Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-45769 State: PUBLISHED Published: 2023-10-24T12:08:05.859Z Last Updated: 2025-02-19T21:20:27.362Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Alex Raven Products: WP Report Post Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-report-post/wordpress-wp-report-post-plugin-2-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45770 State: PUBLISHED Published: 2023-10-24T12:16:08.741Z Last Updated: 2025-02-19T21:20:04.111Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Fastwpspeed Products: Fast WP Speed Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fastwpspeed Fast WP Speed plugin <= 1.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/fast-wp-speed/wordpress-fast-wp-speed-plugin-1-0-0-reflected-cross-site-scripting-vulnerability?_s_id=cve
CVE ID: CVE-2023-45771 State: PUBLISHED Published: 2024-03-26T08:27:55.700Z Last Updated: 2024-08-06T16:01:15.874Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Contact Form With Captcha Products: Contact Form With Captcha Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Contact Form With Captcha allows Reflected XSS.This issue affects Contact Form With Captcha: from n/a through 1.6.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact-form-with-captcha/wordpress-contact-form-with
hment: References: - https://patchstack.com/database/vulnerability/contact-form-with-captcha/wordpress-contact-form-with-captcha-plugin-1-6-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45772 State: PUBLISHED Published: 2023-10-24T12:18:44.978Z Last Updated: 2024-09-09T21:00:59.542Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Scribit Products: Proofreading Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Scribit Proofreading plugin <= 1.0.11 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/proofreading/wordpress-proofreading-plugin-1-0-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-45773 State: PUBLISHED Published: 2023-12-04T22:40:54.826Z Last Updated: 2024-08-28T17:39:45.693Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7b30443dac7bb9138275c909549110191bcbcae9 - https://source.android.com/security/bulletin/20
/packages/modules/Bluetooth/+/7b30443dac7bb9138275c909549110191bcbcae9 - https://source.android.com/security/bulletin/2023-12-01
CVE ID: CVE-2023-45774 State: PUBLISHED Published: 2023-12-04T22:40:55.035Z Last Updated: 2024-12-02T17:27:25.244Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/f229f0e55b07416badaca0e3493db5af0943c9eb - https://source.android.com/s
roid.googlesource.com/platform/frameworks/base/+/f229f0e55b07416badaca0e3493db5af0943c9eb - https://source.android.com/security/bulletin/2023-12-01
CVE ID: CVE-2023-45775 State: PUBLISHED Published: 2023-12-04T22:40:55.237Z Last Updated: 2024-08-02T20:29:32.446Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8e3b3fc918b3ea77754c6d82ab0f09cce81e145b - https://source.android.com/security/bulletin/2023-12-01
CVE ID: CVE-2023-45776 State: PUBLISHED Published: 2023-12-04T22:40:55.427Z Last Updated: 2024-08-02T20:29:31.611Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8e3b3fc918b3ea77754c6d82ab0f09cce81e145b - https://source.android.com/security/bulletin/2023-12-01
CVE ID: CVE-2023-45777 State: PUBLISHED Published: 2023-12-04T22:40:55.603Z Last Updated: 2024-08-02T20:29:32.338Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6 - https://android.g
https://android.googlesource.com/platform/frameworks/base/+/f810d81839af38ee121c446105ca67cb12992fc6 - https://android.googlesource.com/platform/frameworks/base/+/f4644b55d36a549710ba35b6fb797ba744807da6 - https://source.android.com/security/bulletin/2023-12-01
CVE ID: CVE-2023-45779 State: PUBLISHED Published: 2023-12-04T22:40:55.784Z Last Updated: 2024-08-02T20:29:32.420Z Vendors: Google Products: Android Problem Types: Unknown Description: In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. More details on this can be found in the referenced links. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2023-12-01 - https://rtx.meta.security/exploitation/2024/01/30/Android-
: - https://source.android.com/security/bulletin/2023-12-01 - https://rtx.meta.security/exploitation/2024/01/30/Android-vendors-APEX-test-keys.html - https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-wmcc-g67r-9962 - https://www.fairphone.com/en/2024/01/30/security-update-apex-modules-vulnerability-fixed/
CVE ID: CVE-2023-45780 State: PUBLISHED Published: 2023-10-30T17:01:39.813Z Last Updated: 2024-09-06T20:03:02.310Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/docs/security/bulletin/android-14
CVE ID: CVE-2023-45781 State: PUBLISHED Published: 2023-12-04T22:40:55.978Z Last Updated: 2024-08-28T17:36:58.917Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/a218e5be5e4049eae3b321f2a535a128d65d00b6 - https://android.googlesource.com/platform/packages/modules/
dules/Bluetooth/+/a218e5be5e4049eae3b321f2a535a128d65d00b6 - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ea81185c89097500559d61b3d49fb9633899e848 - https://source.android.com/security/bulletin/2023-12-01
CVE ID: CVE-2023-45793 State: PUBLISHED Published: 2024-03-12T10:21:46.998Z Last Updated: 2024-08-02T20:29:32.447Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Siemens Products: Siveillance Control Problem Types: CWE-863 Description: A vulnerability has been identified in Siveillance Control (All versions >= V2.8 < V3.1.1). The affected product does not properly check the list of access groups that are assigned to an individual user. This could enable a locally logged on user to gain write privileges for objects where they only have read privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-port
privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-145196.html
CVE ID: CVE-2023-45794 State: PUBLISHED Published: 2023-11-14T11:04:16.602Z Last Updated: 2025-01-08T16:39:58.374Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Mendix Applications using Mendix 10, Mendix Applications using Mendix 7, Mendix Applications using Mendix 8, Mendix Applications using Mendix 9 Problem Types: CWE-294 Description: A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A ca
pplications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9 (All versions < V9.24.10). A capture-replay flaw in the platform could have an impact to apps built with the platform, if certain preconditions are met that depend on the app's model and access control design. This could allow authenticated attackers to access or modify objects without proper authorization, or escalate privileges in the context of the vulnerable app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-084182.pdf
CVE ID: CVE-2023-45797 State: PUBLISHED Published: 2023-10-30T06:16:42.457Z Last Updated: 2024-09-06T20:48:15.834Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dream Security Products: MagicLine4NX Problem Types: CWE-120 Description: A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&nttId=71023&menuNo=205020
CVE ID: CVE-2023-45798 State: PUBLISHED Published: 2023-10-30T06:17:14.332Z Last Updated: 2024-08-02T20:29:32.201Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Yettiesoft Products: VestCert Problem Types: CWE-829 Description: In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&nttId=71008&menuNo=205020
CVE ID: CVE-2023-45799 State: PUBLISHED Published: 2023-10-30T06:17:21.370Z Last Updated: 2024-09-06T20:46:12.030Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MLSoft Products: TCO!stream Problem Types: CWE-494 Description: In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attacker to make the victim download and execute arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&nttId=71008&menuNo=205020
CVE ID: CVE-2023-45800 State: PUBLISHED Published: 2023-12-13T01:46:40.239Z Last Updated: 2024-08-02T20:29:32.484Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Hanbiro Products: Hanbiro groupware Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hanbiro Hanbiro groupware allows Information Elicitation.This issue affects Hanbiro groupware: from V3.8.79 before V3.8.81.1. Additional Analyst Notes: - CVE Program Container: References: - https://hanbiro.com/
CVE ID: CVE-2023-45801 State: PUBLISHED Published: 2023-12-13T02:05:32.235Z Last Updated: 2024-08-02T20:29:32.456Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Nadatel Products: DVR Problem Types: CWE-287 Description: Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.nadatel.com/
CVE ID: CVE-2023-45802 State: PUBLISHED Published: 2023-10-23T06:50:23.991Z Last Updated: 2024-10-14T09:01:44.836Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-404 Description: When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during te
resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://httpd.apache.org/security/vulnerabilities_24.html
CVE ID: CVE-2023-45803 State: PUBLISHED Published: 2023-10-17T19:43:45.404Z Last Updated: 2025-11-03T21:49:53.115Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: urllib3 Products: urllib3 Problem Types: CWE-200 Description: urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from dif
this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive
of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stri
ts=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4 - https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9 - https://www.rfc-editor.org/rfc/rfc9110.html#name-get - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAG
NRX/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/
CVE ID: CVE-2023-45804 State: REJECTED Published: N/A Last Updated: 2023-10-30T22:11:53.424Z Description: No description available.
CVE ID: CVE-2023-45805 State: PUBLISHED Published: 2023-10-20T18:12:24.701Z Last Updated: 2024-09-12T15:01:47.526Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: pdm-project Products: pdm Problem Types: CWE-20 Description: pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project `foo` can be targeted by creating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` v
reating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` version `2`, while PDM will see this as project `foo` version `2-2`. The version must only be `parseable as a version` and the filename must be a prefix of the project name, but it's not verified to match the version being installed. Version `2-2` is also not a valid normalized version per PEP 440. Matching the project name exactly (not just prefix) would fix the issue. When installing dependencies with PDM, what's actually installed could differ from what's listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attack
s listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version. This issue has been addressed in commit `6853e2642df` which is included in release version `2.9.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pdm-project/pdm/security/advisories/GHSA-j44v-mmf2-xvm9 - https://github.com/pdm-project/pdm/commit/6853e2642dfa281d4a9958fbc6c95b7e32d84831 - https://github.com/frostming/unearth/blob/eca170d9370ac5032f2e497ee9b1b63823d3fe0f/src/unearth/evaluator.py#L21
d84831 - https://github.com/frostming/unearth/blob/eca170d9370ac5032f2e497ee9b1b63823d3fe0f/src/unearth/evaluator.py#L215-L229 - https://github.com/pdm-project/pdm/blob/45d1dfa47d4900c14a31b9bb761e4c46eb5c9442/src/pdm/models/candidates.py#L98-L99 - https://peps.python.org/pep-0440/#post-release-spelling
CVE ID: CVE-2023-45806 State: PUBLISHED Published: 2023-11-10T14:43:37.657Z Last Updated: 2024-09-03T17:43:41.680Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-1333 Description: Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they've been quoted by updating their full name again. Version 3.1.3 of the `stable` branch and version
n all the posts they've been quoted by updating their full name again. Version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches contain a patch for this issue. No known workaround exists, although one can stop the "bleeding" by ensuring users only use alphanumeric characters in their full name field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-hcgf-hg2g-mw78 - https://github.com/discourse/discourse/commit/2ec25105179199cf80912bf011c18b8b870e1863 - https://github.com/discourse/discourse/commit/7d484864fe91ff79c478f57e7ddb1235d701921e
CVE ID: CVE-2023-45807 State: PUBLISHED Published: 2023-10-16T21:33:23.124Z Last Updated: 2024-09-13T18:59:11.668Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: opensearch-project Products: security Problem Types: CWE-281 Description: OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. Thi
perations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable. This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have. This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opensearch-project/security/security/advisories/GHSA-72q2-gwwf-6hrv