45e289d775c62e58841522891dee686b - https://github.com/TogaTech/tEnvoy/releases/tag/v7.0.3
CVE ID: CVE-2021-32686 State: PUBLISHED Published: 2021-07-23T00:00:00.000Z Last Updated: 2025-11-04T16:09:14.172Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pjsip Products: pjproject Problem Types: CWE-362 Description: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both iss
ccepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-cv8x-p47p-99wr - https://github.com/pjsip/pjproject/pull/2716 - https://github.com/pjsip/pjproject/commit/d5f95aa066f878b0aef6a64e60b61e8626e664cd - https://github.com/pjsip/pjproject/releases/tag/2.11.1 - https://www.debian.org/security/2021/dsa-4999 - https://lists.debian.org/debian-lts-an
p/pjproject/releases/tag/2.11.1 - https://www.debian.org/security/2021/dsa-4999 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://security.gentoo.org/glsa/202210-37
CVE ID: CVE-2021-32687 State: PUBLISHED Published: 2021-10-04T17:55:10 Last Updated: 2024-08-03T23:25:31.090Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-190, CWE-680 Description: Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The p
ries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q - https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f - https://lists.fedoraproject
8x9w-r27q - https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/ - https://www.debian.org/security/2021/dsa-5001 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211104-0003/ - https://security.gentoo.org/glsa/202209-17
CVE ID: CVE-2021-32688 State: PUBLISHED Published: 2021-07-12T13:45:13 Last Updated: 2024-08-03T23:25:31.063Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-285 Description: Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13,
. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-48m7-7r2r-838r - https://github.com/nextcloud/server/pull/27000 - https://hackerone.com/reports/1193321 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWR
93321 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/ - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32689 State: PUBLISHED Published: 2021-07-12T18:45:15 Last Updated: 2024-08-03T23:25:31.169Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-708, CWE-200 Description: Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and 11.3.0. As a workaround, don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some
As a workaround, don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some user providers may allow doing so. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xv6f-344w-895c - https://github.com/nextcloud/spreed/pull/5633 - https://hackerone.com/reports/1200700 - https://github.com/nextcloud/spreed/releases/tag/v11.2.2 - https://github.com/nextcloud/spreed/releases/tag/v11.3.0
CVE ID: CVE-2021-32690 State: PUBLISHED Published: 2021-06-16T22:10:10 Last Updated: 2024-08-03T23:25:31.090Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: helm Products: helm Problem Types: CWE-200 Description: Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and passw
1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf - https://github.com/helm/helm/releases/tag/v3.6.1
CVE ID: CVE-2021-32691 State: PUBLISHED Published: 2021-06-16T21:45:13 Last Updated: 2024-08-03T23:25:31.122Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ApollosProject Products: apollos-apps Problem Types: CWE-303 Description: Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a w
s any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one's server by overriding the `create` data source method on the `People` class. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ApollosProject/apollos-apps/security/advisories/GHSA-r578-pj6f-r4ff - https://github.com/ApollosProject/apollos-apps/commit/cb5f8f1c0b24f1b215b2bb5eb6f9a8e16d728ce2 - https://github.com/ApollosProject/apollos-apps/releases/tag/v2.20.0
CVE ID: CVE-2021-32692 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-15T13:30:00.882Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: ActivityWatch Products: Activity Watch Problem Types: CWE-77 Description: Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine with ActivityWatch running. The attacker can exploit this vulnerability by having the user visiting a website with the page title set to a malicious string. An attacker could use another application to accomplish the same, but the web browser is the most likely attack
string. An attacker could use another application to accomplish the same, but the web browser is the most likely attack vector. This issue is patched in version 0.11.0. As a workaround, users can run the latest version of aw-watcher-window from source, or manually patch the `printAppTitle.scpt` file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-3x6w-q32m-jqf3
CVE ID: CVE-2021-32693 State: PUBLISHED Published: 2021-06-17T22:40:11 Last Updated: 2024-08-03T23:25:31.124Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: symfony Products: symfony Problem Types: CWE-287 Description: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the applicati
ll other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrq - https://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129 - https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab347
4c31219773a558b019ee12e54572174ff8129 - https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728 - https://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one
CVE ID: CVE-2021-32694 State: PUBLISHED Published: 2021-06-17T21:15:12 Last Updated: 2024-08-03T23:25:31.058Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-248 Description: Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h2gm-m374-99vc - https://github.co
ferences: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h2gm-m374-99vc - https://github.com/nextcloud/android/pull/7919 - https://hackerone.com/reports/859136
CVE ID: CVE-2021-32695 State: PUBLISHED Published: 2021-06-17T20:50:11 Last Updated: 2024-08-03T23:25:31.133Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choose the malicious app. The shared preferences contain some limited private data such as push tokens and the account name. The vulnerability
p. The shared preferences contain some limited private data such as push tokens and the account name. The vulnerability is patched in version 3.16.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-25m9-cf6c-qf2c - https://github.com/nextcloud/android/pull/8433 - https://hackerone.com/reports/1142918
CVE ID: CVE-2021-32696 State: PUBLISHED Published: 2021-06-18T19:35:13 Last Updated: 2024-08-03T23:25:31.066Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ericnorris Products: striptags Problem Types: CWE-241, CWE-79 Description: The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS. A
trol the shape of their input, e.g. if query parameters are passed directly into the function. This can lead to a XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ericnorris/striptags/security/advisories/GHSA-qxg5-2qff-p49r - https://github.com/ericnorris/striptags/commit/f252a6b0819499cd65403707ebaf5cc925f2faca - https://github.com/ericnorris/striptags/releases/tag/v3.2.0 - https://www.npmjs.com/package/striptags
CVE ID: CVE-2021-32697 State: PUBLISHED Published: 2021-06-21T18:15:13 Last Updated: 2024-08-03T23:25:31.146Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: neos Products: form Problem Types: CWE-20 Description: neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent. Form Finishers can be adjusted in a way that they only execute an action if the submit