Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24721 State: PUBLISHED Published: 2022-03-15T13:45:13.000Z Last Updated: 2025-04-23T18:53:56.693Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: cometd Products: cometd Problem Types: CWE-863 Description: CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other users' (possibly sensitive) data. By publishing to those channels, a remote user may be
rnal traffic that contains other users' (possibly sensitive) data. By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure. A fix is available in versions 5.0.11, 6.0.6, and 7.0.6. As a workaround, install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv - https://github.com/cometd/cometd/issues/1146
CVE ID: CVE-2022-24722 State: PUBLISHED Published: 2022-03-02T22:40:11.000Z Last Updated: 2025-04-23T18:59:13.837Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: github Products: view_component Problem Types: CWE-79 Description: VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully
he `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cf - https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9 - https://github.com/github/view_component/releases/tag/v2.31.2 - https://github.com/github/view_component/releases/tag/v2.49.1
CVE ID: CVE-2022-24723 State: PUBLISHED Published: 2022-03-03T20:35:11.000Z Last Updated: 2025-04-22T18:20:48.760Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: medialize Products: URI.js Problem Types: CWE-20 Description: URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/medializ
d. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/medialize/URI.js/security/advisories/GHSA-gmv4-r438-p67f - https://github.com/medialize/uri.js/commit/86d10523a6f6e8dc4300d99d671335ee362ad316 - https://github.com/medialize/URI.js/releases/tag/v1.19.9 - https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/
CVE ID: CVE-2022-24724 State: PUBLISHED Published: 2022-03-03T19:35:09.000Z Last Updated: 2025-04-22T18:20:59.594Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: github Products: cmark-gfm Problem Types: CWE-190 Description: cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and w
umns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
will prevent this vulnerability from being triggered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55K6VNVKO2G5SNKRCQ2KDG5SKTX5PVV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJBFIJEHJZEEDG6MO4MQHZYKUXELH77O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7V3HAM5H6YFJG2QFEXACZR3XVWFTXTC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr
sage/F7V3HAM5H6YFJG2QFEXACZR3XVWFTXTC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CYUU662VO6CCXQKVZVOHXX3RGIF2DLQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSKUOJ2VAYGTJXPDE2RRPMNLVVMKCI77/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KH4UQA6VWVZU5EW3HNEAB7D7BTCNJSJ2/ - http://packetstormsecurity.com/files/166599/cmark-gfm-Integer-overflow.html
CVE ID: CVE-2022-24725 State: PUBLISHED Published: 2022-03-03T21:35:10.000Z Last Updated: 2025-04-22T18:20:38.968Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ericcornelissen Products: shescape Problem Types: CWE-200 Description: Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of _shescape_ is used, directory traversal may be possible in the applicatio
e not affected. Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_. The issue was patched in version 1.5.1. As a workaround, manually escape all instances of the tilde character (`~`) using `arg.replace(/~/g, "\\~")`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ericcornelissen/shescape/security/advisories/GHSA-446w-rrm4-r47f - https://github.com/ericcornelissen/shescape/issues/169 - https://github.com/ericcornelissen/shescape/pull/170
CVE ID: CVE-2022-24726 State: PUBLISHED Published: 2022-03-10T20:45:12.000Z Last Updated: 2025-04-23T18:55:37.983Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: istio Products: istio Problem Types: CWE-400 Description: Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing when the validating webhook for a cluster is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attack
s exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [external istiod](https://istio.io/latest/docs/setup/install/external-controlplane/) topologies, this port is exposed over the public internet. This issue has been patched in versions 1.13.2, 1.12.5 and 1.11.8. Users are advised to upgrade. Users unable to upgrade should disable access to a validating webhook that is exposed to the public internet or restrict the set of IP addresses that can query it to a set of known
g webhook that is exposed to the public internet or restrict the set of IP addresses that can query it to a set of known, trusted entities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/istio/istio/security/advisories/GHSA-8w5h-qr4r-2h6g - https://github.com/golang/go/issues/51112 - https://github.com/istio/istio/commit/6ca5055a4db6695ef5504eabdfde3799f2ea91fd
CVE ID: CVE-2022-24727 State: REJECTED Published: 2022-03-04T16:45:12 Last Updated: 2022-03-14T14:52:24 Description: No description available.
CVE ID: CVE-2022-24728 State: PUBLISHED Published: 2022-03-16T00:00:00.000Z Last Updated: 2025-04-23T18:53:42.950Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: ckeditor Products: ckeditor4 Problem Types: CWE-79 Description: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workaround
t in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89 - https://github.com/ckeditor/ckeditor4/commit/d158413449692d920a778503502dcb22881bc949 - https://ckeditor.com/cke4/release/CKEditor-4.18.0 - https://www.oracle.com/security-alerts/cpujul2022.html - https://www.drupal.org/sa-core-2022-005 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ - https://lists.fedoraproject.org/arc
ckage-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
CVE ID: CVE-2022-24729 State: PUBLISHED Published: 2022-03-16T00:00:00.000Z Last Updated: 2025-04-23T18:53:35.902Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: ckeditor Products: ckeditor4 Problem Types: CWE-400 Description: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Co
tch is available in version 4.18.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ckeditor.com/cke4/release/CKEditor-4.18.0 - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh - https://www.oracle.com/security-alerts/cpujul2022.html - https://www.drupal.org/sa-core-2022-005 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
CVE ID: CVE-2022-24730 State: PUBLISHED Published: 2022-03-23T20:50:09.000Z Last Updated: 2025-04-23T18:44:28.794Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: argoproj Products: argo-cd Problem Types: CWE-22, CWE-284 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `get` access for a repository contain
ve files from Argo CD's repo-server. A malicious Argo CD user who has been granted `get` access for a repository containing a Helm chart can craft an API request to the `/api/v1/repositories/{repo_url}/appdetails` endpoint to leak the contents of out-of-bounds files from the repo-server. The malicious payload would reference an out-of-bounds file, and the contents of that file would be returned as part of the response. Contents from a non-YAML file may be returned as part of an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from other Applications' source repositories or any secrets which have been
e files which could be leaked include files from other Applications' source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The patches prevent path traversal and limit access to users who either A) have been granted Application `create` privileges or B) have been granted Application `get` privileges and are requesting details for a `repo_url` that has already been used for the given Application. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHS
VE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-r9cr-hvjj-496v
CVE ID: CVE-2022-24731 State: PUBLISHED Published: 2022-03-23T21:00:14.000Z Last Updated: 2025-04-23T18:44:21.525Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: argoproj Products: argo-cd Problem Types: CWE-22, CWE-284 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text fil
ious Argo CD user who has been granted `create` or `update` access to Applications can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file. Sensitive files which could be leaked include files from another Application's source repositories or any secrets which have been mounted as files on the repo-server. This vulnerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing sec
nerability is patched in Argo CD versions 2.1.11, 2.2.6, and 2.3.0. The problem can be mitigated by avoiding storing secrets in git, avoiding mounting secrets as files on the repo-server, avoiding decrypting secrets into files on the repo-server, and carefully limiting who can `create` or `update` Applications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-h6h5-6fmq-rh28
CVE ID: CVE-2022-24732 State: PUBLISHED Published: 2022-03-09T19:40:08.000Z Last Updated: 2025-04-23T18:56:33.643Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: foxcpp Products: maddy Problem Types: CWE-613, CWE-324 Description: Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/foxcpp/
ms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/foxcpp/maddy/security/advisories/GHSA-6cp7-g972-w9m9 - https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583
CVE ID: CVE-2022-24733 State: PUBLISHED Published: 2022-03-14T18:50:10.000Z Last Updated: 2025-04-23T18:54:19.052Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Sylius Products: Sylius Problem Types: CWE-1021 Description: Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every r
provided by the attacker. The issue is fixed in versions 1.9.10, 1.10.11, and 1.11.2. A workaround is available. Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that, add a new `subscriber` in the app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Sylius/Sylius/security/advisories/GHSA-4jp3-q2qm-9fmw - https://github.com/Sylius/Sylius/releases/tag/v1.10.11 - https://github.com/Sylius/Sylius/releases/tag/v1.11.2 - https://github.com/Sylius/Sylius/releases/tag/v1.9.10
CVE ID: CVE-2022-24734 State: PUBLISHED Published: 2022-03-09T21:25:08.000Z Last Updated: 2025-04-22T18:19:20.055Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: mybb Products: mybb Problem Types: CWE-94 Description: MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's
(RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds. Additional Analyst Notes: - CVE Progr
nd internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mybb/mybb/security/advisories/GHSA-876v-gwgh-w57f - https://github.com/mybb/mybb/commit/92012b9831b330714b9f9b4646a98784113489c1 - https://mybb.com/versions/1.8.30/ - https://www.zerodayinitiative.com/advisories/ZDI-22-503/ - http://packetstormsecurity.com/files/167082/MyBB-1.8.29-Remote-Code-Execution.html - http://packetstormsecurity.com/files/167333/MyBB-Admin-Control-Remote-Code-Execution.html
CVE ID: CVE-2022-24735 State: PUBLISHED Published: 2022-04-27T19:43:27.000Z Last Updated: 2025-04-22T18:02:46.190Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: redis Products: redis Problem Types: CWE-94 Description: Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The Lua script execution environment in Redis provides some measures that prevent a script from creating side effects that persist and can affect the execution of
dis provides some measures that prevent a script from creating side effects that persist and can affect the execution of the same, or different script, at a later time. Several weaknesses of these measures have been publicly known for a long time, but they had no security impact as the Redis security model did not endorse the concept of users or privileges. With the introduction of ACLs in Redis 6.0, these weaknesses can be exploited by a less privileged users to inject Lua code that will execute at a later time, when a privileged user executes a Lua script. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-se
fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-647m-2wmq-qmvq - https://github.com/redis/redis/pull/10651 - https://github.com/redis/redis/releases/tag/6.2.7 - https://github.com/redis/redis/releases/tag/7.0.0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/ - https://li
ject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220715-0003/ - https://security.gentoo.org/glsa/202209-17
CVE ID: CVE-2022-24736 State: PUBLISHED Published: 2022-04-27T19:55:10.000Z Last Updated: 2025-04-22T18:02:34.902Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: redis Products: redis Problem Types: CWE-476 Description: Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block ac