Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-39888 State: PUBLISHED Published: 2024-07-09T12:05:35.455Z Last Updated: 2025-08-27T20:42:58.535Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: Mendix Encryption Problem Types: CWE-547 Description: A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised. Additional Analyst Notes:
crypt any encrypted project data, as the default encryption key can be considered compromised. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-998949.html
CVE ID: CVE-2024-39890 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-03T16:04:58.814Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300. The baseband software does not properly check the length specified by the CC (Call Control). This can lead to an Out-of-Bounds write. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quali
write. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2024-39891 State: PUBLISHED Published: 2024-07-02T00:00:00.000Z Last Updated: 2025-10-21T22:55:50.240Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.) Additional Analyst Notes:
r each phone number was registered with Authy. (Authy accounts were not compromised, however.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/203.html - https://www.twilio.com/docs/usage/security/reporting-vulnerabilities - https://www.twilio.com/en-us/changelog - https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/
CVE ID: CVE-2024-39894 State: PUBLISHED Published: 2024-07-02T00:00:00.000Z Last Updated: 2025-11-04T16:12:30.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openssh.com/txt/release-9.8 - https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html - https://www.openwall.com/lists/oss-security/2024/07/02/1 - http://www.
ail/openssh-unix-announce/2024-July/000158.html - https://www.openwall.com/lists/oss-security/2024/07/02/1 - http://www.openwall.com/lists/oss-security/2024/07/03/6 - https://security.netapp.com/advisory/ntap-20240712-0004/ - http://www.openwall.com/lists/oss-security/2024/07/23/4 - http://www.openwall.com/lists/oss-security/2024/07/23/6 - http://www.openwall.com/lists/oss-security/2024/07/28/3 - https://crzphil.github.io/posts/ssh-obfuscation-bypass/ - https://news.ycombinator.com/item?id=41508530
CVE ID: CVE-2024-39895 State: PUBLISHED Published: 2024-07-08T16:47:44.673Z Last Updated: 2024-08-02T04:33:11.240Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: directus Products: directus Problem Types: CWE-400 Description: Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legiti
the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/directus/directus/security/advisories/GHSA-7hmh-pfrp-vcx4 - https://github.com/directus/directus/commit/543b345695071c1de61a35004bd063fe59dba0c8
CVE ID: CVE-2024-39896 State: PUBLISHED Published: 2024-07-08T17:27:56.032Z Last Updated: 2024-08-02T04:33:11.337Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-200 Description: Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0. A
hen it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/directus/directus/security/advisories/GHSA-jgf4-vwc3-r46v - https://github.com/directus/directus/commit/454cb534d6ffa547feb11f4d74b932ae7368dae2
CVE ID: CVE-2024-39897 State: PUBLISHED Published: 2024-07-09T18:48:24.335Z Last Updated: 2024-08-02T04:33:11.364Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: project-zot Products: zot Problem Types: CWE-639 Description: zot is an OCI image registry. Prior to 2.1.0, the cache driver `GetBlob()` allows read access to any blob without access control check. If a Zot `accessControl` policy allows users read access to some repositories but restricts read access to other repositories and `dedupe` is enabled (it is enabled by default), then an attacker who knows the name of an image and the digest of a blob (that they do not have read access to), they may malic
attacker who knows the name of an image and the digest of a blob (that they do not have read access to), they may maliciously read it via a second repository they do have read access to. This attack is possible because [`ImageStore.CheckBlob()` calls `checkCacheBlob()`](https://github.com/project-zot/zot/blob/v2.1.0-rc2/pkg/storage/imagestore/imagestore.go#L1158-L1159) to find the blob a global cache by searching for the digest. If it is found, it is copied to the user requested repository with `copyBlob()`. The attack may be mitigated by configuring "dedupe": false in the "storage" settings. The vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progr
"storage" settings. The vulnerability is fixed in 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/project-zot/zot/security/advisories/GHSA-55r9-5mx9-qq7r - https://github.com/project-zot/zot/commit/aaee0220e46bdadd12115ac67c19f9d3153eb1df
CVE ID: CVE-2024-39899 State: PUBLISHED Published: 2024-07-09T18:57:50.228Z Last Updated: 2024-08-02T04:33:11.967Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PrivateBin Products: PrivateBin Problem Types: CWE-305, CWE-791 Description: PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configu
public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j - https://github.com/PrivateBin/PrivateBin/pull/1370 - https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4
CVE ID: CVE-2024-39900 State: PUBLISHED Published: 2024-07-09T21:17:21.652Z Last Updated: 2024-08-02T04:33:11.516Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: opensearch-project Products: reporting Problem Types: CWE-639 Description: OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14. Additio
rces in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/opensearch-project/reporting/security/advisories/GHSA-xmvg-335g-x44q - https://github.com/opensearch-project/reporting/commit/2403014c57ee63268e83d919db3334b676a8c992 - https://opensearch.org/versions/opensearch-2-14-0.html
CVE ID: CVE-2024-39901 State: PUBLISHED Published: 2024-07-09T21:14:28.777Z Last Updated: 2024-08-02T04:33:11.298Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: opensearch-project Products: observability Problem Types: CWE-639 Description: OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14. A
resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33 - https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e - https://opensearch.org/versions/opensearch-2-14-0.html
CVE ID: CVE-2024-39902 State: PUBLISHED Published: 2024-07-22T14:10:11.992Z Last Updated: 2024-08-02T04:33:11.925Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-281 Description: Tuleap is an open source suite to improve management of software developments and collaboration. Prior to Tuleap Community Edition 15.10.99.128 and Tuleap Enterprise Edition 15.10-6 and 15.9-8, the checkbox "Apply same permissions to all sub-items of this folder" in the document manager permissions modal is not taken into account and always considered as unchecked. In situations where the permissions are being restricted some users might
o account and always considered as unchecked. In situations where the permissions are being restricted some users might still keep, incorrectly, the possibility to edit or manage items. Only change made via the web UI are affected, changes directly made via the REST API are not impacted. This vulnerability is fixed in Tuleap Community Edition 15.10.99.128 and Tuleap Enterprise Edition 15.10-6 and 15.9-8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-5jq5-vxmq-xrj7 - https://github.com/Enalean/tuleap/commit/580161e8a065fba30ca5ca1f6f1bdb4f4b1424bb - https://tuleap.net/plugins/git/tuleap/tule
//github.com/Enalean/tuleap/commit/580161e8a065fba30ca5ca1f6f1bdb4f4b1424bb - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=580161e8a065fba30ca5ca1f6f1bdb4f4b1424bb - https://tuleap.net/plugins/tracker/?aid=38675
CVE ID: CVE-2024-39903 State: PUBLISHED Published: 2024-07-12T14:28:15.073Z Last Updated: 2024-08-02T04:33:11.210Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: widgetti Products: solara Problem Types: CWE-22 Description: Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment
ersal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w - https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54
CVE ID: CVE-2024-39904 State: PUBLISHED Published: 2024-07-11T15:37:08.305Z Last Updated: 2024-08-02T04:33:11.301Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vnotex Products: vnote Problem Types: CWE-73 Description: VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example, file:///C:/WINDOWS/system32/cmd.exe. This allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as file:///C:/WINDOWS/sy
ttackers to execute arbitrary programs by embedding a reference to a local executable file such as file:///C:/WINDOWS/system32/cmd.exe and file:///C:/WINDOWS/system32/calc.exe. This vulnerability can be exploited by creating and sharing specially crafted notes. An attacker could send a crafted note file and perform further attacks. This vulnerability is fixed in 3.18.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vnotex/vnote/security/advisories/GHSA-vhh5-8wcv-68gj - https://github.com/vnotex/vnote/commit/3477469b669708ff547037fda9fc2817870428aa
CVE ID: CVE-2024-39905 State: PUBLISHED Published: 2024-07-11T15:43:34.437Z Last Updated: 2024-08-02T04:33:11.321Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Cog-Creators Products: Red-DiscordBot Problem Types: CWE-863 Description: Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizi
e commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-5jq8-q6rj-9gq4 - https://github.com/Cog-Creators/Red-DiscordBot/pull/6398 - https://github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750
CVE ID: CVE-2024-39906 State: PUBLISHED Published: 2024-07-19T19:50:11.778Z Last Updated: 2024-08-02T04:33:11.833Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: havenweb Products: haven Problem Types: CWE-74 Description: A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads to the immediate execution of the provided commands when the link is accessed by the authenticated administrator. This issue may lead to Remote Code
the provided commands when the link is accessed by the authenticated administrator. This issue may lead to Remote Code Execution (RCE) and has been addressed by commit `c52f07c`. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/havenweb/haven/security/advisories/GHSA-65cm-7g24-hm9f - https://github.com/havenweb/haven/commit/c52f07c
CVE ID: CVE-2024-39907 State: PUBLISHED Published: 2024-07-18T15:31:30.892Z Last Updated: 2024-08-02T04:33:11.402Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-89 Description: 1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refere
o known workarounds for these issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6
CVE ID: CVE-2024-39908 State: PUBLISHED Published: 2024-07-16T17:28:07.372Z Last Updated: 2025-11-03T20:38:21.548Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: ruby Products: rexml Problem Types: CWE-400 Description: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings. Additional A
bilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 - https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908
CVE ID: CVE-2024-39909 State: PUBLISHED Published: 2024-07-12T14:34:25.230Z Last Updated: 2024-08-02T04:33:11.579Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: openclarity Products: kubeclarity Problem Types: CWE-89 Description: KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`. As it can be seen in backend/pkg/database/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without th
atabase/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without the input having first been subjected to any validation. This vulnerability is fixed in 2.23.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/openclarity/kubeclarity/security/advisories/GHSA-5248-h45p-9pgw - https://github.com/openclarity/kubeclarity/commit/1d1178840703a72d9082b7fc4aea0a3326c5d294 - https://github.com/openclarity/kubeclarity/blob/main/backend/pkg/database/id_view.go#L79
CVE ID: CVE-2024-39910 State: PUBLISHED Published: 2024-09-16T18:38:11.423Z Last Updated: 2024-09-16T19:58:06.959Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: decidim Products: decidim Problem Types: CWE-79 Description: decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.
d=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to upgrade should review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/decidim/decidim/security/advisories/GHSA-vvqw-fqwx-mqmm - https://github.com/decidim/decidim/commit/47adca81cabea898005ec07b130b008f2a2be99f
CVE ID: CVE-2024-39911 State: PUBLISHED Published: 2024-07-18T15:35:15.584Z Last Updated: 2025-02-13T17:53:20.929Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: 1Panel-dev Products: 1Panel Problem Types: CWE-89 Description: 1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7m53-pwp6-v3f5 -
: - CVE Program Container: References: - https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7m53-pwp6-v3f5 - https://blog.mo60.cn/index.php/archives/1Panel_SQLinjection2Rce.html