Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ble for the node to be exhausted of memory. The consequence of the exhaustion is that other services on the node, e.g. other containers, will be unable to allocate memory and thus causing a denial of service. Malicious apps accidentally pulled by users on the host and have the access to send HTTP requests to localhost may make an attack. It will be affected only when users enable the `ServiceBus` module in the config file `edgecore.yaml`. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. As a workaround, disable the `ServiceBus` module in the config file `edgecore.yaml`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/
ore.yaml`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubeedge/kubeedge/security/advisories/GHSA-vwm6-qc77-v2rh - https://github.com/kubeedge/kubeedge/pull/4038 - https://github.com/kubeedge/kubeedge/pull/4039 - https://github.com/kubeedge/kubeedge/pull/4042
CVE ID: CVE-2022-31074 State: PUBLISHED Published: 2022-07-11T20:10:10.000Z Last Updated: 2025-04-23T18:03:46.086Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: kubeedge Products: kubeedge Problem Types: CWE-400 Description: KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, several endpoints in the Cloud AdmissionController may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to it. The consequence of the exhaustion is that the Cloud AdmissionController will be in denial of service. This bug has been
The consequence of the exhaustion is that the Cloud AdmissionController will be in denial of service. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. There is currently no known workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubeedge/kubeedge/security/advisories/GHSA-w52j-3457-q9wr
CVE ID: CVE-2022-31075 State: PUBLISHED Published: 2022-07-11T20:15:12.000Z Last Updated: 2025-04-23T18:03:39.583Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: kubeedge Products: kubeedge Problem Types: CWE-400 Description: KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, EdgeCore may be susceptible to a DoS attack on CloudHub if an attacker was to send a well-crafted HTTP request to `/edge.crt`. If an attacker can send a well-crafted HTTP request to CloudHub, and that request has a very large body, that request can crash the HTTP serv
nd a well-crafted HTTP request to CloudHub, and that request has a very large body, that request can crash the HTTP service through a memory exhaustion vector. The request body is being read into memory, and a body that is larger than the available memory can lead to a successful attack. Because the request would have to make it through authorization, only authorized users may perform this attack. The consequence of the exhaustion is that CloudHub will be in denial of service. KubeEdge is affected only when users enable the CloudHub module in the file `cloudcore.yaml`. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. As a workaround, disable the CloudHub switch in the config fi
bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. As a workaround, disable the CloudHub switch in the config file `cloudcore.yaml`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubeedge/kubeedge/security/advisories/GHSA-x3px-2p95-f6jr
CVE ID: CVE-2022-31076 State: PUBLISHED Published: 2022-06-27T20:10:10.000Z Last Updated: 2025-04-22T17:53:48.947Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: kubeedge Products: kubeedge Problem Types: CWE-476 Description: KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message can crash CloudCore by triggering a nil-pointer dereference in the UDS Server. Since the UDS Server only communicates with the CSI Driver on the cloud side, the attack is limited to the local host network. As such, an attacker would already need to be an authen
the cloud side, the attack is limited to the local host network. As such, an attacker would already need to be an authenticated user of the Cloud. Additionally it will be affected only when users turn on the unixsocket switch in the config file cloudcore.yaml. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. Users unable to upgrade should sisable the unixsocket switch of CloudHub in the config file cloudcore.yaml. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubeedge/kubeedge/security/advisories/GHSA-8f4f-v9x5-cg6j - https://github.com/kubeedge/kubeedge/pu
- https://github.com/kubeedge/kubeedge/security/advisories/GHSA-8f4f-v9x5-cg6j - https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe8137664701
CVE ID: CVE-2022-31077 State: PUBLISHED Published: 2022-06-27T20:10:17.000Z Last Updated: 2025-04-23T18:07:38.012Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: kubeedge Products: kubeedge Problem Types: CWE-476 Description: KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should
er controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe8137664701 - https://github.com/kubeedge/kubeedge/security/advisories/GHSA-x938-fvfw-7jh5 - https://github.com/kubeedge/kubeedge/pull/3899
CVE ID: CVE-2022-31078 State: PUBLISHED Published: 2022-07-11T20:25:09.000Z Last Updated: 2025-04-23T18:03:32.198Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: kubeedge Products: kubeedge Problem Types: CWE-400 Description: KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of responses to requests made by the REST handler. An attacker could use this weakness to make a request that will return an HTTP response with a large body and cause DoS of CloudCore. In the HTTP Handler API, t
ake a request that will return an HTTP response with a large body and cause DoS of CloudCore. In the HTTP Handler API, the rest handler makes a request to a pre-specified handle. The handle will return an HTTP response that is then read into memory. The consequence of the exhaustion is that CloudCore will be in a denial of service. Only an authenticated user of the cloud can make an attack. It will be affected only when users enable `router` module in the config file `cloudcore.yaml`. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. As a workaround, disable the router switch in the config file `cloudcore.yaml`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
e router switch in the config file `cloudcore.yaml`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubeedge/kubeedge/security/advisories/GHSA-qpx3-9565-5xwm
CVE ID: CVE-2022-31079 State: PUBLISHED Published: 2022-07-11T20:40:09.000Z Last Updated: 2025-04-23T18:03:25.013Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: kubeedge Products: kubeedge Problem Types: CWE-400 Description: KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire message into memory without imposing a limit on the size of this message. An attacker can exploit this by sending a large message to exhaust memory and cause a DoS. The Cloud Stream server and the Edg
acker can exploit this by sending a large message to exhaust memory and cause a DoS. The Cloud Stream server and the Edge Stream server are under DoS attack in this case. The consequence of the exhaustion is that the CloudCore and EdgeCore will be in a denial of service. Only an authenticated user can cause this issue. It will be affected only when users enable `cloudStream` module in the config file `cloudcore.yaml` and enable `edgeStream` module in the config file `edgecore.yaml`. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. As a workaround, disable cloudStream module in the config file `cloudcore.yaml` and disable edgeStream module in the config file `edgecore.yaml`. Add
dStream module in the config file `cloudcore.yaml` and disable edgeStream module in the config file `edgecore.yaml`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubeedge/kubeedge/security/advisories/GHSA-wrcr-x4qj-j543
CVE ID: CVE-2022-31080 State: PUBLISHED Published: 2022-07-11T20:55:09.000Z Last Updated: 2025-04-23T18:03:19.067Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: kubeedge Products: kubeedge Problem Types: CWE-400 Description: KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, a large response received by the viaduct WSClient can cause a DoS from memory exhaustion. The entire body of the response is being read into memory which could allow an attacker to send a request that returns a response with a large body. The consequence of the exhaus
which could allow an attacker to send a request that returns a response with a large body. The consequence of the exhaustion is that the process which invokes a WSClient will be in a denial of service. The software is affected If users who are authenticated to the edge side connect to `cloudhub` from the edge side through WebSocket protocol. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubeedge/kubeedge/security/advisories/GHSA-6wvc-6pww-qr4r
CVE ID: CVE-2022-31081 State: PUBLISHED Published: 2022-06-27T00:00:00.000Z Last Updated: 2025-04-22T17:54:07.967Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: libwww-perl Products: HTTP-Daemon Problem Types: CWE-444 Description: HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to
Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected. Addition
r, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn - https://github.com/libwww-perl/HTTP-Daemon/security/advisories/GHSA-cg8c-pxmv-w7cf - https://github.com/libwww-perl/HTTP-Daemon/commit/8dc5269d59e2d5d9eb1647d82c449ccd880f7fd0 - https://github.com/libwww-perl/HTTP-Daemon/commit/e84475de51d6fd7b29354a997413472a99db70b2 - https://cwe.mitre.org/data/definitions/444.html - https://datatracker.ietf.org/doc/html/rfc7230#section-9.5 - http://metacpan.org/release/HTTP-Daem
definitions/444.html - https://datatracker.ietf.org/doc/html/rfc7230#section-9.5 - http://metacpan.org/release/HTTP-Daemon/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00038.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U4XEPZ5Q3LNOQF3E6EXFWVSEXU5IZ6T/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQBW2D43TDNYX4R2YBTNNZDBNZ45DINN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECJ4ZPBQWD3B2CD6RRIVMENB5KUOJ3LC/
CVE ID: CVE-2022-31082 State: PUBLISHED Published: 2022-06-27T20:30:22.000Z Last Updated: 2025-04-23T18:07:31.644Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: glpi-project Products: glpi-inventory-plugin Problem Types: CWE-89 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/
ssue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q6m7-h6rj-5wmw - https://github.com/glpi-project/glpi-inventory-plugin/commit/0b805ca6fb2a0f9bde4af29fca4f703fdfbd8f66
CVE ID: CVE-2022-31083 State: PUBLISHED Published: 2022-06-17T18:15:17.000Z Last Updated: 2025-04-23T18:09:25.391Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-287 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object. Versions 4.0.11 an
accessible via certain Apple domains and providing the URL to that certificate in an authData object. Versions 4.0.11 and 5.2.2 prevent this by introducing a new `rootCertificateUrl` property to the Parse Server Apple Game Center auth adapter which takes the URL to the root certificate of Apple's Game Center authentication certificate. If no value is set, the `rootCertificateUrl` property defaults to the URL of the current root certificate as of May 27, 2022. Keep in mind that the root certificate can change at any time and that it is the developer's responsibility to keep the root certificate URL up-to-date when using the Parse Server Apple Game Center auth adapter. There are no known worka
the root certificate URL up-to-date when using the Parse Server Apple Game Center auth adapter. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc - https://github.com/parse-community/parse-server/pull/8054 - https://github.com/parse-community/parse-server/commit/ba2b0a9cb9a568817a114b132a4c2e0911d76df1 - https://developer.apple.com/news/?id=stttq465
CVE ID: CVE-2022-31084 State: PUBLISHED Published: 2022-06-27T20:55:11.000Z Last Updated: 2025-04-22T17:53:34.621Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: LDAPAccountManager Products: lam Problem Types: CWE-88 Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0. Ad
non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4 - https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-r387-grjx-qgvw - https://www.debian.org/security/2022/dsa-5177 - https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/
CVE ID: CVE-2022-31085 State: PUBLISHED Published: 2022-06-27T20:55:21.000Z Last Updated: 2025-04-23T18:07:04.817Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: LDAPAccountManager Products: lam Problem Types: CWE-311 Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make s
n. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4 - https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-6m3q-5c84-6h6j - https://www.debian.org/security/2022/dsa-5177
CVE ID: CVE-2022-31086 State: PUBLISHED Published: 2022-06-27T20:50:21.000Z Last Updated: 2025-04-23T18:07:11.602Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: LDAPAccountManager Products: lam Problem Types: CWE-74 Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixe
ates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4 - https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q9pc-x84w-982x - https://www.debian.org/security/2022/dsa-5177
CVE ID: CVE-2022-31087 State: PUBLISHED Published: 2022-06-27T20:50:11.000Z Last Updated: 2025-04-23T18:07:18.371Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: LDAPAccountManager Products: lam Problem Types: CWE-74 Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been
ww-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP scripts in (/var/lib/ldap-account-manager/)tmp directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4 - https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q8g5-45m4-q95p - https://www.debian.org/security/2022/dsa-5177
CVE ID: CVE-2022-31088 State: PUBLISHED Published: 2022-06-27T20:45:18.000Z Last Updated: 2025-04-23T18:07:24.243Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: LDAPAccountManager Products: lam Problem Types: CWE-74 Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LDAPAccou
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-wxf8-9x99-6gp4 - https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4 - https://www.debian.org/security/2022/dsa-5177
CVE ID: CVE-2022-31089 State: PUBLISHED Published: 2022-06-27T21:10:11.000Z Last Updated: 2025-04-23T18:06:52.797Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-706, CWE-252 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as single instance without redundancy, the availability impact may be hi
act may be low; if you are running Parse Server as single instance without redundancy, the availability impact may be high. This issue has been addressed in versions 4.10.12 and 5.2.3. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9 - https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92