ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-8r8m-8qj7-8fm2: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the PFE of Juniper Networks Junos OS on PTX Series and QFX10k Series allows an adjacent unauthenticated attacker to gain access to sensitive information. PTX1000 and PTX10000 Series, and QFX10000 Series and PTX5000 Series devices sometimes do not reliably pad Ethernet packets, and thus some packets can contain fragments of system memory or data from previous packets. This issue is also known as 'Etherleak' and often detected as CVE-2003-0001. This issue affects: Juniper Networks Junos OS on PTX1000 and PTX10000 Series: All versions prior to 18.4R3-S11; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S8, 19.2R3-S4; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R2-S5, 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S2; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R1-S1, 21.2R2. Juniper Networks Junos OS on QFX10000 Series and PTX5000 Series: All versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R2-S9, 18.4R3-S10; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S8, 19.2R3-S4; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R2-S6, 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3-S1; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R2.
CVSS v3.1: 4.3
CVE-2008-1072: The TFTP dissector in Wireshark (formerly Ethereal) 0.6.0 through 0.99.7, when running on Ubuntu 7.10, allows remote attackers to cause a denial of service (crash or memory consumption) via a malformed packet, possibly related to a Cairo library bug.
CVSS v2.0: 4.7
RHSA-2022:1702: Red Hat Security Advisory: firefox security update
Mozilla: Bypassing permission prompt in nested browsing contexts Mozilla: iframe Sandbox bypass Mozilla: Reader mode bypassed SameSite cookies Mozilla: Fullscreen notification bypass using popups Mozilla: Leaking browser history with CSS variables Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
CVSS v3.1: 9.8
CVSS v3.0: 7.5
GHSA-m839-458p-p487: The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch
GHSA-6457-jqhp-fr49: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS v3.1: 5.4
CVE-2006-0572: phpstatus 1.0 does not require passwords when using cookies to identify a user, which allows remote attackers to bypass authentication.
CVSS v2.0: 7.5
CVE-2013-5551: Cisco Adaptive Security Appliance (ASA) Software, when certain same-security-traffic and management-access options are enabled, allows remote authenticated users to cause a denial of service (stack overflow and device reload) by using the clientless SSL VPN portal for internal-resource browsing, aka Bug ID CSCui51199.
CVSS v2.0: 6.3
CVE-2024-13627: WP Touch Slider <= 2.2 - Reflected XSS
The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS v3.1: 4.7
CVE-2015-3196: ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.
CVSS v2.0: 4.3
GHSA-hj8w-jv52-fv86: XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.
CVSS v3.1: 7.8
PYSEC-2011-12: Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
GHSA-w9wq-p7qh-9q68: In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read (due to improper input validation) vulnerability which could lead to local information disclosure. This issue is rated as moderate. Android: A-64340684. Reference: N-CVE-2018-6254.
CVSS v3.0: 3.3
CVE-2002-1865: Buffer overflow in the Embedded HTTP server, as used in (1) D-Link DI-804 4.68, Dl-704 V2.56b6, and Dl-704 V2.56b5 and (2) Linksys Etherfast BEFW11S4 Wireless AP + Cable/DSL Router 1.37.2 through 1.42.7 and Linksys WAP11 1.3 and 1.4, allows remote attackers to cause a denial of service (crash) via a long header, as demonstrated using the Host header.
CVSS v2.0: 5
GHSA-g66q-rfrg-hp99: An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows attackers to execute arbitrary code via uploading a crafted SVG file.
CVSS v3.1: 6.5
CVE-2008-3891: The SAML Single Sign-On (SSO) Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field.
CVSS v2.0: 7.5
GHSA-5v7x-9h3r-vmfx: Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and list the privileges of arbitrary users via unspecified vectors.
GHSA-p988-hvw7-6fpj: Unspecified vulnerability in Virtualization Manager 1.2.2 in IBM Systems Director 1.2.2 has unknown impact and attack vectors.
GHSA-fhv3-95jg-vjrh: Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.
CVSS v3.1: 10
CVE-2025-54155: File Station 5
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5018 and later
CVSS v4.0: 3.6
CVE-2010-2692: Cross-site scripting (XSS) vulnerability in 2daybiz Custom T-Shirt Design Script allows remote attackers to inject arbitrary web script or HTML via a review comment.
CVSS v2.0: 4.3
GHSA-27g3-qf2q-r4wm: The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS v3.1: 5.4
CVE-2019-8643: CVE-2019-8643: Arun Sharma of VMWare This issue is fixed in macOS Mojave 10.14. Description: A logic issue was addressed with improved state management..
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2008-5123: SQL injection vulnerability in admin.php in CCleague Pro 1.2 allows remote attackers to execute arbitrary SQL commands via the u parameter.
CVSS v2.0: 6.8
GHSA-4cqp-8pqq-phx4: Cross-Site Request Forgery (CSRF) vulnerability in Abu Bakar TWB Woocommerce Reviews allows Cross Site Request Forgery. This issue affects TWB Woocommerce Reviews: from n/a through 1.7.7.
CVSS v3.1: 4.3
GHSA-xhh8-8jq9-8vf6: In the Linux kernel, the following vulnerability has been resolved:fs/jfs: Add validity check for db_maxag and db_agprefBoth db_maxag and db_agpref are used as the index of the
db_agfree array, but there is currently no validity check for
db_maxag and db_agpref, which can lead to errors.The following is related bug reported by Syzbot:UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20
index 7936 is out of range for type 'atomic_t[128]'Add checking that the values of db_maxag and db_agpref are valid
indexes for the db_agfree array.
CVSS v3.1: 7.8
CVE-2021-35506: Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-qw52-qv79-54wv: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd s_schd, at 0x9d01a010, the value for the `grp` key is copied using `strcpy` to the buffer at `$sp+0x280`.This buffer is 16 bytes large, sending anything longer will cause a buffer overflow.
CVSS v3.1: 8.8
CVE-2026-6575: PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array.  This allows a table maintainer to infer memory values past that array end.  Within major version 18, minor versions before PostgreSQL 18.4 are affected.  Versions before PostgreSQL 18 are unaffected.
CVSS v3.1: 4.3
CVE-2017-16116: The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.
CVSS v3.1: 7.5
CVSS v2.0: 5
RHSA-2025:19951: Red Hat Security Advisory: bind security update
bind: Cache poisoning attacks with unsolicited RRs bind: Cache poisoning due to weak PRNG
CVSS v3.1: 8.6
GHSA-542f-549f-58vm: A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.
CVSS v3.1: 4.8
CVE-2024-48703: PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchdata parameter.
CVSS v3.1: 4.8
GHSA-9pqg-44mx-r5gr: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and  22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVSS v3.1: 3.7
GHSA-xcfg-fcr5-gw9r: Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser
SummaryA server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head texture data.
By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints.
This occurs server-side, without proper URL validation, and can be triggered by a Bedrock client.DetailsGeyser allows Bedrock clients to interact with Java Edition mechanics, including the creation of custom player heads using the minecraft:profile NBT structure.When a player head is created with a custom textures property, Geyser processes the Base64-encoded JSON value and forwards the embedded texture URL for resolution.
However, the URL contained in the textures.SKIN.url field is not sufficiently validated.PoC**Setup Environment:**Set up a Minecraft Server (Paper/Spigot) with the latest version of Geyser installed.Ensure you have a Bedrock client connected.**Prepare Listener:**Go to [webhook.site](https://webhook.site) and obtain a unique URL (e.g., `https://webhook.site/YOUR-UUID`).**Construct Payload:**Create a JSON payload pointing to your listener URL:
`{"textures":{"SKIN":{"url":"https://webhook.site/YOUR-UUID"}}}`Encode this JSON string to Base64.
*(You can use a terminal command: `echo -n '{"textures":{"SKIN":{"url":"..."}}}' | base64`)***Execute Command:**Run the following command in the Bedrock Edition client:
`/give @p minecraft:player_head[minecraft:profile={properties:[{name:"textures",value:"[PASTE_BASE64_HERE]"}]}]`**Verify:**Check the webhook.site dashboard.You will see an **HTTP GET request originating from the Minecraft Server's IP address**, not the client's IP.ImpactThis vulnerability allows server-side request forgery (SSRF) from the Minecraft server to arbitrary HTTP endpoints.Affected PartiesMinecraft servers running GeyserServer operators exposing internal or cloud metadata endpointsPotential ImpactsInternal network probing (e.g., intranet services, admin panels)Cloud metadata access attempts (e.g., 169.254.169.254)IP address disclosure of the Minecraft serverAbuse of the server as an HTTP request proxyAlthough the vulnerability is blind SSRF (no response data returned to the attacker), it is still useful for:Network mappingFirewall bypass attemptsCloud environment fingerprinting
CVSS v3.1: 2.4
CVE-2026-8149: GCM chunking can lead to bad tag exception on decryption
A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS on Linux, X86_64, AVX, AVX-512f.

 This vulnerability is associated with program files gcm128w, gcm512w.



This issue affects BC-LTS: from 2.73.0 before 2.73.11.
CVSS v4.0: 5.1
GHSA-gc7h-mj38-j8xm: MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years.
CVSS v3.0: 5.9
CVE-2025-48500: BIG-IP APM VPN web client for macOS vulnerability
A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. 
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v4.0: 7
CVSS v3.1: 7.3
CVE-2024-0806: Use after free in Passwords in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)
CVSS v3.1: 8.8
CVE-2003-1106: The SMTP service in Microsoft Windows 2000 before SP4 allows remote attackers to cause a denial of service (crash or hang) via an e-mail message with a malformed time stamp in the FILETIME attribute.
CVSS v2.0: 5
CVE-2023-41626: Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.
CVSS v3.1: 4.8
GHSA-pw3m-pc2q-29fr: WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer.
CVSS v3.1: 4.7
CVE-2007-4975: Cross-site scripting (XSS) vulnerability in hilfe.php in b1gMail 6.3.1 allows remote attackers to inject arbitrary web script or HTML via the chapter parameter.
CVSS v2.0: 4.3
GHSA-7ggw-h8pp-r95r: October CMS Session ID not invalidated after logout
ImpactWhen logging out, the session ID was not invalidated. This is not a problem while the user is logged out, but as soon as the user logs back in the old session ID would be valid again; which means that anyone that gained access to the old session cookie would be able to act as the logged in user. This is not a major concern for the majority of cases, since it requires a malicious party gaining access to the session cookie in the first place, but nevertheless has been fixed.PatchesIssue has been patched in Build 472 (v1.0.472) and v1.1.2.WorkaroundsApply https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually if unable to upgrade to Build 472 or v1.1.2.ReferencesReported by Anisio (Brazilian Information Security Analyst)http://cve.circl.lu/cve/CVE-2021-3311For more informationIf you have any questions or comments about this advisory:Email us at [hello@octobercms.com](mailto:hello@octobercms.com)Threat assessment:
CVSS v3.1: 9.8
CVE-2023-45757: Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability
Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page.
An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page.

Solution (choose one of three):
1. upgrade to bRPC > 1.6.0, download link:  https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 
2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch:  https://github.com/apache/brpc/pull/2411 
3. disable rpcz feature
CVSS v3.1: 6.1
GHSA-v6qx-vgv9-cr3j: The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/manage-attachments.php by adding a question mark (?) followed by the payload.
CVSS v3.1: 4.8
CVE-2023-43705: Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "translation_value[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS v3.1: 5.4
CVE-2021-2175: Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any View, Select Any View privilege with network access via Oracle Net to compromise Database Vault. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Database Vault accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1: 2.7
CVE-2016-6691: service/jni/com_android_server_wifi_Gbk2Utf.cpp in the Qualcomm Wi-Fi gbk2utf module in Android before 2016-10-05 allows remote attackers to cause a denial of service (framework crash) or possibly have unspecified other impact via an access point that has a malformed SSID with GBK encoding, aka Qualcomm internal bug CR 978452.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-5r2h-7rx4-jxmv: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a through 1.4.16.
CVSS v3.1: 5.9
CVE-2013-4655: Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service.
CVSS v3.1: 7.5
CVSS v2.0: 7.8
CVE-2011-2761: Google Chrome 14.0.794.0 does not properly handle a reload of a page generated in response to a POST, which allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web site, related to GetWidget methods.
CVSS v2.0: 4.3
CVE-2022-3383: Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.
CVSS v3.1: 7.2
GHSA-63v4-wjq3-45mp: Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
GHSA-5q52-45hp-63pf: Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted PNG image file, aka "GDI+ PNG Heap Overflow Vulnerability."
CVE-2025-71082: Bluetooth: btusb: revert use of devm_kzalloc in btusb
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: revert use of devm_kzalloc in btusb

This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in
btusb.c file").

In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This
ties the lifetime of all the btusb data to the binding of a driver to
one interface, INTF. In a driver that binds to other interfaces, ISOC
and DIAG, this is an accident waiting to happen.

The issue is revealed in btusb_disconnect(), where calling
usb_driver_release_interface(&btusb_driver, data->intf) will have devm
free the data that is also being used by the other interfaces of the
driver that may not be released yet.

To fix this, revert the use of devm and go back to freeing memory
explicitly.
CVSS v3.1: 7.8
CVE-2023-45215: A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS v3.1: 7.2
CVE-2023-23430: 

Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
CVSS v3.1: 3.3
GHSA-35g4-qx3c-vjhx: Automatic room upgrade handling can be used maliciously to bridge a room non-consentually
ImpactIf a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any mailcious admin of a bridged room can repoint the traffic to a different room without the new room being aware.PatchesVersions 2.6.1 and greater are patched.WorkaroundsDisabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options.ReferencesThe issue is patched by https://github.com/matrix-org/matrix-appservice-bridge/pull/330For more information]If you have any questions or comments about this advisory, email us at security@matrix.org.
CVSS v3.1: 6.5