Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-49090 State: PUBLISHED Published: 2023-11-29T14:38:52.195Z Last Updated: 2024-10-11T17:55:40.314Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: carrierwaveuploader Products: carrierwave Problem Types: CWE-79 Description: CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included
ent_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj - https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5 - https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3
CVE ID: CVE-2023-49091 State: PUBLISHED Published: 2023-11-29T19:16:37.723Z Last Updated: 2025-01-21T20:18:17.369Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: azukaar Products: Cosmos-Server Problem Types: CWE-613 Description: Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an attacker to use the token to gain unauthorized access to the application/system even after the user has logged out. This issue has been pat
token to gain unauthorized access to the application/system even after the user has logged out. This issue has been patched in version 0.13.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-hpvm-x7m8-3c6x - https://github.com/azukaar/Cosmos-Server/commit/7a3fdfb467bd4d1f8333e3e1f3c3f5fca0b69cd7
CVE ID: CVE-2023-49092 State: PUBLISHED Published: 2023-11-28T20:57:06.739Z Last Updated: 2024-11-27T16:03:51.520Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: RustCrypto Products: RSA Problem Types: CWE-385 Description: RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local u
a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RustCrypto/RSA/security/advisories/GHSA-c38w-74pg-36hr - https://github.com/RustCrypto/RSA/issues/19#issuecomment-1822995643
CVE ID: CVE-2023-49093 State: PUBLISHED Published: 2023-12-04T04:47:27.145Z Last Updated: 2024-10-10T20:14:07.250Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HtmlUnit Products: htmlunit Problem Types: CWE-94 Description: HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7 - https://www.htmlunit.org/changes-report.html#a3.9.0
CVE ID: CVE-2023-49094 State: PUBLISHED Published: 2023-11-30T04:49:37.404Z Last Updated: 2025-06-05T13:31:36.875Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: getsentry Products: symbolicator Problem Types: CWE-918 Description: Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if they have an account on Sentry instance. The issue has been fixed in the release 23.11.2. Additional Analyst Notes: - CVE Program Container:
on Sentry instance. The issue has been fixed in the release 23.11.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getsentry/symbolicator/security/advisories/GHSA-6576-pr6j-h9c6 - https://github.com/getsentry/symbolicator/pull/1332 - https://github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865a - https://github.com/getsentry/symbolicator/releases/tag/23.11.2
CVE ID: CVE-2023-49095 State: PUBLISHED Published: 2023-11-30T07:10:10.994Z Last Updated: 2024-11-27T15:54:12.214Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: nexryai Products: nexkey Problem Types: CWE-20 Description: nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nexryai/nexkey/security/advisories/GHSA-fpxw-rw9v-2gmx - https://github.com/nexryai/nexkey/commit/b96da0eac5a1
ithub.com/nexryai/nexkey/security/advisories/GHSA-fpxw-rw9v-2gmx - https://github.com/nexryai/nexkey/commit/b96da0eac5a1e75abba94cf926f1251842829bab
CVE ID: CVE-2023-49096 State: PUBLISHED Published: 2023-12-06T19:14:11.108Z Last Updated: 2025-05-28T15:44:52.025Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: jellyfin Products: jellyfin Problem Types: CWE-88 Description: Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the VideosController, specifically the `/Videos/<itemId>/stream` and `/Videos/<itemId>/stream.<container>` endpoints which are present in the current Jellyfin version. Additional endpoints in the AudioController might also be vulnerable, as they differ only slightly in execution. Those endpoints are reachable b
the AudioController might also be vulnerable, as they differ only slightly in execution. Those endpoints are reachable by an unauthenticated user. In order to exploit this vulnerability an unauthenticated attacker has to guess an itemId, which is a completely random GUID. It’s a very unlikely case even for a large media database with lots of items. Without an additional information leak, this vulnerability shouldn’t be directly exploitable, even if the instance is reachable from the Internet. There are a lot of query parameters that get accepted by the method. At least two of those, videoCodec and audioCodec are vulnerable to the argument injection. The values can be traced through a lot of
of those, videoCodec and audioCodec are vulnerable to the argument injection. The values can be traced through a lot of code and might be changed in the process. However, the fallback is to always use them as-is, which means we can inject our own arguments. Those arguments land in the command line of FFmpeg. Because UseShellExecute is always set to false, we can’t simply terminate the FFmpeg command and execute our own. It should only be possible to add additional arguments to FFmpeg, which is powerful enough as it stands. There is probably a way of overwriting an arbitrary file with malicious content. This vulnerability has been addressed in version 10.8.13. Users are advised to upgrade. Th
file with malicious content. This vulnerability has been addressed in version 10.8.13. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jellyfin/jellyfin/security/advisories/GHSA-866x-wj5j-2vf4 - https://github.com/jellyfin/jellyfin/issues/5415 - https://github.com/jellyfin/jellyfin/commit/a656799dc879d16d21bf2ce7ad412ebd5d45394a - https://cwe.mitre.org/data/definitions/88.html - https://en.wikipedia.org/wiki/Pass_the_hash - https://ffmpeg.org/ffmpeg-filters.html#drawtext-1
CVE ID: CVE-2023-49097 State: PUBLISHED Published: 2023-11-30T04:45:49.675Z Last Updated: 2024-11-27T15:55:49.263Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-640 Description: ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwo
secret code can be retrieved and used to reset the users password and take over his account. Accounts with MFA or Passwordless enabled can not be taken over by this attack. This issue has been patched in versions 2.41.6, 2.40.10 and 2.39.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-2wmj-46rj-qm2w
CVE ID: CVE-2023-49098 State: PUBLISHED Published: 2024-01-12T20:37:26.516Z Last Updated: 2025-06-03T14:04:02.387Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse-reactions Problem Types: CWE-284 Description: Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse-reactions/security/advisories/GHSA-mq82-7v5x-rhv8 - https://github.com/discourse/discourse-reactions/comm
urse/discourse-reactions/security/advisories/GHSA-mq82-7v5x-rhv8 - https://github.com/discourse/discourse-reactions/commit/2c26939395177730e492640d71aac68423be84fc
CVE ID: CVE-2023-49099 State: PUBLISHED Published: 2024-01-12T20:53:53.163Z Last Updated: 2025-06-17T21:09:17.903Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-284 Description: Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-j67x-x6mq-pwv4 - https://github.com/di
nt: References: - https://github.com/discourse/discourse/security/advisories/GHSA-j67x-x6mq-pwv4 - https://github.com/discourse/discourse/commit/1b288236387fc0a823e4f15f1aea8dde81b49d53
CVE ID: CVE-2023-49100 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-10-31T20:03:10.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0 through x6,
ged attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0 through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is possible. An attacker can still crash TF-A, however. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ARM-software/arm-trusted-firmware/blob/a05414bedc9b1cc35cf0795ce641b6b4db5bc97e/services/std_svc/sdei/sdei_main.c#L708 - https://github.com/ARM-software/arm-trusted-firmware/blob/a05414bedc9b1cc35cf0795ce641b6b4db5bc97e
ei/sdei_main.c#L708 - https://github.com/ARM-software/arm-trusted-firmware/blob/a05414bedc9b1cc35cf0795ce641b6b4db5bc97e/services/std_svc/sdei/sdei_main.c#L714 - https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-11.html
CVE ID: CVE-2023-49101 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-06-17T15:26:03.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mishandling of viewing the usage of SSL certificates. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.axigen.com/kb/show/400
CVE ID: CVE-2023-49102 State: PUBLISHED Published: 2023-11-22T00:00:00 Last Updated: 2024-08-02T21:46:29.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. An attacker with the Control capability can execute a file by setting the value of SevenZipCommand or UnrarCmd. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://nzbget.net/download - https://sec.maride.cc/posts/nzbget/
CVE ID: CVE-2023-49103 State: PUBLISHED Published: 2023-11-21T00:00:00.000Z Last Updated: 2025-10-21T23:05:32.034Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the o
les of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure. Additional Analyst Notes: - CVE Program C
ers from before February 2023 are not vulnerable to the credential disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://owncloud.org/security - https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
CVE ID: CVE-2023-49104 State: PUBLISHED Published: 2023-11-21T00:00:00 Last Updated: 2024-09-04T18:44:05.609Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AC:H/AV:N/A:N/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://owncloud.org/security - https://owncloud.com/security-advisories/subdomain
CISA ADP Vulnrichment: References: - https://owncloud.org/security - https://owncloud.com/security-advisories/subdomain-validation-bypass/
CVE ID: CVE-2023-49105 State: PUBLISHED Published: 2023-11-21T00:00:00 Last Updated: 2024-08-29T20:42:13.587Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
files. The earliest affected version is 10.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://owncloud.org/security - https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/
CVE ID: CVE-2023-49106 State: PUBLISHED Published: 2024-01-16T00:58:50.428Z Last Updated: 2024-11-13T20:58:16.990Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitachi Products: Hitachi Device Manager Problem Types: CWE-549 Description: Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent component).This issue affects Hitachi Device Manager: before 8.8.5-04. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-101/index.html
CVE ID: CVE-2023-49107 State: PUBLISHED Published: 2024-01-16T00:59:46.297Z Last Updated: 2025-06-02T15:12:18.349Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hitachi Products: Hitachi Device Manager Problem Types: CWE-209 Description: Generation of Error Message Containing Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Agent modules).This issue affects Hitachi Device Manager: before 8.8.5-04. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-101/index.html
CVE ID: CVE-2023-49108 State: PUBLISHED Published: 2023-12-04T05:08:29.398Z Last Updated: 2024-08-02T21:46:29.150Z Vendors: Sumitomo Electric Information Systems Co., Ltd. Products: RakRak Document Plus Problem Types: Directory traversal Description: Path traversal vulnerability exists in RakRak Document Plus Ver.3.2.0.0 to Ver.6.4.0.7 (excluding Ver.6.1.1.3a). If this vulnerability is exploited, arbitrary files on the server may be obtained or deleted by a user of the product with specific privileges. Additional Analyst Notes: - CVE Program Container: References: - https://rakrak.jp/RakDocSupport/rkspServlet - https://jvn.jp/en/jp/JVN46895889/
CVE ID: CVE-2023-49109 State: PUBLISHED Published: 2024-02-20T09:58:56.779Z Last Updated: 2025-02-13T17:18:34.198Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-94 Description: Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/dolphinscheduler/pull/14991 - https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5 - https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo
https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5 - https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8 - http://www.openwall.com/lists/oss-security/2024/02/20/4
CVE ID: CVE-2023-49110 State: PUBLISHED Published: 2024-06-20T12:29:34.997Z Last Updated: 2025-11-04T17:13:01.132Z Vendors: Kiuwan Products: SAST Problem Types: CWE-611 Description: When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the transmitted data consists of a ZIP archive containing several files, some of them in the XML file format. During Kiuwan's server-side processing of these XML files, it resolves external XML entities, resulting in a XML external entity injection attack. An attacker with privileges to scan source code within the "Code Security" module is able to extract any files of the operati
tacker with privileges to scan source code within the "Code Security" module is able to extract any files of the operating system with the rights of the application server user and is potentially able to gain sensitive files, such as configuration and passwords. Furthermore, this vulnerability also allows an attacker to initiate connections to internal systems, e.g. for port scans or accessing other internal functions / applications such as the Wildfly admin console of Kiuwan. This issue affects Kiuwan SAST: <master.1808.p685.q13371 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/kiuwan - https://www.kiuwan.com/docs/display/
richment: - CVE Program Container: References: - https://r.sec-consult.com/kiuwan - https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log
CVE ID: CVE-2023-49111 State: PUBLISHED Published: 2024-06-20T12:34:38.170Z Last Updated: 2025-11-04T17:13:02.645Z Vendors: Kiuwan Products: SAST Problem Types: CWE-79 Description: For Kiuwan installations with SSO (single sign-on) enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is especially critical in business environments using AD SSO authentication, e.g. via ADFS, where attackers could potentially steal AD passwords. This issue affects Kiuwan SAST: <master.1808.p685.q13371 Additional Analyst
ckers could potentially steal AD passwords. This issue affects Kiuwan SAST: <master.1808.p685.q13371 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/kiuwan - https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log
CVE ID: CVE-2023-49112 State: PUBLISHED Published: 2024-06-20T12:36:18.575Z Last Updated: 2025-11-04T17:13:04.026Z Vendors: Kiuwan Products: SAST Description: Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even though they have not been granted the necessary rights to do so. This issue affects Kiuwan SAST: <master.1808.p685.q13371 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/kiuwan
itional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/kiuwan - https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log