Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ith network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Additional An
6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2022.html
CVE ID: CVE-2022-21640 State: PUBLISHED Published: 2022-10-18T00:00:00 Last Updated: 2024-09-24T14:55:37.147Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: MySQL Server Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior
CVE ID: CVE-2022-21641 State: PUBLISHED Published: 2022-10-18T00:00:00 Last Updated: 2024-09-24T14:43:32.099Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Oracle Corporation Products: MySQL Server Problem Types: Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior
CVE ID: CVE-2022-21642 State: PUBLISHED Published: 2022-01-05T19:05:10.000Z Last Updated: 2025-04-23T19:14:48.196Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gith
vised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-mx3h-vc7w-r9c6 - https://github.com/discourse/discourse/commit/702685b6a06ae45a544fc702027f1e4573d94aaa
CVE ID: CVE-2022-21643 State: PUBLISHED Published: 2022-01-04T19:55:10.000Z Last Updated: 2025-04-23T19:15:12.267Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Aaron-Junker Products: USOC Problem Types: CWE-89 Description: USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via register.php. In particular usernames, email addresses, and passwords provided by the user were not sanitized and were used directly to construct a sql statement. Users are advised to upgrade as soon as possible. There are not workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
le. There are not workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Aaron-Junker/USOC/security/advisories/GHSA-fjp4-phjh-jgmc - https://github.com/Aaron-Junker/USOC/commit/21e8bfd7a9ab0b7f9344a7a3a7c32a7cdd5a0b69
CVE ID: CVE-2022-21644 State: PUBLISHED Published: 2022-01-04T20:00:12.000Z Last Updated: 2025-04-23T19:15:06.420Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Aaron-Junker Products: USOC Problem Types: CWE-89 Description: USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the user were not sanitized and were used directly to construct a sql statement. The only users permitted to search are site admins. Users are advised to upgrade as soon as possible. There are not workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA A
soon as possible. There are not workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Aaron-Junker/USOC/security/advisories/GHSA-89jg-6fr3-9q4h - https://github.com/Aaron-Junker/USOC/commit/06217c66c8f9b114726b21633eabcd88ac9034aa
CVE ID: CVE-2022-21646 State: PUBLISHED Published: 2022-01-11T21:50:10.000Z Last Updated: 2025-04-23T19:13:28.941Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: authzed Products: spicedb Problem Types: CWE-155, CWE-20 Description: SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcar
virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/authzed/spicedb/security/advisories/GHSA-7p8f-8hjm-wm92 - https://github.com/authzed/spicedb/issues/358 - https://github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970 - https://github.com/a
b/issues/358 - https://github.com/authzed/spicedb/commit/15bba2e2d2a4bda336a37a7fe8ef8a35028cd970 - https://github.com/authzed/spicedb/releases/tag/v1.4.0
CVE ID: CVE-2022-21647 State: PUBLISHED Published: 2022-01-04T20:05:11.000Z Last Updated: 2025-04-23T19:14:59.823Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: codeigniter4 Products: CodeIgniter4 Problem Types: CWE-502 Description: CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advis
loit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `old()` function and form_helper nor `RedirectResponse::withInput()` and `redirect()->withInput()`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-w6jr-wj64-mc9x - https://github.com/codeigniter4/CodeIgniter4/commit/ce95ed5765256e2f09f3513e7d42790e0d6948f5
CVE ID: CVE-2022-21648 State: PUBLISHED Published: 2022-01-04T20:10:11.000Z Last Updated: 2025-04-23T19:14:54.192Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: nette Products: latte Problem Types: CWE-79 Description: Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources. Additional Analyst Notes: - CVE Progr
. Users unable to upgrade should not accept template input from untrusted sources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nette/latte/security/advisories/GHSA-36m2-8rhx-f36j - https://github.com/nette/latte/commit/9e1b4f7d70f7a9c3fa6753ffa7d7e450a3d4abb0
CVE ID: CVE-2022-21649 State: PUBLISHED Published: 2022-01-04T20:40:20.000Z Last Updated: 2025-04-22T18:34:30.665Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: convos-chat Products: convos Problem Types: CWE-79 Description: Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "<" or ">" but escaping for double quotes does not exist. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible. Additional Analyst Not
ttacker is capable to execute malicious scripts. Users are advised to update as soon as possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.pocas.kr/2021/12/30/2021-12-30-s-xss-convos-chat/#Second-vulnerability - https://github.com/convos-chat/convos/commit/86b2193de375005ba71d9dd53843562c6ac1847c - https://www.huntr.dev/bounties/4532a0ac-4e7c-4fcf-9fe3-630e132325c0/ - https://github.com/convos-chat/convos/security/advisories/GHSA-xmpj-xwm3-vww7
CVE ID: CVE-2022-21650 State: PUBLISHED Published: 2022-01-04T20:40:14.000Z Last Updated: 2025-04-22T18:34:37.741Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: convos-chat Products: convos Problem Types: CWE-79 Description: Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scr
k is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.pocas.kr/2021/12/30/2021-12-30-s-xss-convos-chat/#First-vulnerability - https://github.com/convos-chat/convos/commit/5c0a1ec9a2c147bc3b63fd5a48da5f32e18fe5df - https://www.huntr.dev/bounties/ae424798-de01-4972-b73b-2db674f82368/ - https://github.com/convos-chat/convos/security/advisories/GHSA-mm2v-4v7g-m695
CVE ID: CVE-2022-21651 State: PUBLISHED Published: 2022-01-05T19:15:14.000Z Last Updated: 2025-04-23T19:14:41.168Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: shopware Products: shopware Problem Types: CWE-601 Description: Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware
e. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shopware/shopware/security/advisories/GHSA-c53v-qmrx-93hg - https://github.com/shopware/shopware/commit/a90046c765c57a46c4399dce17bd174253c32886 - https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
CVE ID: CVE-2022-21652 State: PUBLISHED Published: 2022-01-05T19:20:18.000Z Last Updated: 2025-04-23T19:14:34.905Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: shopware Products: shopware Problem Types: CWE-613 Description: Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are au
th said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022 - https://github.com/shopware/shopware/security/advisories/GHSA-p523-jrph-qjc6 - https://github.com/shopware/shopware/commit/47ebd126a94f4b019b6fde64c0df3d18d74ef7d0
CVE ID: CVE-2022-21653 State: PUBLISHED Published: 2022-01-05T21:00:12.000Z Last Updated: 2025-04-22T18:34:05.348Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: typelevel Products: jawn Problem Types: CWE-400 Description: Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `o
library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/typelevel/jawn/security/advisories/GHSA-vc89-hccf-rq55 - https://github.com/typelevel/jawn/pull/390
CVE ID: CVE-2022-21654 State: PUBLISHED Published: 2022-02-22T22:35:11.000Z Last Updated: 2025-04-23T19:01:27.096Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-295 Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/securi
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283 - https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
CVE ID: CVE-2022-21655 State: PUBLISHED Published: 2022-02-22T22:40:11.000Z Last Updated: 2025-04-23T19:01:21.074Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-670 Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
entries are configured on the same listener. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg - https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682
CVE ID: CVE-2022-21656 State: PUBLISHED Published: 2022-02-22T22:25:11.000Z Last Updated: 2025-04-23T19:01:38.563Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-295 Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by
icator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-c9g7-xwcv-pjx2 - https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e
CVE ID: CVE-2022-21657 State: PUBLISHED Published: 2022-02-22T22:30:12.000Z Last Updated: 2025-04-23T19:01:32.824Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-295 Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), eith
p-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
his issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5g - https://github.com/envoyproxy/envoy/pull/630
CVE ID: CVE-2022-21658 State: PUBLISHED Published: 2022-01-20T00:00:00.000Z Last Updated: 2025-04-22T18:32:53.619Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H) Vendors: rust-lang Products: rust Problem Types: CWE-363, CWE-367 Description: Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't oth
ould use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Not
d contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2 - https://github.com/rust-lang/rust/pull/93110 - https://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946 - https://git
pull/93110 - https://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946 - https://github.com/rust-lang/rust/pull/93110/commits/406cc071d6cfdfdb678bf3d83d766851de95abaf - https://github.com/rust-lang/rust/pull/93110/commits/4f0ad1c92ca08da6e8dc17838070975762f59714 - https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BK32QZLHDC2OVLPKTUHNT2G3VHWHD4LX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63NH72Q7UHJM5V3IVYRI7LVBGGFQMSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe
rg/message/C63NH72Q7UHJM5V3IVYRI7LVBGGFQMSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKGTACKMKAPRDPWPTU26GYWBELIRFF5N/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JKZDTBMGAWIFJSNWKBMPO5EAKRR4BEW/ - https://support.apple.com/kb/HT213183 - https://support.apple.com/kb/HT213182 - https://support.apple.com/kb/HT213186 - https://support.apple.com/kb/HT213193 - https://security.gentoo.org/glsa/202210-09
CVE ID: CVE-2022-21659 State: PUBLISHED Published: 2022-01-31T20:20:40.000Z Last Updated: 2025-05-05T16:34:10.131Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue. Additional Analys
dvised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-wfjw-w6pv-8p7f - https://github.com/dpgaspar/Flask-AppBuilder/pull/1775