deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-0935
Published: 2024-02-01
Description: Insertion of Sensitive Information into Log File vulnerabilities are affecting DELMIA Apriso Release 2019 through Release 2024
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.3ds.com/vulnerability/advisories; https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-24059
Published: 2024-02-01
Description: springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/springboot-manager.md#2-file-upload-vulnerability; https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/springboot-manager.md#2-file-upload-vulnerability
CVE: CVE-2024-24060
Published: 2024-02-01
Description: springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/springboot-manager.md#11-stored-cross-site-scripting-sysuser; https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/springboot-manager.md#11-stored-cross-site-scripting-sysuser
CVE: CVE-2024-24061
Published: 2024-02-01
Description: springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/springboot-manager.md#13-stored-cross-site-scripting-syscontentadd; https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/springboot-manager.md#13-stored-cross-site-scripting-syscontentadd
CVE: CVE-2024-24062
Published: 2024-02-01
Description: springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/springboot-manager.md#12-stored-cross-site-scripting-sysrole; https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/springboot-manager.md#12-stored-cross-site-scripting-sysrole
CVE: CVE-2024-0704
Published: 2024-02-01
Description: Rejected reason: very low impact - impractical to correct
CVE: CVE-2024-1141
Published: 2024-02-01
Description: A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-779
References: https://access.redhat.com/errata/RHSA-2024:2732; https://access.redhat.com/security/cve/CVE-2024-1141; https://bugzilla.redhat.com/show_bug.cgi?id=2258836
CVE: CVE-2024-24752
Published: 2024-02-01
Description: Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in `/tmp` with a random filename starting with `bref_upload_`. The flow mimics what plain PHP does but it does not delete the temporary files when the request has been processed. An attacker could fill the Lambda instance disk by performing multiple MultiPart requests containing files. This vulnerability is patched in 2.1.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840e; https://github.com/brefphp/bref/security/advisories/GHSA-x4hh-frx8-98r5; https://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840e
CVE: CVE-2024-24753
Published: 2024-02-01
Description: Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-436
References: https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc; https://github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r; https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc
CVE: CVE-2024-24754
Published: 2024-02-01
Description: Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the `$files` or `$parsedBody` arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with and open square bracket ([) are used. Based on the application logic the difference in the body parsing might lead to vulnerabilities and/or undefined behaviors. This vulnerability is patched in 2.1.13.
CVSS Score: 3.7 (LOW)
CWE: CWE-436
References: https://github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092; https://github.com/brefphp/bref/security/advisories/GHSA-82vx-mm6r-gg8w; https://github.com/brefphp/bref/commit/c77d9f5abf021f29fa96b5720b7b84adbd199092
CVE: CVE-2024-23832
Published: 2024-02-01
Description: Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as 4.0.x versions prior to 4.0.13, 4.1.x version prior to 4.1.13, and 4.2.x versions prior to 4.2.5.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-290
References: http://www.openwall.com/lists/oss-security/2024/02/02/4; https://github.com/mastodon/mastodon/commit/1726085db5cd73dd30953da858f9887bcc90b958; https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw
CVE: CVE-2024-24557
Published: 2024-02-01
Description: Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-345, CWE-346, CWE-346
References: https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae; https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc; https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae
CVE: CVE-2024-24561
Published: 2024-02-01
Description: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: https://github.com/vyperlang/vyper/blob/b01cd686aa567b32498fefd76bd96b0597c6f099/vyper/builtins/functions.py#L404-L457; https://github.com/vyperlang/vyper/issues/3756; https://github.com/vyperlang/vyper/security/advisories/GHSA-9x7f-gwxq-6f2c
CVE: CVE-2024-24570
Published: 2024-02-01
Description: Statamic is a Laravel and Git powered CMS. HTML files crafted to look like jpg files are able to be uploaded, allowing for XSS. This affects the front-end forms with asset fields without any mime type validation, asset fields in the control panel, and asset browser in the control panel. Additionally, if the XSS is crafted in a specific way, the "copy password reset link" feature may be exploited to gain access to a user's password reset token and gain access to their account. The authorized user is required to execute the XSS in order for the vulnerability to occur. In versions 4.46.0 and 3.4.17, the XSS vulnerability has been patched, and the copy password reset link functionality has been disabled.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: http://packetstormsecurity.com/files/177133/Statamic-CMS-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2024/Feb/17; https://github.com/statamic/cms/security/advisories/GHSA-vqxq-hvxw-9mv9
CVE: CVE-2023-51446
Published: 2024-02-01
Description: GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-74, CWE-90
References: https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35; https://github.com/glpi-project/glpi/releases/tag/10.0.12; https://github.com/glpi-project/glpi/security/advisories/GHSA-p995-jmfv-c7r8
CVE: CVE-2024-1167
Published: 2024-02-01
Description: 
When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-016-01; https://www.seweurodrive.com/contact_us/contact_us.html; https://www.cisa.gov/news-events/ics-advisories/icsa-24-016-01
CVE: CVE-2024-23645
Published: 2024-02-01
Description: GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages.  Upgrade to 10.0.12.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/commit/6cf265936c4f6edf7dea7c78b12e46d75b94d9b0; https://github.com/glpi-project/glpi/commit/fc1f6da9d158933b870ff374ed3a50ae98dcef4a; https://github.com/glpi-project/glpi/releases/tag/10.0.12
CVE: CVE-2023-5841
Published: 2024-02-01
Description: Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LSB6DB5LAKGPLRXEF5HDNGUMT7GIFT2C/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMINVKQLSUHECXBSQMZFCSDRIHFOJJI/; https://takeonme.org/cves/CVE-2023-5841.html
CVE: CVE-2024-24569
Published: 2024-02-01
Description: The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. `ZipSecurity#isBelowCurrentDirectory` is vulnerable to a partial-path traversal bypass. To be vulnerable to the bypass, the application must use toolkit version <=1.1.1, use ZipSecurity as a guard against path traversal, and have an exploit path. Although the control still protects attackers from escaping the application path into higher level directories (e.g., /etc/), it will allow "escaping" into sibling paths. For example, if your running path is /my/app/path you an attacker could navigate into /my/app/path-something-else. This vulnerability is patched in 1.1.2.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/pixee/java-security-toolkit/blob/7c8e93e6fb2420fb6003c54a741e267c4f883bab/src/main/java/io/github/pixee/security/ZipSecurity.java#L82-L87; https://github.com/pixee/java-security-toolkit/commit/b885b03c9cfae53d62d239037f9654d973dd54d9; https://github.com/pixee/java-security-toolkit/security/advisories/GHSA-qh4g-4m4w-jgv2
CVE: CVE-2024-24041
Published: 2024-02-01
Description: A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the location parameter at /travel-journal/write-journal.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/tubakvgc/CVE/blob/main/Travel_Journal_App.md; https://portswigger.net/web-security/cross-site-scripting; https://github.com/tubakvgc/CVE/blob/main/Travel_Journal_App.md
CVE: CVE-2024-24945
Published: 2024-02-01
Description: A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Share Your Moments parameter at /travel-journal/write-journal.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/tubakvgc/CVE/blob/main/Travel_Journal_App.md; https://portswigger.net/web-security/cross-site-scripting; https://github.com/tubakvgc/CVE/blob/main/Travel_Journal_App.md
CVE: CVE-2023-47256
Published: 2024-02-01
Description: ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://web.archive.org/web/[PII_REDACTED]0218/https://gotham-security.com/screenconnect-cve-2023-47256; https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.8-security-fix; https://web.archive.org/web/[PII_REDACTED]0218/https://gotham-security.com/screenconnect-cve-2023-47256
CVE: CVE-2023-47257
Published: 2024-02-01
Description: ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94, CWE-94
References: https://web.archive.org/web/[PII_REDACTED]0218/https://gotham-security.com/screenconnect-cve-2023-47256; https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.8-security-fix; https://web.archive.org/web/[PII_REDACTED]0218/https://gotham-security.com/screenconnect-cve-2023-47256
CVE: CVE-2023-4472
Published: 2024-02-01
Description: Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-335, CWE-335
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md; https://www.objectplanet.com/opinio/changelog.html; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md
CVE: CVE-2024-0325
Published: 2024-02-01
Description: In Helix Sync versions prior to 2024.1, a local command injection was identified.  Reported by Bryan Riggins.  

CVSS Score: 3.6 (LOW)
CWE: CWE-94, CWE-77
References: https://perforce.com; https://perforce.com
CVE: CVE-2024-1039
Published: 2024-02-01
Description: Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01
CVE: CVE-2024-1040
Published: 2024-02-01
Description: Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the device.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01
CVE: CVE-2024-24755
Published: 2024-02-01
Description: discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom fields to remain secret.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/discourse/discourse-group-membership-ip-block/commit/b394d61b0bdfd18a2d8310aa5cf26cccf8bd31c1; https://github.com/discourse/discourse-group-membership-ip-block/security/advisories/GHSA-r38c-cp8w-664m; https://github.com/discourse/discourse-group-membership-ip-block/commit/b394d61b0bdfd18a2d8310aa5cf26cccf8bd31c1
CVE: CVE-2023-36496
Published: 2024-02-01
Description: Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.

CVSS Score: 7.7 (HIGH)
CWE: CWE-269
References: https://docs.pingidentity.com/r/en-us/pingdirectory-93/ynf[PII_REDACTED]84; https://support.pingidentity.com/s/article/SECADV039; https://www.pingidentity.com/en/resources/downloads/pingdirectory-downloads.html
CVE: CVE-2023-46706
Published: 2024-02-01
Description: 


Multiple MachineSense devices have credentials unable to be changed by the user or administrator.




CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://machinesense.com/pages/about-machinesense; https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01; https://machinesense.com/pages/about-machinesense
CVE: CVE-2023-47867
Published: 2024-02-01
Description: 








MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device.










CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://machinesense.com/pages/about-machinesense; https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01; https://machinesense.com/pages/about-machinesense
CVE: CVE-2023-49115
Published: 2024-02-01
Description: 






MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.








CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://machinesense.com/pages/about-machinesense; https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01; https://machinesense.com/pages/about-machinesense
CVE: CVE-2023-49610
Published: 2024-02-01
Description: 










MachineSense FeverWarn Raspberry Pi-based devices lack input sanitization, which could allow an attacker on an adjacent network to send a message running commands or could overflow the stack.












CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://machinesense.com/pages/about-machinesense; https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01; https://machinesense.com/pages/about-machinesense
CVE: CVE-2023-49617
Published: 2024-02-01
Description: 




The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker could retrieve and modify sensitive information without any authentication.






CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://machinesense.com/pages/about-machinesense; https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01; https://machinesense.com/pages/about-machinesense
CVE: CVE-2023-6221
Published: 2024-02-01
Description: 
The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal procedures could view source code, secret credentials, and more.


CVSS Score: 7.7 (HIGH)
CWE: CWE-306, CWE-306
References: https://machinesense.com/pages/about-machinesense; https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01; https://machinesense.com/pages/about-machinesense
CVE: CVE-2024-21852
Published: 2024-02-01
Description: In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can supply a malicious configuration file by utilizing a Zip Slip vulnerability in the unpacking routine to achieve remote code execution.

CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://rapidscada.org/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-011-03; https://rapidscada.org/contact/
CVE: CVE-2024-22927
Published: 2024-02-01
Description: Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/57; https://github.com/weng-xianhu/eyoucms/issues/57
CVE: CVE-2024-23031
Published: 2024-02-01
Description: Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/57; https://github.com/weng-xianhu/eyoucms/issues/57
CVE: CVE-2024-23032
Published: 2024-02-01
Description: Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/57; https://github.com/weng-xianhu/eyoucms/issues/57
CVE: CVE-2024-23033
Published: 2024-02-01
Description: Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/57; https://github.com/weng-xianhu/eyoucms/issues/57
CVE: CVE-2024-23034
Published: 2024-02-01
Description: Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/weng-xianhu/eyoucms/issues/57; https://github.com/weng-xianhu/eyoucms/issues/57
CVE: CVE-2024-24756
Published: 2024-02-01
Description: Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be requested from the server. Instances running behind Cloudflare (including crafatar.com) are not affected. Instances using the Docker container as shown in the README are affected, but only files within the container can be read. By default, all of the files within the container can also be found in this repository and are not confidential. This vulnerability is patched in 2.1.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/crafatar/crafatar/blob/e0233f2899a3206a817d2dd3b80da83d51c7a726/lib/server.js#L64-L67; https://github.com/crafatar/crafatar/commit/bba004acc725b362a5d2d5dfe30cf60e7365a373; https://github.com/crafatar/crafatar/security/advisories/GHSA-5cxq-25mp-q5f2
CVE: CVE-2023-50939
Published: 2024-02-02
Description: IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  275129.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/275129; https://www.ibm.com/support/pages/node/7113759; https://exchange.xforce.ibmcloud.com/vulnerabilities/275129