Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-22717 State: PUBLISHED Published: 2023-05-15T11:09:23.655Z Last Updated: 2025-01-09T15:16:03.393Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: nCrafts Products: FormCraft Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in nCrafts FormCraft plugin <= 1.2.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/formcraft-form-builder/wordpress-formcraft-contact-form-builder-for-wordpress-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-22718 State: PUBLISHED Published: 2023-04-23T09:27:12.873Z Last Updated: 2024-08-02T13:44:40.748Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Jason Lau Products: User Meta Manager Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/user-meta-manager/wordpress-user-meta-manager-plugin-3-4-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-22719 State: PUBLISHED Published: 2023-11-07T15:41:52.708Z Last Updated: 2024-09-05T14:12:08.629Z Vendors: GiveWP Products: GiveWP Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-csv-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-22720 State: PUBLISHED Published: 2023-05-11T14:31:36.554Z Last Updated: 2025-02-19T21:30:31.014Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Robert Macchi Products: WP Links Page Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Robert Macchi WP Links Page plugin <= 4.9.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-links-page/wordpress-wp-links-page-plugin-4-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-22721 State: PUBLISHED Published: 2023-01-23T17:50:35.909Z Last Updated: 2025-01-13T15:59:08.628Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Alexei Isaenko Products: Oi Yandex.Maps for WordPress Problem Types: CWE-79 Description: Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress <= 3.2.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/oi-yamaps/wordpress-oi-yandex-maps-for-wordpress-plugin-3-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-22722 State: PUBLISHED Published: 2023-01-25T05:58:01.087Z Last Updated: 2025-03-10T21:19:55.688Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, the attacker can make actions as the victim or exfiltrate session cookies. This issue is patched in version 10.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
ion cookies. This issue is patched in version 10.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-352j-wr38-493c
CVE ID: CVE-2023-22724 State: PUBLISHED Published: 2023-01-25T05:55:10.180Z Last Updated: 2025-03-10T21:20:01.945Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6. Additional Analyst Notes: - CVE Program Container: - CI
nk will execute the Javascript. This issue is patched in 10.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-x9g4-j85w-cmff
CVE ID: CVE-2023-22725 State: PUBLISHED Published: 2023-01-25T05:50:19.071Z Last Updated: 2025-03-10T21:20:08.158Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-f5g6-fxrw-pfj7
CVE ID: CVE-2023-22726 State: PUBLISHED Published: 2023-01-20T21:02:35.083Z Last Updated: 2025-03-10T21:21:14.383Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: nektos Products: act Problem Types: CWE-434 Description: act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /art
is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff - https://git
CISA ADP Vulnrichment: References: - https://github.com/nektos/act/security/advisories/GHSA-pc99-qmg4-rcff - https://github.com/nektos/act/issues/1553 - https://github.com/nektos/act/commit/63ae215071f94569d910964bdee866d91d6e3a10 - https://github.com/nektos/act/blob/master/pkg/artifacts/server.go#L65 - https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#L245 - https://github.com/nektos/act/blob/v0.2.35/pkg/artifacts/server.go#LL103C2-L103C2 - https://securitylab.github.com/advisories/GHSL-2023-004_act/
CVE ID: CVE-2023-22727 State: PUBLISHED Published: 2023-01-17T20:41:10.143Z Last Updated: 2025-03-10T21:22:35.657Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cakephp Products: cakephp Problem Types: CWE-89 Description: CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters t
le to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cakephp/cakephp/security/advisories/GHSA-6g8q-qfpv-57wp - https://github.com/cakephp/cakephp/commit/3f463e7084b5a15e67205ced3a622577cca7a239 - https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html
CVE ID: CVE-2023-22728 State: PUBLISHED Published: 2023-04-26T13:57:03.733Z Last Updated: 2025-01-31T16:10:56.483Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: silverstripe Products: silverstripe-framework Problem Types: CWE-862 Description: Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue. Additional Analyst Notes:
access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-jh3w-6jp2-vqqm - https://github.com/silverstripe/silverstripe-framework/commit/fd5d8217e83768d7bf841e94b2d4d82642d5bc58
CVE ID: CVE-2023-22729 State: PUBLISHED Published: 2023-04-26T14:00:29.716Z Last Updated: 2025-01-31T16:10:21.843Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: silverstripe Products: silverstripe-framework Problem Types: CWE-601 Description: Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue. Additional Analyst Notes: - CVE Program
should upgrade to Silverstripe Framework 4.12.15 or above to address the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-fw84-xgm8-9jmv - https://github.com/silverstripe/silverstripe-framework/commit/1a5bb4cbece1721203977910b8ecd8b79c18dc77
CVE ID: CVE-2023-22730 State: PUBLISHED Published: 2023-01-17T21:27:50.656Z Last Updated: 2025-03-10T21:22:13.869Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: shopware Products: platform Problem Types: CWE-20 Description: Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in sales. This problem has been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin. Addi
been fixed with version 6.4.18.1. Users on major versions 6.1, 6.2, and 6.3 may also obtain this fix via a plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-8r6h-m72v-38fg - https://github.com/shopware/platform/commit/4fce12096e54b2033832d9104fa2e68888c2b4e9 - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
CVE ID: CVE-2023-22731 State: PUBLISHED Published: 2023-01-17T21:31:45.875Z Last Updated: 2025-03-10T21:22:08.214Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: shopware Products: platform Problem Types: CWE-94 Description: Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows a template to call any global PHP function and thus execute arbitrary code. The attacker must have access to a Twig environment in order to exploit this vulnerability. This problem has been fixed wit
attacker must have access to a Twig environment in order to exploit this vulnerability. This problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished. Users are advised to upgrade. Users of major versions 6.1, 6.2, and 6.3 may also receive this fix via a plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-93cw-f5jj-x85w - https://github.com/shopware/platform/commit/89d1ea154689cb6202e0d3a0ceeae0febb0c09e1 - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=
02e0d3a0ceeae0febb0c09e1 - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
CVE ID: CVE-2023-22732 State: PUBLISHED Published: 2023-01-17T21:34:26.912Z Last Updated: 2025-03-10T21:22:02.274Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: shopware Products: platform Problem Types: CWE-613 Description: Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administration session has been added. As a result the user will be logged out when they are inactive. Users are advised to upgrade. There are no known workar
As a result the user will be logged out when they are inactive. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-59qg-93jg-236f - https://github.com/shopware/platform/commit/cd7a89cbcd3a0428c6d1ef27b3aa15467a722ff6 - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
CVE ID: CVE-2023-22733 State: PUBLISHED Published: 2023-01-17T21:37:43.906Z Last Updated: 2025-03-10T21:21:56.020Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: shopware Products: platform Problem Types: CWE-532 Description: Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugi
ersion 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Users unable to upgrade may remove from all users the log module ACL rights or disable logging. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-7cp7-jfp6-jh4f - https://github.com/shopware/platform/commit/407a83063d7141c1a626441799c3ebef79498c07 - https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#logging - https://docs.shopware.com/en/shopware-6-en/sec
shopware.com/docs/guides/hosting/performance/performance-tweaks#logging - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
CVE ID: CVE-2023-22734 State: PUBLISHED Published: 2023-01-17T21:21:23.973Z Last Updated: 2025-03-10T21:22:21.731Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: shopware Products: platform Problem Types: CWE-20 Description: Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This problem has been fixed with version 6.4.18.1. Users are advised to upgrade. Users unable to upgrade may find security measures are available via
th version 6.4.18.1. Users are advised to upgrade. Users unable to upgrade may find security measures are available via a plugin for major versions 6.1, 6.2, and 6.3. Users may also disable newsletter registration completely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/platform/security/advisories/GHSA-46h7-vj7x-fxg2 - https://github.com/shopware/platform/commit/f5a95ee2bcf1e546878450963ef1d9886e59a620 - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
CVE ID: CVE-2023-22735 State: PUBLISHED Published: 2023-02-07T18:48:29.870Z Last Updated: 2025-03-10T21:15:28.102Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: zulip Products: zulip Problem Types: CWE-436 Description: Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could upload files with arbitrary `Content-Type` which would be served from the Zulip hostname with `Content-Disposition: inline` and no `Content-Security-Policy` header, allowing them to trick other users into executing arbitrary Javascript in the context of the Zulip application. Among other things, this enables
her users into executing arbitrary Javascript in the context of the Zulip application. Among other things, this enables session theft. Only deployments which use the S3 storage (not the local-disk storage) are affected, and only deployments which deployed commit 04cf68b45ebb5c03247a0d6453e35ffc175d55da, which has only been in `main`, not any numbered release. Users affected should upgrade from main again to deploy this fix. Switching from S3 storage to the local-disk storage would nominally mitigate this, but is likely more involved than upgrading to the latest `main` which addresses the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
addresses the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-wm83-3764-5wqh - https://github.com/zulip/zulip/commit/04cf68b45ebb5c03247a0d6453e35ffc175d55da - https://github.com/zulip/zulip/commit/2f6c5a883e106aa82a570d3d1f243993284b70f3 - https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-from-a-git-repository
CVE ID: CVE-2023-22736 State: PUBLISHED Published: 2023-01-26T03:35:27.309Z Last Updated: 2025-03-10T21:19:37.895Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-862 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed namespaces. Reconciled Application namespaces are specified as a comma-delimited list of glob patterns. When sharding is enabled on the Application
ication namespaces are specified as a comma-delimited list of glob patterns. When sharding is enabled on the Application controller, it does not enforce that list of patterns when reconciling Applications. For example, if Application namespaces are configured to be argocd-*, the Application controller may reconcile an Application installed in a namespace called other, even though it does not start with argocd-. Reconciliation of the out-of-bounds Application is only triggered when the Application is updated, so the attacker must be able to cause an update operation on the Application resource. This bug only applies to users who have explicitly enabled the "apps-in-any-namespace" feature by s
pplication resource. This bug only applies to users who have explicitly enabled the "apps-in-any-namespace" feature by setting `application.namespaces` in the argocd-cmd-params-cm ConfigMap or otherwise setting the `--application-namespaces` flags on the Application controller and API server components. The apps-in-any-namespace feature is in beta as of this Security Advisory's publish date. The bug is also limited to Argo CD instances where sharding is enabled by increasing the `replicas` count for the Application controller. Finally, the AppProjects' `sourceNamespaces` field acts as a secondary check against this exploit. To cause reconciliation of an Application in an out-of-bounds namesp
eld acts as a secondary check against this exploit. To cause reconciliation of an Application in an out-of-bounds namespace, an AppProject must be available which permits Applications in the out-of-bounds namespace. A patch for this vulnerability has been released in versions 2.5.8 and 2.6.0-rc5. As a workaround, running only one replica of the Application controller will prevent exploitation of this bug. Making sure all AppProjects' sourceNamespaces are restricted within the confines of the configured Application namespaces will also prevent exploitation of this bug. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-6p4m-hw2h-6gmw
CVE ID: CVE-2023-22737 State: PUBLISHED Published: 2023-01-27T23:14:33.913Z Last Updated: 2025-03-10T21:18:14.172Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: wireapp Products: wire-server Problem Types: CWE-862, CWE-280 Description: wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Conversation admins should be able to remove Bots. Regular Conversations are not allowed to do so. The issue is fixed in wire-server 2022-12-09 and is already deployed on all Wire managed serv
are not allowed to do so. The issue is fixed in wire-server 2022-12-09 and is already deployed on all Wire managed services. On-premise instances of wire-server need to be updated to 2022-12-09/Chart 4.29.0, so that their backends are no longer affected. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wireapp/wire-server/security/advisories/GHSA-xmjc-c6w3-pcp4 - https://github.com/wireapp/wire-server/pull/2870 - https://github.com/wireapp/wire-server/commit/494a6881f5895d4ed9e5d011455242be0d5e6223 - https://github.com/wireapp/wire-server/releases/tag/v2022-12-09