deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-21693
Published: 2025-02-10
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: zswap: properly synchronize freeing resources during CPU hotunplug

In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the
current CPU at the beginning of the operation is retrieved and used
throughout.  However, since neither preemption nor migration are disabled,
it is possible that the operation continues on a different CPU.

If the original CPU is hotunplugged while the acomp_ctx is still in use,
we run into a UAF bug as some of the resources attached to the acomp_ctx
are freed during hotunplug in zswap_cpu_comp_dead() (i.e. 
acomp_ctx.buffer, acomp_ctx.req, or acomp_ctx.acomp).

The problem was introduced in commit 1ec3b5fe6eec ("mm/zswap: move to use
crypto_acomp API for hardware acceleration") when the switch to the
crypto_acomp API was made.  Prior to that, the per-CPU crypto_comp was
retrieved using get_cpu_ptr() which disables preemption and makes sure the
CPU cannot go away from under us.  Preemption cannot be disabled with the
crypto_acomp API as a sleepable context is needed.

Use the acomp_ctx.mutex to synchronize CPU hotplug callbacks allocating
and freeing resources with compression/decompression paths.  Make sure
that acomp_ctx.req is NULL when the resources are freed.  In the
compression/decompression paths, check if acomp_ctx.req is NULL after
acquiring the mutex (meaning the CPU was offlined) and retry on the new
CPU.

The initialization of acomp_ctx.mutex is moved from the CPU hotplug
callback to the pool initialization where it belongs (where the mutex is
allocated).  In addition to adding clarity, this makes sure that CPU
hotplug cannot reinitialize a mutex that is already locked by
compression/decompression.

Previously a fix was attempted by holding cpus_read_lock() [1].  This
would have caused a potential deadlock as it is possible for code already
holding the lock to fall into reclaim and enter zswap (causing a
deadlock).  A fix was also attempted using SRCU for synchronization, but
Johannes pointed out that synchronize_srcu() cannot be used in CPU hotplug
notifiers [2].

Alternative fixes that were considered/attempted and could have worked:
- Refcounting the per-CPU acomp_ctx. This involves complexity in
  handling the race between the refcount dropping to zero in
  zswap_[de]compress() and the refcount being re-initialized when the
  CPU is onlined.
- Disabling migration before getting the per-CPU acomp_ctx [3], but
  that's discouraged and is a much bigger hammer than needed, and could
  result in subtle performance issues.

[1]https://lkml.kernel.org/[PII_REDACTED]2[PII_REDACTED]-1-yosryahmed@google.com/
[2]https://lkml.kernel.org/[PII_REDACTED]4[PII_REDACTED]-2-yosryahmed@google.com/
[3]https://lkml.kernel.org/[PII_REDACTED]2[PII_REDACTED]-2-yosryahmed@google.com/

[yosryahmed@google.com: remove comment]
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/12dcb0ef540629a281533f9dedc1b6b8e14cfb65; https://git.kernel.org/stable/c/8d29ff5d50304daa41dc3cfdda4a9d1e46cf5be1
CVE: CVE-2025-24031
Published: 2025-02-10
Description: PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 module segfaults when a user presses ctrl-c/ctrl-d when they are asked for a PIN. When a user enters no PIN at all, `pam_get_pwd` will never initialize the password buffer pointer and as such `cleanse` will try to dereference an uninitialized pointer. On my system this pointer happens to have the value 3 most of the time when running sudo and as such it will segfault. The most likely impact to a system affected by this issue is an availability impact due to a daemon that uses PAM crashing. As of time of publication, a patch for the issue is unavailable.
CWE: CWE-476
References: https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db[PII_REDACTED]/src/pam_pkcs11/pam_pkcs11.c#L211; https://github.com/OpenSC/pam_pkcs11/blob/bb2e3f3a95e44fdf44b0d5a4b377db[PII_REDACTED]/src/pam_pkcs11/pam_pkcs11.c#L797; https://github.com/OpenSC/pam_pkcs11/security/advisories/GHSA-wvr3-c9x3-9mff
CVE: CVE-2025-24032
Published: 2025-02-10
Description: PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to none (the default value), then pam_pkcs11 will only check if the user is capable of logging into the token. An attacker may create a different token with the user's public data (e.g. the user's certificate) and a PIN known to the attacker. If no signature with the private key is required, then the attacker may now login as user with that created token. The default to *not* check the private key's signature has been changed with commit commi[PII_REDACTED]b59a99389043c90a1e7dd4d783b921, so that all versions starting with pam_pkcs11-0.6.0 should be affected. As a workaround, in `pam_pkcs11.conf`, set at least `cert_policy = signature;`.
CWE: CWE-287
References: https://github.com/OpenSC/pam_pkcs11/commit/470263258d1ac59c5eade439c4d9caba0097e6e6; https://github.com/OpenSC/pam_pkcs11/commit/b665b287ff955bbbd9539252ff9f9e2754c3fb48; https://github.com/OpenSC/pam_pkcs11/commit/d[PII_REDACTED]a77115db6e885d459382a2e52ee9e
CVE: CVE-2025-24892
Published: 2025-02-10
Description: OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a project. The issue has been resolved in OpenProject version 15.2.1. Those who are unable to upgrade may apply the patch manually.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/opf/openproject/pull/17783; https://github.com/opf/openproject/security/advisories/GHSA-mg4q-ghvh-cm2j; https://patch-diff.githubusercontent.com/raw/opf/openproject/pull/17783.patch
CVE: CVE-2025-25186
Published: 2025-02-10
Description: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser.  At any time while the client is connected, a malicious server can send  can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-405, CWE-409, CWE-770, CWE-789
References: https://github.com/ruby/net-imap/commit/70e3ddd071a94e450b3238570af482c296380b35; https://github.com/ruby/net-imap/commit/c8c5a643739d2669f0c9a6bb9770d0c045fd74a3; https://github.com/ruby/net-imap/commit/cb92191b1ddce2d978d01b56a0883b6ecf0b1022
CVE: CVE-2025-1150
Published: 2025-02-10
Description: A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
CVSS Score: 3.1 (LOW)
CWE: CWE-401, CWE-404, CWE-401
References: https://sourceware.org/bugzilla/attachment.cgi?id=15887; https://sourceware.org/bugzilla/show_bug.cgi?id=32576; https://vuldb.com/?ctiid.295054
CVE: CVE-2025-1151
Published: 2025-02-10
Description: A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
CVSS Score: 3.1 (LOW)
CWE: CWE-401, CWE-404, CWE-401
References: https://sourceware.org/bugzilla/attachment.cgi?id=15887; https://sourceware.org/bugzilla/show_bug.cgi?id=32576; https://vuldb.com/?ctiid.295055
CVE: CVE-2024-48170
Published: 2025-02-10
Description: PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload injected into the name in the profile.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://medium.com/@jose.inaciot/cve-2024-48170-bee6ccb773d4
CVE: CVE-2024-54954
Published: 2025-02-10
Description: OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1336
References: https://gist.github.com/kaoniniang2/03658cc78e789b992b378f4951bedfb7; https://gitee.com/yadong.zhang/DBlog/issues/IB6552
CVE: CVE-2024-57407
Published: 2025-02-10
Description: An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://gist.github.com/kaoniniang2/71f6a39535490ea2eeac371f33faec9c; https://gitee.com/aun/Timo/issues/IBBTZI
CVE: CVE-2024-57408
Published: 2025-02-10
Description: An arbitrary file upload vulnerability in the component /comm/upload of cool-admin-java v1.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://gist.github.com/kaoniniang2/2cfc83a612ba929279ed5fb8b91b45ba; https://github.com/cool-team-official/cool-admin-java; https://github.com/kaoniniang2/exploit/blob/main/Cool-admin-File%20upload%20vulnerability.md
CVE: CVE-2024-57409
Published: 2025-02-10
Description: A stored cross-site scripting (XSS) vulnerability in the Parameter List module of cool-admin-java v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the internet pictures field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/kaoniniang2/05c2d0acdf8002b7121edff93d5230d6; https://github.com/cool-team-official/cool-admin-java; https://github.com/kaoniniang2/exploit/blob/main/Cool-admin-xss.md
CVE: CVE-2025-1152
Published: 2025-02-10
Description: A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
CVSS Score: 3.1 (LOW)
CWE: CWE-401, CWE-404, CWE-401
References: https://sourceware.org/bugzilla/attachment.cgi?id=15887; https://sourceware.org/bugzilla/show_bug.cgi?id=32576; https://vuldb.com/?ctiid.295056
CVE: CVE-2025-25188
Published: 2025-02-10
Description: Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to authenticate other records in the zone. There is a second variant of this vulnerability involving DS records, where an authenticated DS record covering one DNSKEY leads to trust in signatures made by an unrelated DNSKEY in the same zone. Versions 0.24.3 and 0.25.0-alpha.5 fix the issue.
CWE: CWE-345
References: https://github.com/hickory-dns/hickory-dns/commit/e118c6eec569f4340421f86ee[PII_REDACTED]c63e9; https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-37wc-h8xc-5hc4
CVE: CVE-2024-10649
Published: 2025-02-10
Description: wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads from an AWS S3 bucket. This can lead to multiple security issues including denial of service, stored XSS, and information disclosure. The affected endpoints are '/v1/share/{id:str}' for uploading and '/v1/share/{id:str}' for downloading JSON files. The lack of authentication allows any user to upload and overwrite files, potentially causing the S3 bucket to run out of space, injecting malicious scripts, and accessing sensitive information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-306
References: https://huntr.com/bounties/1025793a-3c19-4148-a26e-80cd84d4822d; https://huntr.com/bounties/1025793a-3c19-4148-a26e-80cd84d4822d
CVE: CVE-2024-13010
Published: 2025-02-10
Description: The WP Foodbakery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on the 'search_type' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331; https://www.wordfence.com/threat-intel/vulnerabilities/id/f267527d-5fb5-4fc2-bb35-bc60854f1a68?source=cve
CVE: CVE-2024-13011
Published: 2025-02-10
Description: The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331; https://www.wordfence.com/threat-intel/vulnerabilities/id/850fc4db-6e02-44c7-836a-02c433a0bae7?source=cve
CVE: CVE-2024-13059
Published: 2025-02-10
Description: A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-29, CWE-22
References: https://github.com/mintplex-labs/anything-llm/commit/0b7bf68f2c02ca68075970fbf85d5a70ca5e94ca; https://huntr.com/bounties/92a875fe-c5b3-485c-b03f-d3185189e0b1; https://huntr.com/bounties/92a875fe-c5b3-485c-b03f-d3185189e0b1
CVE: CVE-2024-27859
Published: 2025-02-10
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://support.apple.com/en-us/120881; https://support.apple.com/en-us/120882; https://support.apple.com/en-us/120883
CVE: CVE-2024-42512
Published: 2025-02-10
Description: Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.
CVSS Score: 8.6 (HIGH)
CWE: CWE-208
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42512.pdf
CVE: CVE-2024-42513
Published: 2025-02-10
Description: Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-305
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42513.pdf
CVE: CVE-2024-46429
Published: 2025-02-10
Description: A hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using a default guest account with administrative privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://reddassolutions.com/blog/tenda_w18e_security_research
CVE: CVE-2024-46430
Published: 2025-02-10
Description: Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. Unauthorized password change via the web management portal allows an unauthenticated remote attacker to change the administrator password by sending a specially crafted HTTP POST request to the setLoginPassword function, bypassing the authentication mechanism.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://reddassolutions.com/blog/tenda_w18e_security_research
CVE: CVE-2024-46431
Published: 2025-02-10
Description: Tenda W18E V16.01.0.8(1625) is vulnerable to Buffer Overflow. An attacker with access to the web management portal can exploit this vulnerability by sending specially crafted data to the delWewifiPic function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://reddassolutions.com/blog/tenda_w18e_security_research
CVE: CVE-2024-46432
Published: 2025-02-10
Description: Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. An attacker can send a specially crafted HTTP POST request to the setQuickCfgWifiAndLogin function, which allows unauthorized changes to WiFi configuration settings and administrative credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://reddassolutions.com/blog/tenda_w18e_security_research
CVE: CVE-2024-46433
Published: 2025-02-10
Description: A default credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using the default rzadmin account with administrative privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://reddassolutions.com/blog/tenda_w18e_security_research
CVE: CVE-2024-46434
Published: 2025-02-10
Description: Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain administrative access by sending a specially crafted HTTP request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://reddassolutions.com/blog/tenda_w18e_security_research
CVE: CVE-2024-46435
Published: 2025-02-10
Description: A stack overflow vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an authenticated remote attacker to cause a denial of service or potentially execute arbitrary code. This vulnerability occurs due to improper input validation when handling user-supplied data in the delFacebookPic function.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://reddassolutions.com/blog/tenda_w18e_security_research
CVE: CVE-2024-46436
Published: 2025-02-10
Description: Hardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the device over the telnet service.
CVSS Score: 8.3 (HIGH)
CWE: CWE-798
References: https://reddassolutions.com/blog/tenda_w18e_security_research
CVE: CVE-2024-46437
Published: 2025-02-10
Description: A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information, including WiFi SSID, WiFi password, and base64-encoded administrator credentials, by sending a specially crafted HTTP POST request to the getQuickCfgWifiAndLogin function, bypassing authentication checks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://reddassolutions.com/blog/tenda_w18e_security_research
CVE: CVE-2024-54658
Published: 2025-02-10
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. Processing web content may lead to a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/120881; https://support.apple.com/en-us/120882; https://support.apple.com/en-us/120883
CVE: CVE-2024-8550
Published: 2025-02-10
Description: A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://huntr.com/bounties/7cd8f519-7c75-4936-889d-a17ea1bcb3ea; https://huntr.com/bounties/7cd8f519-7c75-4936-889d-a17ea1bcb3ea
CVE: CVE-2025-1153
Published: 2025-02-10
Description: A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component.
CVSS Score: 3.1 (LOW)
CWE: CWE-119
References: https://sourceware.org/bugzilla/show_bug.cgi?id=32603; https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150; https://vuldb.com/?ctiid.295057
CVE: CVE-2025-24200
Published: 2025-02-10
Description: An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/122173; https://support.apple.com/en-us/122174; https://support.apple.com/en-us/122345
CVE: CVE-2024-57177
Published: 2025-02-10
Description: A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information
CVSS Score: 7.3 (HIGH)
CWE: CWE-1336
References: https://github.com/perfood/couch-auth; https://github.com/waristea/cve-research/tree/main/CVE-2024-57177