Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-50253 State: PUBLISHED Published: 2024-01-03T16:45:11.778Z Last Updated: 2025-06-09T18:48:18.796Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: labring Products: laf Problem Types: CWE-200 Description: Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which allows authenticated users to obtain any pod logs under the same namespace through this method, thereby obtaining sensitive information printed in t
o obtain any pod logs under the same namespace through this method, thereby obtaining sensitive information printed in the logs. As of time of publication, no known patched versions exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/labring/laf/security/advisories/GHSA-g9c8-wh35-g75f - https://github.com/labring/laf/pull/1468
CVE ID: CVE-2023-50254 State: PUBLISHED Published: 2023-12-22T16:49:48.977Z Last Updated: 2024-08-02T22:16:46.096Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H) Vendors: linuxdeepin Products: developer-center Problem Types: CWE-27, CWE-22 Description: Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.
by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-q9jr-726g-9495 - https://github.com/linuxdeepin/deepin-reader/commit/4db7a079fb7bd77257b1b9208a7ab26aade8fe04 - https://github.com/linuxdeepin/deepin-reader/commit/c192fd20a2fe4003e0581c3164489a89e06420c6
CVE ID: CVE-2023-50255 State: PUBLISHED Published: 2023-12-27T16:16:51.459Z Last Updated: 2024-08-02T22:16:46.183Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: linuxdeepin Products: developer-center Problem Types: CWE-23, CWE-26, CWE-22 Description: Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability. Additional Analyst Notes:
sion 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2 - https://github.com/linuxdeepin/deepin-compressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6
CVE ID: CVE-2023-50256 State: PUBLISHED Published: 2024-01-03T22:34:47.447Z Last Updated: 2025-06-17T20:29:07.539Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Froxlor Products: Froxlor Problem Types: CWE-20 Description: Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA
e) established by the system. Version 2.1.2 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4 - https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac - https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4
CVE ID: CVE-2023-50257 State: PUBLISHED Published: 2024-02-19T19:22:45.526Z Last Updated: 2024-08-14T13:54:54.506Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: eProsima Products: Fast-DDS Problem Types: CWE-284 Description: eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the application of SROS2, due to the issue where the data (`p[UD]`) and `guid` values used to disconnect between nodes are not encrypted, a vulnerability has been discovered where a malicious attacker can forcibly disconnect a Subscriber and can deny a Subscriber attempting to connect. Aft
red where a malicious attacker can forcibly disconnect a Subscriber and can deny a Subscriber attempting to connect. Afterwards, if the attacker sends the packet for disconnecting, which is data (`p[UD]`), to the Global Data Space (`239.255.0.1:7400`) using the said Publisher ID, all the Subscribers (Listeners) connected to the Publisher (Talker) will not receive any data and their connection will be disconnected. Moreover, if this disconnection packet is sent continuously, the Subscribers (Listeners) trying to connect will not be able to do so. Since the initial commit of the `SecurityManager.cpp` code (`init`, `on_process_handshake`) on Nov 8, 2016, the Disconnect Vulnerability in RTPS Pac
the `SecurityManager.cpp` code (`init`, `on_process_handshake`) on Nov 8, 2016, the Disconnect Vulnerability in RTPS Packets Used by SROS2 has been present prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-v5r6-8mvh-cp98 - https://github.com/eProsima/Fast-DDS/commit/072cbc9d6a71d869a5cbed1873c0cdd6cf67cda4 - https://github.com/eProsima/Fast-DDS/commit/e1869863c06db7fbb366ae53760fbe6e754be026 - https://github.com/eProsima/Fast-DDS/commit/f07a0213e655202188840b864be4438ae1067a13 - https://github.com/eProsima/Fast-DDS/commit/f2e5ceae8
Prosima/Fast-DDS/commit/f07a0213e655202188840b864be4438ae1067a13 - https://github.com/eProsima/Fast-DDS/commit/f2e5ceae8fbea0a6c9445a366faaca0b98a8ef86
CVE ID: CVE-2023-50258 State: PUBLISHED Published: 2023-12-22T16:55:58.406Z Last Updated: 2025-04-23T16:18:19.076Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: pymedusa Products: Medusa Problem Types: CWE-918 Description: Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testDiscord` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `discord_webhook` variable and passes it to the `notifiers.discord_notifier.test_notify` method, then `_notify_discord` and finally `_send_discord_msg` method, which send
otifiers.discord_notifier.test_notify` method, then `_notify_discord` and finally `_send_discord_msg` method, which sends a POST request to the user-controlled URL on line 64 in `/medusa/notifiers/discord.py`, which leads to a blind server-side request forgery. This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pymedusa/Medusa/security/advisories/GHSA-3hph-6586-qv9g - https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/notifiers/discord.py#L64 - https://github.com/pymedusa/Medusa
edusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/notifiers/discord.py#L64 - https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/server/web/home/handler.py#L158 - https://github.com/pymedusa/Medusa/releases/tag/v1.0.19 - https://securitylab.github.com/advisories/GHSL-2023-201_GHSL-2023-202_Medusa/
CVE ID: CVE-2023-50259 State: PUBLISHED Published: 2023-12-22T17:00:00.976Z Last Updated: 2024-11-27T15:45:03.076Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: pymedusa Products: Medusa Problem Types: CWE-918 Description: Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testslack` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `slack_webhook` variable and passes it to the `notifiers.slack_notifier.test_notify` method, then `_notify_slack` and finally `_send_slack` method, which sends a POST reque
iers.slack_notifier.test_notify` method, then `_notify_slack` and finally `_send_slack` method, which sends a POST request to the user-controlled URL on line 103 in `/medusa/notifiers/slack.py`, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pymedusa/Medusa/security/advisories/GHSA-8mcr-vffr-jwxv - https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/notifiers/slack.py#L103 - https://github.com/pymedusa/Medusa/blob/3d6
ob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/notifiers/slack.py#L103 - https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/server/web/home/handler.py#L168 - https://github.com/pymedusa/Medusa/releases/tag/v1.0.19 - https://securitylab.github.com/advisories/GHSL-2023-201_GHSL-2023-202_Medusa/
CVE ID: CVE-2023-50260 State: PUBLISHED Published: 2024-04-19T14:28:20.318Z Last Updated: 2024-08-02T22:16:46.332Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wazuh Products: wazuh Problem Types: CWE-94 Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script allows to write any string in the `hosts.deny` file, which can end in an arbitrary command execution on the target system. This vulnerability is part of the active response feature, which can automatically triggers actions in response to alerts. By default, active responses are limited to a set of pre define
an automatically triggers actions in response to alerts. By default, active responses are limited to a set of pre defined executables. This is enforced by only allowing executables stored under `/var/ossec/active-response/bin` to be run as an active response. However, the `/var/ossec/active-response/bin/host_deny` can be exploited. `host_deny` is used to add IP address to the `/etc/hosts.deny` file to block incoming connections on a service level by using TCP wrappers. Attacker can inject arbitrary command into the `/etc/hosts.deny` file and execute arbitrary command by using the spawn directive. The active response can be triggered by writing events either to the local `execd` queue on serv
ng the spawn directive. The active response can be triggered by writing events either to the local `execd` queue on server or to the `ar` queue which forwards the events to agents. So, it can leads to LPE on server as root and RCE on agent as root. This vulnerability is fixed in 4.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw
CVE ID: CVE-2023-50262 State: PUBLISHED Published: 2023-12-13T20:52:56.173Z Last Updated: 2024-08-02T22:16:46.642Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: dompdf Products: dompdf Problem Types: CWE-20, CWE-674 Description: Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not reference itself. However, prior to version 2.0.4, a recursive chained using two or more SVG documents is not correctly validated. Depending on the system configuration and attack pattern this could exhaust the memory avail
is not correctly validated. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. php-svg-lib, when run in isolation, does not support SVG references for `image` elements. However, when used in combination with Dompdf, php-svg-lib will process SVG images referenced by an `image` element. Dompdf currently includes validation to prevent self-referential `image` references, but a chained reference is not checked. A malicious actor may thus trigger infinite recursion by chaining references between two or more SVG images. When Dompdf parses a malicious payload, it will crash due after exceeding the al
erences between two or more SVG images. When Dompdf parses a malicious payload, it will crash due after exceeding the allowed execution time or memory usage. An attacker sending multiple request to a system can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 2.0.4 contains a fix for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dompdf/dompdf/security/advisories/GHSA-3qx2-6f78-w2j2 - https://github.com/dompdf/dompdf/commit/41cbac16f3cf56affa49f06e8dae66d0eac2b593 - https://github.com/dompdf/dompdf/blob/v2.0.3/src/Image/Cache.php#L136-L153
CVE ID: CVE-2023-50263 State: PUBLISHED Published: 2023-12-12T22:17:00.858Z Last Updated: 2024-08-02T22:16:46.201Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nautobot Products: nautobot Problem Types: CWE-200 Description: Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get/?name=...` and `/files/download/?name=...` are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these file
es that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job in question runs. In the default implementation used in Nautobot, as provided by `django-db-file-storage`, these URLs do not by default require any user authentication to access; they should instead be restricted to only users who have permissions to view Nautobot's `FileProxy` model instances. Note that no URL mechanism is provided for listing or traversal of the available file `name` values, so in practice an unauthenticated user would have to guess names to discover arbitrary files for download, but if a user knows the file na
unauthenticated user would have to guess names to discover arbitrary files for download, but if a user knows the file name/path value, they can access it without authenticating, so we are considering this a vulnerability. Fixes are included in Nautobot 1.6.7 and Nautobot 2.0.6. No known workarounds are available other than applying the patches included in those versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nautobot/nautobot/security/advisories/GHSA-75mc-3pjc-727q - https://github.com/nautobot/nautobot/pull/4959 - https://github.com/nautobot/nautobot/pull/4964 - https://github.com/nautobot/nautobot/commit/458280c359a4833a20da294eaf4b8d55edc91cee
b.com/nautobot/nautobot/pull/4964 - https://github.com/nautobot/nautobot/commit/458280c359a4833a20da294eaf4b8d55edc91cee - https://github.com/nautobot/nautobot/commit/7c4cf3137f45f1541f09f2f6a7f8850cd3a2eaee - https://github.com/victor-o-silva/db_file_storage/blob/master/db_file_storage/views.py
CVE ID: CVE-2023-50264 State: PUBLISHED Published: 2023-12-15T20:42:22.304Z Last Updated: 2024-08-02T22:16:46.183Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: morpheus65535 Products: bazarr Problem Types: CWE-22 Description: Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advis
in version 1.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/ - https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6b - https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1
CVE ID: CVE-2023-50265 State: PUBLISHED Published: 2023-12-15T20:42:25.409Z Last Updated: 2024-10-07T15:29:04.636Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: morpheus65535 Products: bazarr Problem Types: CWE-22 Description: Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/ - https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6b - https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1
CVE ID: CVE-2023-50266 State: PUBLISHED Published: 2023-12-15T20:42:29.685Z Last Updated: 2024-08-02T22:16:46.218Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: morpheus65535 Products: bazarr Problem Types: CWE-918 Description: Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting GET requests to internal and external resources on behalf of the server. 1.3.1 contains a partial fix, which limits the
GET requests to internal and external resources on behalf of the server. 1.3.1 contains a partial fix, which limits the vulnerability to HTTP/HTTPS protocols. Additional Analyst Notes: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/ - https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6b - https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1
CVE ID: CVE-2023-50267 State: PUBLISHED Published: 2023-12-28T15:13:34.769Z Last Updated: 2024-09-09T17:57:40.374Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: metersphere Products: metersphere Problem Types: CWE-269, CWE-639 Description: MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metersphere/metersphere/security/advisories/GHSA-rcp4-
tainer: - CISA ADP Vulnrichment: References: - https://github.com/metersphere/metersphere/security/advisories/GHSA-rcp4-c5p2-58v9
CVE ID: CVE-2023-50268 State: PUBLISHED Published: 2023-12-13T20:49:54.982Z Last Updated: 2025-02-13T17:19:02.376Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: jqlang Products: jq Problem Types: CWE-121, CWE-120 Description: jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-442f-qc8j - https://github.com/jqlang/jq/pull/2804 - https://github.com/jqlang/jq/commit/c9a51565214eece8f1053089739aea73145bfd6b - https://bugs.c
.com/jqlang/jq/pull/2804 - https://github.com/jqlang/jq/commit/c9a51565214eece8f1053089739aea73145bfd6b - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771 - http://www.openwall.com/lists/oss-security/2023/12/15/10
CVE ID: CVE-2023-50269 State: PUBLISHED Published: 2023-12-14T17:09:25.168Z Last Updated: 2025-05-21T14:31:00.896Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: squid-cache Products: squid Problem Types: CWE-674 Description: Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed
tack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3 - http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch - http://www.squid-cache.org/Versions/v6/SQUID-2023_10.patch - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/ - https://lists.fedoraproject
es/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html - https://security.netapp.com/advisory/ntap-20240119-0005/
CVE ID: CVE-2023-50270 State: PUBLISHED Published: 2024-02-20T10:01:32.260Z Last Updated: 2024-08-29T15:08:36.166Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-613 Description: Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/dolphinscheduler/pull/15219 - https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r - https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 - https
e.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r - https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6 - https://www.openwall.com/lists/oss-security/2024/02/20/3