Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-37890 State: PUBLISHED Published: 2023-11-30T15:13:59.975Z Last Updated: 2024-08-02T17:23:27.659Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: WPOmnia Products: KB Support – WordPress Help Desk and Knowledge Base Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88. Additional Analyst Notes: - CVE Program Container: References: - https
Desk and Knowledge Base: from n/a through 1.5.88. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/kb-support/wordpress-kb-support-wordpress-help-desk-plugin-1-5-88-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2023-37891 State: PUBLISHED Published: 2023-10-03T09:34:38.171Z Last Updated: 2024-09-20T13:18:52.802Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: OptiMonk Products: OptiMonk: Popups, Personalization & A/B Testing Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin <= 2.0.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/exit-intent-popups-by-optimonk/wordpress-exit-popups-onsite-retargeting-by-optimonk-plugin-2-0-4-cross-site-request-forgery-csrf?_
t-popups-by-optimonk/wordpress-exit-popups-onsite-retargeting-by-optimonk-plugin-2-0-4-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-37892 State: PUBLISHED Published: 2023-07-18T12:31:17.966Z Last Updated: 2024-09-26T15:11:58.594Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Kemal YAZICI - PluginPress Products: Shortcode IMDB Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin <= 6.0.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/shortcode-imdb/wordpress-shortcode-imdb-plugin-6-0-8-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-37893 State: PUBLISHED Published: 2023-09-01T11:04:35.426Z Last Updated: 2024-09-24T19:07:14.421Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Chop-Chop Products: Coming Soon Chop Chop Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chop-Chop Coming Soon Chop Chop plugin <= 2.2.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cc-coming-soon/wordpress-coming-soon-chop-chop-plugin-2-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-37894 State: PUBLISHED Published: 2023-07-27T14:34:43.085Z Last Updated: 2024-09-25T16:57:21.334Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: RadiusTheme Products: Variation Images Gallery for WooCommerce Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RadiusTheme Variation Images Gallery for WooCommerce plugin <= 2.3.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-product-variation-gallery/wordpress-variation-images-gallery-for-woocommerce-plugin-2-3-3-reflected-cross-site-scripting-xss-v
t-variation-gallery/wordpress-variation-images-gallery-for-woocommerce-plugin-2-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-37895 State: PUBLISHED Published: 2023-07-25T14:02:10.036Z Last Updated: 2025-02-13T17:01:36.333Z Vendors: Apache Software Foundation Products: Apache Jackrabbit Webapp (jackrabbit-webapp), Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components) Problem Types: CWE-502 Description: Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update
s", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases. How to check
ss altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases. How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone. The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like "netstat" can be used to check. RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container a
04 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control. Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet: <servlet> <servlet-name>RMI</servlet-name> <servlet-class>org.apache.jackrabbit.servlet.remote.RemoteBindingServlet</servlet-class> </servlet> <servlet-mapping> <servlet-name>RMI</servlet-name> <url-pattern>/rmi</url-pattern> </servlet-mapping> Find the bootstrap.properties file (in $REPOSITORY_HOME), and set rmi.enabled=false a
i</url-pattern> </servlet-mapping> Find the bootstrap.properties file (in $REPOSITORY_HOME), and set rmi.enabled=false and also remove rmi.host rmi.port rmi.url-pattern If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/list.html?users@jackrabbit.apache.org - https://lists.apache.org/thread/j03b3qdhborc2jrhdc4d765d3jkh8bfw - http://seclists.org/fulldisclosure/2023/Jul/43 - http://www.openwall.com/lists/oss-security/2023/07/25/8
CVE ID: CVE-2023-37896 State: PUBLISHED Published: 2023-08-04T15:34:11.804Z Last Updated: 2024-10-08T18:13:54.292Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: projectdiscovery Products: nuclei Problem Types: CWE-22 Description: Nuclei is a vulnerability scanner. Prior to version 2.9.9, a security issue in the Nuclei project affected users utilizing Nuclei as Go code (SDK) running custom templates. This issue did not affect CLI users. The problem was related to sanitization issues with payload loading in sandbox mode. There was a potential risk with payloads loading in sandbox mode. The issue occurred due to relative paths not being converted to absolute pa
risk with payloads loading in sandbox mode. The issue occurred due to relative paths not being converted to absolute paths before doing the check for `sandbox` flag allowing arbitrary files to be read on the filesystem in certain cases when using Nuclei from `Go` SDK implementation. This issue has been fixed in version 2.9.9. The maintainers have also enabled sandbox by default for filesystem loading. This can be optionally disabled if required. The `-sandbox` option has been deprecated and is now divided into two new options: `-lfa` (allow local file access) which is enabled by default and `-lna` (restrict local network access) which can be enabled by users optionally. The `-lfa` allows fi
led by default and `-lna` (restrict local network access) which can be enabled by users optionally. The `-lfa` allows file (payload) access anywhere on the system (disabling sandbox effectively), and `-lna` blocks connections to the local/private network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-2xx4-jj5v-6mff - https://github.com/projectdiscovery/nuclei/pull/3927 - https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.9
CVE ID: CVE-2023-37897 State: PUBLISHED Published: 2023-07-18T20:22:13.008Z Last Updated: 2024-10-18T17:19:07.910Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: getgrav Products: grav Problem Types: CWE-74, CWE-393 Description: Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` che
rousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP
e. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getgrav/grav/security/advisories/GHSA-9436-3gmp-4f53 - https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b - https://github.com/getgrav/grav/commit/b4c62101a43051fc7f5349c7d0a5b6085375c1d7
CVE ID: CVE-2023-37898 State: PUBLISHED Published: 2024-06-21T19:45:19.982Z Last Updated: 2024-08-02T17:23:27.755Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: laurent22 Products: joplin Problem Types: CWE-79 Description: Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows an untrusted note opened in safe mode to execute arbitrary code. `packages/renderer/MarkupToHtml.ts` renders note content in safe mode by surrounding it with <pre> and </pre>, without escaping any interior HTML tags. Thus, an attacker can create a note that closes the opening <pre> tag, then includes HTML that runs JavaScript.
ML tags. Thus, an attacker can create a note that closes the opening <pre> tag, then includes HTML that runs JavaScript. Because the rendered markdown iframe has the same origin as the toplevel document and is not sandboxed, any scripts running in the preview iframe can access the top variable and, thus, access the toplevel NodeJS `require` function. `require` can then be used to import modules like fs or child_process and run arbitrary commands. This issue has been addressed in version 2.12.9 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com
nerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/laurent22/joplin/security/advisories/GHSA-hjmq-3qh4-g2r8 - https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox
CVE ID: CVE-2023-37899 State: PUBLISHED Published: 2023-07-19T19:45:31.386Z Last Updated: 2024-10-28T15:12:04.645Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: feathersjs Products: feathers Problem Types: CWE-754 Description: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade
cket.emit('find', { toString: '' })`. A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/feathersjs/feathers/security/advisories/GHSA-hhr9-rh25-hvf9 - https://github.com/feathersjs/feathers/pull/3241 - https://github.com/feathersjs/feathers/pull/3242 - https://github.com/feathersjs/feathers/blob/crow/CHANGELOG.md#4518-2023-07-19 - https://github.com/feathersjs/feathers/blob/dove/CHANGELOG.md#508-2023-07-19
CVE ID: CVE-2023-37900 State: PUBLISHED Published: 2023-07-27T15:50:54.954Z Last Updated: 2024-10-15T15:29:41.961Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:L) Vendors: crossplane Products: crossplane Problem Types: CWE-400, CWE-770 Description: Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled. The impact is limited due to the high privileg
all the available memory and therefore in the container being OOMKilled. The impact is limited due to the high privileges required to be able to create the Package and the eventually consistency nature of controller. This issue is fixed in versions 1.11.5, 1.12.3, and 1.13.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/crossplane/crossplane/security/advisories/GHSA-68p4-95xf-7gx8 - https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf
CVE ID: CVE-2023-37901 State: PUBLISHED Published: 2023-07-21T18:14:25.481Z Last Updated: 2024-10-10T18:58:39.624Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: indico Products: indico Problem Types: CWE-79 Description: Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content. Considering that event organizers may want to delete suspicious-looking content when spotting it, there i
this content. Considering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content. Users need to update to Indico 3.2.6 as soon as possible. See the docs for instructions on how to update. Users who cannot upgrade should only let trustworthy users manage categories, create events or upload materials ("submission" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management. Note that a conf
s should already be the case in a properly-configured setup when it comes to category/event management. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/indico/indico/security/advisories/GHSA-fmqq-25x9-c6hm - https://github.com/indico/indico/commit/2ee636d318653fb1ab193803dafbfe3e371d4130 - https://docs.getindico.io/en/stable/installation/upgrade/ - https://github.com/indico/indi
fb1ab193803dafbfe3e371d4130 - https://docs.getindico.io/en/stable/installation/upgrade/ - https://github.com/indico/indico/releases/tag/v3.2.6
CVE ID: CVE-2023-37902 State: PUBLISHED Published: 2023-07-25T20:05:40.615Z Last Updated: 2024-10-03T18:59:13.773Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-252 Description: Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that the if the compiler has been convinced to write to the 0 memory location with specially crafted data (generally, this can happen with a
ler has been convinced to write to the 0 memory location with specially crafted data (generally, this can happen with a hashmap access or immutable read) just before the ecrecover, a signature check might pass on an invalid signature. Version 0.3.10 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-f5x6-7qgp-jhf3 - https://github.com/vyperlang/vyper/commit/019a37ab98ff53f04fecfadf602b6cd5ac748f7f
CVE ID: CVE-2023-37903 State: PUBLISHED Published: 2023-07-21T19:42:09.346Z Last Updated: 2025-11-03T21:48:55.029Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: patriksimek Products: vm2 Problem Types: CWE-78 Description: vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software. Additional Anal
ndbox. There are no patches and no known workarounds. Users are advised to find an alternative software. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4 - https://security.netapp.com/advisory/ntap-20230831-0007/
CVE ID: CVE-2023-37904 State: PUBLISHED Published: 2023-07-28T15:09:08.049Z Last Updated: 2024-10-10T16:05:21.191Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-362 Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. As a workaround, use restrict to email address invites. Additional Analyst Notes: - CVE
a` and `tests-passed` branches. As a workaround, use restrict to email address invites. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-6wj5-4ph2-c7qg - https://github.com/discourse/discourse/commit/62a609ea2d0645a27ee8adbb01ce10a5e03a600b
CVE ID: CVE-2023-37905 State: PUBLISHED Published: 2023-07-21T19:35:49.656Z Last Updated: 2024-10-21T13:07:15.669Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: w8tcha, typo3 Products: CKEditor-WordCount-Plugin, cms-rte-ckeditor Problem Types: CWE-79 Description: ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this
.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/w8tcha/CKEditor-WordCount-Plugin/security/advisories/GHSA-q9w4-w667-qqj4 - https://github.com/w8tcha/CKEditor-WordCount-Plugin/commit/0f03b3e5b7c1409998a13aba3a95396e6fa349d8 - https://github.com/w8tcha/CKEditor-WordCount-Plugin/commit/a4b154bdf35b3465320136fcb078f196b437c2f1 - https://github.com/TYPO3/typo3/security/advisories/GHSA-m8fw-p3cr-6jqc - https://typo3.org/security/advisory/typo3-core-sa-2023-004
CVE ID: CVE-2023-37906 State: PUBLISHED Published: 2023-07-28T15:13:46.848Z Last Updated: 2024-10-10T16:05:02.743Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-770 Description: Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerabi
nch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-pjv6-47x6-mx7c - https://github.com/discourse/discourse/commit/dcc825bda505a344eda403a1b8733f30e784034a
CVE ID: CVE-2023-37907 State: PUBLISHED Published: 2023-07-25T20:11:50.843Z Last Updated: 2024-10-03T18:51:28.195Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cryptomator Products: cryptomator Problem Types: CWE-269 Description: Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue. Additional Analyst Notes: - CVE Progra
ve CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hpjq - https://github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670b868fa208c - https://github.com/cryptomator/cryptomator/releases/tag/1.9.2