[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$apiParty6fBuHLCPZ1LTYs42XHdVbjpSDOYYPYzyxeAGwSN5Tp8":3,"$apiParty1tnBUgIA78sD0ryDfSg0vojgURfiqP13VwknMhrE3ZA":563,"$apiParty1tnBUgIA78sD0ryDfSg0vojgURfiqP13VwknMhrE3ZA$H93EERW16b":563},{"product_data":4,"scene_data":21,"task_data":407,"modality_data":441,"domain_data":478},[5,9,12,15,18],{"name":6,"value":7,"add_value":8,"describe":8},"Rivo","1","",{"name":10,"value":11,"add_value":8,"describe":8},"Cubo","2",{"name":13,"value":14,"add_value":8,"describe":8},"Moye","3",{"name":16,"value":17,"add_value":8,"describe":8},"Juro","4",{"name":19,"value":20,"add_value":8,"describe":8},"Ordo","5",[22,73,135,197,232,267,302,337,372],{"name":23,"value":7,"add_value":24,"describe":25,"children":26},"Home & Indoor","sofa","AI enhances everyday home life. Our datasets cover real indoor scenes to support smart devices, robotics, and home intelligence.",[27,29,31,33,35,37,40,43,46,49,52,55,58,61,64,67,70],{"name":28,"value":7},"Living Room",{"name":30,"value":11},"Bedroom",{"name":32,"value":14},"Kitchen",{"name":34,"value":17},"Dining Area",{"name":36,"value":20},"Bathroom",{"name":38,"value":39},"Entrance \u002F Foyer","6",{"name":41,"value":42},"Corridor \u002F Hallway","7",{"name":44,"value":45},"Staircase","8",{"name":47,"value":48},"Home Office","9",{"name":50,"value":51},"Hobby \u002F Game Room","10",{"name":53,"value":54},"Worship Space","11",{"name":56,"value":57},"Garage","12",{"name":59,"value":60},"Utility \u002F Laundry Room","13",{"name":62,"value":63},"Pantry","14",{"name":65,"value":66},"Basement","15",{"name":68,"value":69},"Garden","16",{"name":71,"value":72},"Balcony","17",{"name":74,"value":11,"add_value":75,"describe":76,"children":77},"Office & Educational","workshop","AI is reshaping work and learning. Our datasets capture offices and classrooms to power automation and next-generation productivity tools.",[78,81,84,87,90,93,96,99,102,105,108,111,114,117,120,123,126,129,132],{"name":79,"value":80},"Open Office","18",{"name":82,"value":83},"Private Office","19",{"name":85,"value":86},"Co-working Space","20",{"name":88,"value":89},"Reception \u002F Lobby","21",{"name":91,"value":92},"Conference Room","22",{"name":94,"value":95},"Huddle Room \u002F Booth","23",{"name":97,"value":98},"Lecture Hall \u002F Auditorium","24",{"name":100,"value":101},"Classroom","25",{"name":103,"value":104},"Science Laboratory","26",{"name":106,"value":107},"Library","27",{"name":109,"value":110},"Design Studio","28",{"name":112,"value":113},"Pantry \u002F Breakroom","29",{"name":115,"value":116},"Cafeteria \u002F Canteen","30",{"name":118,"value":119},"Restroom (Commercial)","31",{"name":121,"value":122},"Gymnasium \u002F Sports Hall","32",{"name":124,"value":125},"Server Room","33",{"name":127,"value":128},"Mailroom \u002F Logistics","34",{"name":130,"value":131},"Janitorial Closet","35",{"name":133,"value":134},"Corridor \u002F Elevators","36",{"name":136,"value":14,"add_value":137,"describe":138,"children":139},"Healthcare & Medical","love-and-help","AI is advancing modern healthcare. Our datasets include clinics and hospitals to enable clinical insights and medical automation.",[140,143,146,149,152,155,158,161,164,167,170,173,176,179,182,185,188,191,194],{"name":141,"value":142},"Operating Theatre \u002F OR","37",{"name":144,"value":145},"Consultation Room","38",{"name":147,"value":148},"Treatment Room","39",{"name":150,"value":151},"Dental Clinic","40",{"name":153,"value":154},"Inpatient Ward","41",{"name":156,"value":157},"Nurse Station","42",{"name":159,"value":160},"ICU","43",{"name":162,"value":163},"NICU (Neonatal ICU)","44",{"name":165,"value":166},"Emergency Room (ER)","45",{"name":168,"value":169},"Hospital Corridor","46",{"name":171,"value":172},"Waiting Area","47",{"name":174,"value":175},"CT\u002FMRI","48",{"name":177,"value":178},"Medical Laboratory","49",{"name":180,"value":181},"Phlebotomy Room","50",{"name":183,"value":184},"Rehabilitation Gym","51",{"name":186,"value":187},"Assisted Living Room","52",{"name":189,"value":190},"Pharmacy","53",{"name":192,"value":193},"Sterile Processing Dept","54",{"name":195,"value":196},"Medical Storage","55",{"name":198,"value":17,"add_value":199,"describe":200,"children":201},"Business & Public Service","business","AI is elevating commercial and public services. Our datasets span retail, dining, and service centers to improve intelligent operations.",[202,205,208,211,214,217,220,223,226,229],{"name":203,"value":204},"Shopping Mall Atrium","86",{"name":206,"value":207},"Supermarket Shelf","87",{"name":209,"value":210},"Self-Checkout Counter","88",{"name":212,"value":213},"Restaurant Dining Hall","89",{"name":215,"value":216},"Commercial Kitchen","90",{"name":218,"value":219},"Hotel Lobby","91",{"name":221,"value":222},"Subway Platform","92",{"name":224,"value":225},"Security Checkpoint","93",{"name":227,"value":228},"Underground Parking","94",{"name":230,"value":231},"Bank Teller Zone","95",{"name":233,"value":20,"add_value":234,"describe":235,"children":236},"Industrial & Manufacturing","robot-arm","AI is modernizing industry. Our datasets capture factories and logistics spaces to support robotics and intelligent manufacturing.",[237,240,243,246,249,252,255,258,261,264],{"name":238,"value":239},"Final Assembly Line","96",{"name":241,"value":242},"Quality Control Station","97",{"name":244,"value":245},"Robotic Welding Cell","98",{"name":247,"value":248},"CNC Machining Center","99",{"name":250,"value":251},"Cleanroom","100",{"name":253,"value":254},"Automated Warehouse","101",{"name":256,"value":257},"Loading Dock","102",{"name":259,"value":260},"Sorting Center","103",{"name":262,"value":263},"Chemical Plant","104",{"name":265,"value":266},"Power Substation","105",{"name":268,"value":39,"add_value":269,"describe":270,"children":271},"Transportation & Driving","car","AI is revolutionizing mobility. Our datasets capture road networks, vehicle dynamics and traffic scenarios to support autonomous driving and intelligent transportation systems.",[272,275,278,281,284,287,290,293,296,299],{"name":273,"value":274},"Urban Intersection","56",{"name":276,"value":277},"Highway \u002F Expressway","57",{"name":279,"value":280},"Tunnel","58",{"name":282,"value":283},"Roundabout","59",{"name":285,"value":286},"School \u002F Hospital Zone","60",{"name":288,"value":289},"Toll Station","61",{"name":291,"value":292},"Construction Zone","62",{"name":294,"value":295},"Parking Garage","63",{"name":297,"value":298},"Driver Cabin","64",{"name":300,"value":301},"Adverse Weather","65",{"name":303,"value":42,"add_value":304,"describe":305,"children":306},"Outdoor & Construction","tent-tree","AI is optimizing outdoor operations. Our datasets capture construction sites, open-air work zones and outdoor infrastructure to support smart construction and autonomous outdoor machinery.",[307,310,313,316,319,322,325,328,331,334],{"name":308,"value":309},"Excavation Site","66",{"name":311,"value":312},"Scaffolding Area","67",{"name":314,"value":315},"Material Storage Yard","68",{"name":317,"value":318},"Site Entrance","69",{"name":320,"value":321},"Roadwork Zone","70",{"name":323,"value":324},"Bridge Infrastructure","71",{"name":326,"value":327},"Transmission Line","72",{"name":329,"value":330},"Open-pit Mine","73",{"name":332,"value":333},"Tunneling Site","74",{"name":335,"value":336},"Post-Disaster Rubble","75",{"name":338,"value":45,"add_value":339,"describe":340,"children":341},"Nature, Aerial & Aquatic","global-loop","AI is exploring the natural world. Our datasets capture terrestrial landscapes, aerial vistas and aquatic ecosystems to support environmental monitoring and autonomous exploration systems.",[342,345,348,351,354,357,360,363,366,369],{"name":343,"value":344},"Deep Forest","76",{"name":346,"value":347},"Farmland \u002F Crops","77",{"name":349,"value":350},"River \u002F Lake","78",{"name":352,"value":353},"Open Ocean","79",{"name":355,"value":356},"Underwater Coral Reef","80",{"name":358,"value":359},"Fish Farm","81",{"name":361,"value":362},"Mountain Terrain","82",{"name":364,"value":365},"Urban Low Altitude","83",{"name":367,"value":368},"Fire Scene","84",{"name":370,"value":371},"Desert \u002F Gobi","85",{"name":373,"value":48,"add_value":374,"describe":375,"children":376},"Virtul & Digital","siri","AI is reshaping the virtual realm. Our datasets capture digital twins, virtual environments and simulated spaces to support metaverse development and intelligent digital interaction.",[377,380,383,386,389,392,395,398,401,404],{"name":378,"value":379},"VR Social Space","106",{"name":381,"value":382},"Synthetic Driving Sim","107",{"name":384,"value":385},"Digital Twin City","108",{"name":387,"value":388},"FPS \u002F MOBA Game","109",{"name":390,"value":391},"Robotics Gym","110",{"name":393,"value":394},"AR Navigation","111",{"name":396,"value":397},"Virtual Showroom","112",{"name":399,"value":400},"Code \u002F IDE Interface","113",{"name":402,"value":403},"App GUI Screen","114",{"name":405,"value":406},"Synthetic Face\u002FID","115",[408,411,414,417,420,423,426,429,432,435,438],{"name":409,"value":7,"add_value":410,"describe":8},"Classification","rubric",{"name":412,"value":11,"add_value":413,"describe":8},"Detection","radar",{"name":415,"value":14,"add_value":416,"describe":8},"Segmentation","segmentation",{"name":418,"value":17,"add_value":419,"describe":8},"Tacking","crosshairs",{"name":421,"value":20,"add_value":422,"describe":8},"Estimation","streamline",{"name":424,"value":39,"add_value":425,"describe":8},"QA","qa",{"name":427,"value":42,"add_value":428,"describe":8},"Recognition","finger-scan",{"name":430,"value":45,"add_value":431,"describe":8},"Control","control",{"name":433,"value":48,"add_value":434,"describe":8},"Extraction","extraction",{"name":436,"value":51,"add_value":437,"describe":8},"Retrieval","retrieval",{"name":439,"value":54,"add_value":440,"describe":8},"Forecast","forecast",[442,445,448,451,454,457,460,463,466,469,472,475],{"name":443,"value":7,"add_value":444,"describe":8},"Audio","audio",{"name":446,"value":11,"add_value":447,"describe":8},"Image","image",{"name":449,"value":14,"add_value":450,"describe":8},"Text","text",{"name":452,"value":17,"add_value":453,"describe":8},"Video","video",{"name":455,"value":20,"add_value":456,"describe":8},"Multi","multi",{"name":458,"value":39,"add_value":459,"describe":8},"Document","document",{"name":461,"value":42,"add_value":462,"describe":8},"Time-Series","time-series",{"name":464,"value":45,"add_value":465,"describe":8},"3D cloud","cloud",{"name":467,"value":48,"add_value":468,"describe":8},"Code","code",{"name":470,"value":51,"add_value":471,"describe":8},"Event","event",{"name":473,"value":54,"add_value":474,"describe":8},"Motion","motion",{"name":476,"value":57,"add_value":477,"describe":8},"Interaction","interaction",[479,482,487,491,494,499,504,509,514,519,524,528,532,536,540,544,548,552,556,559],{"id":480,"value":480,"name":233,"intro":481,"add_value":234,"describe":481},2,"智能质检：利用图像识别、多模态模型对产品外观或声音、振动等数据进行分析，自动识别缺陷，提高质量控制效率。\n工业知识问答与文档理解：通过大模型理解和总结技术文档、操作手册，实现快速问答、知识检索和培训支持。\n安全监测与风险预警：实时分析视频、传感器和操作日志，识别潜在危险行为或异常状态，提前预警，保障人员和设备安全。",{"id":483,"value":483,"name":484,"intro":485,"add_value":486,"describe":485},3,"Finance & Insurance","风险评估与预测：分析大量客户数据，评估信用风险、市场风险等，预测违约概率、股价走势等，辅助金融机构决策。\n智能投顾：根据客户风险偏好、资产状况等，提供个性化投资组合建议，实时调整投资策略。\n反欺诈检测：通过分析交易数据、用户行为，识别异常交易和欺诈行为，保障金融安全。","funds",{"id":488,"value":488,"name":489,"intro":490,"add_value":269,"describe":490},1,"Transport & Automotive","智能座舱：打造多模态交互的 AI 座舱，通过语音、手势、面部识别等实现人机交互，如语音控制导航、音乐播放。\n驾驶员状态监测：识别疲劳、分心、抽烟、打电话等行为，通过大模型判断危险等级，触发相应提醒或干预机制。\n智能驾驶：AI 用于环境感知、路径规划与决策控制，使车辆能识别道路、行人、障碍物等，实现自适应巡航、自动泊车、车道保持等功能，提升驾驶安全性与便利性。",{"id":492,"value":492,"name":136,"intro":493,"add_value":137,"describe":493},4,"医学影像诊断：分析 CT、MRI 等影像，辅助医生检测疾病、识别病灶，如 AI 系统可快速发现肺部结节。\n医患对话助手：通过自然语言处理理解患者问题，提供初步健康建议或就诊指导，缓解医生接诊压力。\n智能健康管理：根据用户健康数据，提供个性化健康建议、疾病预警，如智能手环结合 AI 分析用户运动、睡眠、心率等数据。",{"id":495,"value":495,"name":496,"intro":497,"add_value":498,"describe":497},6,"Smart Devices","多模态交互：支持语音、手势、眼神等多种交互方式，如 AI 眼镜可通过语音指令实现翻译、搜索功能。\n智能感知与处理：使设备能感知环境、理解用户需求，如智能音箱根据环境噪音自动调节音量。\n个性化服务：根据用户使用习惯和偏好，提供个性化功能与服务，如智能手表为用户定制运动健身计划。","microscope",{"id":500,"value":500,"name":501,"intro":502,"add_value":503,"describe":502},8,"Law & Government","智能法律问答：面向公众或企业用户，提供合规、劳动法、婚姻继承、知识产权等常见法律问题的智能解答。\n合同审查与风险识别：利用大模型分析合同内容，识别潜在风险条款、漏洞或不合理约定，提升合同审核质量。\n法律知识图谱构建：自动梳理法规、案例、条文之间的引用关系，构建语义化知识图谱，支持智能分析和推理。","hammer",{"id":505,"value":505,"name":506,"intro":507,"add_value":508,"describe":507},7,"Education & Training","个性化学习：根据学生学习进度、能力和知识掌握情况，推送个性化学习内容与练习，如智能辅导系统为学生制定专属学习计划。\n智能教学辅助：AI 助教协助教师进行作业批改、答疑解惑，还可分析教学数据，为教师提供教学反馈，优化教学方法。\n虚拟学习环境：利用 AI 创建虚拟实验、历史场景等，让学生沉浸式学习，如在虚拟化学实验室中进行实验操作。","degree-hat",{"id":510,"value":510,"name":511,"intro":512,"add_value":513,"describe":512},5,"Agriculture & Food","作物病虫害识别与防治：通过图像识别分析农作物叶片、果实等症状，识别病虫害类型，给出防治建议，减少产量损失。\n农产品质量检测：利用图像和传感器数据，识别果蔬等农产品的成熟度、外观缺陷，进行自动分级，提高市场竞争力。\n农情监测与预测：利用卫星遥感、气象和传感器数据，结合大模型预测作物长势、干旱、洪涝等农情变化。","ph-farm",{"id":515,"value":515,"name":516,"intro":517,"add_value":518,"describe":517},9,"Retail & E-commerce","智能客服：通过自然语言对话理解用户需求，提供产品推荐、订单查询、退换货支持等服务，提升客户满意度。\n个性化营销推荐：基于用户浏览、购买、偏好等行为数据，生成个性化推荐内容与优惠策略，提高转化率和客单价。\n商品内容生成：自动撰写商品标题、卖点描述、使用说明等内容，适用于海量SKU的内容生产与多语言发布。","buy",{"id":520,"value":520,"name":521,"intro":522,"add_value":523,"describe":8},10,"Security & Protection",null,"safe-shield-line",{"id":525,"value":525,"name":526,"intro":522,"add_value":527,"describe":8},11,"Environment & Climate","weather",{"id":529,"value":529,"name":530,"intro":522,"add_value":531,"describe":8},12,"Energy & Resource","energy-leaf",{"id":533,"value":533,"name":534,"intro":522,"add_value":535,"describe":8},13,"Express & Logistics","speed-outline",{"id":537,"value":537,"name":538,"intro":522,"add_value":539,"describe":8},15,"Sports","baseball-outline",{"id":541,"value":541,"name":542,"intro":522,"add_value":543,"describe":8},16,"General Data","daily-booth",{"id":545,"value":545,"name":546,"intro":522,"add_value":547,"describe":8},17,"Content & Media","media",{"id":549,"value":549,"name":550,"intro":522,"add_value":551,"describe":8},18,"Construction","construction",{"id":553,"value":553,"name":554,"intro":522,"add_value":555,"describe":8},19,"IT & Telecom","tech",{"id":557,"value":557,"name":558,"intro":522,"add_value":498,"describe":8},20,"Science & Research",{"id":560,"value":560,"name":561,"intro":522,"add_value":562,"describe":8},21,"Language & Culture","lang",{"id":564,"unique_code":565,"title":566,"icon":8,"intro":567,"cate":483,"detail":568,"create_time":569,"update_time":570,"price":571,"view_count":525,"download_count":572,"unit":572,"amount":573,"is_create_order":572,"enterprise_id":488,"seo_keywords":574,"seo_description":575,"data_format":576,"file_size":577,"apply_scene":578,"training_task":579,"version":580,"dataset_type_id":492,"dataset_scene_id":520,"sample_file":581,"banner":8,"unit_name":8,"cate_name":449,"icon_url":8,"banner_url":8,"sample_file_url":8,"data_dict":582,"qa_list":623,"sample_metadatas":640,"text_sample_content":668,"enterprise_name":669,"enterprise_logo":670,"data_distribution":671},1315,"38650d301ce4838deec683014560b9b8","Web Vulnerability Advisory Comprehensive QA Dataset","Train expert security QA models to reason from vulnerability advisories, applicability details, and protection guidance.","\u003Cp>This dataset is built around Web application vulnerability advisories and includes original advisory text, affected products and versions, technical background, and protection recommendations, paired with questions that require synthesis of the materials and expert reference answers. Fields for impact scope, applicability conditions, protection points, and evidence basis help models learn to integrate vulnerability knowledge and produce accurate, source-grounded security answers. It is suitable for supervised fine-tuning in Web security, QA evaluation, and the development of security knowledge assistants.\u003C\u002Fp>","2026-10-17 17:58:44","2026-10-19 18:25:26","0.00",0,5000,"Web vulnerability dataset,Vulnerability advisory QA,Web application security,Security question answering,Security LLM training,Vulnerability impact analysis,Mitigation guidance,Domain SFT data","A Web security QA dataset covering vulnerability impact, applicability, mitigations, and expert answers for domain SFT and evaluation.","JSON","0.3GB","web vulnerability assessment, cybersecurity advisory analysis, vulnerability mitigation guidance","security question answering, vulnerability applicability analysis, evidence-based reasoning","V1.0","rivo\u002Fsample-packages\u002Fa302b295-7581-4cff-82f9-b240a71316c7\u002F20261017.zip",[583,588,593,598,603,608,613,618],{"id":572,"name":584,"field":585,"intro":586,"type":587},"File Name","file_name","File name","string",{"id":589,"name":590,"field":591,"intro":592,"type":587},9710,"Question","question","A question that requires synthesizing the advisory materials, such as assessing vulnerability impact, applicability, or protection guidance.",{"id":594,"name":595,"field":596,"intro":597,"type":587},9711,"Impact Scope","impact_scope","A source-grounded summary of affected products, versions, components, or vulnerability consequences.",{"id":599,"name":600,"field":601,"intro":602,"type":587},9712,"Expert Answer","expert_answer","The original expert-provided reference answer to the question.",{"id":604,"name":605,"field":606,"intro":607,"type":587},9713,"Evidence Basis","evidence_basis","An account of the advisory details that support the answer and its conclusions.",{"id":609,"name":610,"field":611,"intro":612,"type":587},9714,"Protection Points","protection_points","Key mitigation, remediation, or defensive guidance supported by the source materials.",{"id":614,"name":615,"field":616,"intro":617,"type":587},9715,"Advisory Materials","advisory_materials","Original vulnerability advisory text, affected-version information, technical background, and protection recommendations.",{"id":619,"name":620,"field":621,"intro":622,"type":587},9716,"Applicability Conditions","applicability_conditions","Conditions under which the vulnerability applies, such as configuration, deployment, or feature prerequisites.",[624,628,632,636],{"id":625,"question":626,"answer":627},6713,"What does the dataset contain?","It includes original vulnerability advisories, affected-version information, technical background, and protection recommendations, along with related questions and expert reference answers. Structured fields also capture impact scope, applicability conditions, protection points, and the evidence supporting conclusions.",{"id":629,"question":630,"answer":631},6714,"Which model capabilities can it support?","It can support training models to read long-form vulnerability materials, synthesize impact and applicability details, extract mitigation guidance, and answer security questions using source evidence. It can also be used to evaluate these capabilities.",{"id":633,"question":634,"answer":635},6715,"What are the dataset size and quality specifications?","The sample count, product coverage, and detailed quality metrics should be confirmed in the delivery documentation. Expert reference answers and evidence-related fields support answer verification and training-data review.",{"id":637,"question":638,"answer":639},6716,"How can I obtain the dataset, and what are the licensing terms?","Contact the dataset provider or consult the product page for availability, delivery format, and licensing terms. Before use, verify the permitted scope and comply with applicable copyright, information security, and vulnerability disclosure requirements.",[641,656],{"id":642,"relate_table":643,"relate_id":644,"file_size":572,"file_name":645,"path":8,"duration":572,"cate":483,"file_format":646,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":647,"cate_name":648,"question":649,"impact_scope":650,"expert_answer":651,"evidence_basis":652,"protection_points":653,"advisory_materials":654,"applicability_conditions":655},15344,"union_cubo",1750214608,"样例_2.json","json","{\"question\": \"What deployment conditions make this access-control issue applicable, what information is exposed, and what should administrators do?\", \"impact_scope\": \"Northmere Workspace Portal 3.1.0–3.1.7 and 3.2.0–3.2.2 are affected in shared multi-tenant deployments with Scheduled Report Export enabled. A signed-in user who obtains another tenant’s export job identifier may retrieve that export. The exposed file contents include member display names, email addresses, and workspace labels. The advisory does not identify exposure of passwords or authentication tokens, and states that single-tenant deployments are not affected.\", \"expert_answer\": \"The issue affects Northmere Workspace Portal 3.1.0–3.1.7 and 3.2.0–3.2.2 only in shared multi-tenant deployments where Scheduled Report Export is enabled. A signed-in user who obtains another tenant’s export job identifier may retrieve that export because the download handler checks authentication but not tenant ownership. The files contain member display names, email addresses, and workspace labels; the advisory does not identify password or authentication-token exposure. Upgrade to 3.1.8 or 3.2.3. Until then, disable Scheduled Report Export, remove cached export files, and review access logs for cross-tenant downloads. Single-tenant deployments are not affected.\", \"evidence_basis\": \"The advisory provides the affected and fixed version ranges and limits the issue to shared multi-tenant deployments with Scheduled Report Export enabled. It states that the handler checks sign-in status but not tenant ownership, and that a signed-in user with another tenant’s export job identifier may retrieve the file. It lists the file contents as member display names, email addresses, and workspace labels, explicitly notes that passwords and authentication tokens have not been identified as exposed, and excludes single-tenant deployments. The recommended actions and the tenant-ownership check in the fix are also specified in the advisory.\", \"protection_points\": \"Upgrade to 3.1.8 or 3.2.3. Until patched, disable Scheduled Report Export and remove cached export files. Review access logs for cross-tenant export downloads. The fixed releases enforce tenant ownership checks when an export is requested.\", \"advisory_materials\": \"## Security advisory: Northmere Workspace Portal tenant export access control\\n\\n**Affected component:** Scheduled Report Export\\n\\n**Affected versions:** 3.1.0 through 3.1.7 and 3.2.0 through 3.2.2.\\n\\n**Fixed versions:** 3.1.8 and 3.2.3.\\n\\nIn affected releases, the authenticated download handler verifies that a user is signed in but does not verify that the requested export job belongs to the user's tenant. In a shared multi-tenant deployment with Scheduled Report Export enabled, a signed-in user who obtains another tenant's export job identifier may retrieve that export. Export files contain member display names, email addresses, and workspace labels. The advisory has not identified exposure of passwords or authentication tokens through this issue. Single-tenant deployments are not affected.\\n\\nUpdate to 3.1.8 or 3.2.3. If an update cannot be applied promptly, disable Scheduled Report Export and remove cached export files. Review access logs for cross-tenant export downloads. The fix enforces tenant ownership checks when an export is requested.\", \"applicability_conditions\": \"The deployment must be shared and multi-tenant, Scheduled Report Export must be enabled, and the requester must be signed in and obtain another tenant’s export job identifier. The vulnerable handler checks authentication but fails to verify that the export belongs to the requester’s tenant. Single-tenant deployments are outside the advisory’s affected scope.\"}","文本","What deployment conditions make this access-control issue applicable, what information is exposed, and what should administrators do?","Northmere Workspace Portal 3.1.0–3.1.7 and 3.2.0–3.2.2 are affected in shared multi-tenant deployments with Scheduled Report Export enabled. A signed-in user who obtains another tenant’s export job identifier may retrieve that export. The exposed file contents include member display names, email addresses, and workspace labels. The advisory does not identify exposure of passwords or authentication tokens, and states that single-tenant deployments are not affected.","The issue affects Northmere Workspace Portal 3.1.0–3.1.7 and 3.2.0–3.2.2 only in shared multi-tenant deployments where Scheduled Report Export is enabled. A signed-in user who obtains another tenant’s export job identifier may retrieve that export because the download handler checks authentication but not tenant ownership. The files contain member display names, email addresses, and workspace labels; the advisory does not identify password or authentication-token exposure. Upgrade to 3.1.8 or 3.2.3. Until then, disable Scheduled Report Export, remove cached export files, and review access logs for cross-tenant downloads. Single-tenant deployments are not affected.","The advisory provides the affected and fixed version ranges and limits the issue to shared multi-tenant deployments with Scheduled Report Export enabled. It states that the handler checks sign-in status but not tenant ownership, and that a signed-in user with another tenant’s export job identifier may retrieve the file. It lists the file contents as member display names, email addresses, and workspace labels, explicitly notes that passwords and authentication tokens have not been identified as exposed, and excludes single-tenant deployments. The recommended actions and the tenant-ownership check in the fix are also specified in the advisory.","Upgrade to 3.1.8 or 3.2.3. Until patched, disable Scheduled Report Export and remove cached export files. Review access logs for cross-tenant export downloads. The fixed releases enforce tenant ownership checks when an export is requested.","## Security advisory: Northmere Workspace Portal tenant export access control\n\n**Affected component:** Scheduled Report Export\n\n**Affected versions:** 3.1.0 through 3.1.7 and 3.2.0 through 3.2.2.\n\n**Fixed versions:** 3.1.8 and 3.2.3.\n\nIn affected releases, the authenticated download handler verifies that a user is signed in but does not verify that the requested export job belongs to the user's tenant. In a shared multi-tenant deployment with Scheduled Report Export enabled, a signed-in user who obtains another tenant's export job identifier may retrieve that export. Export files contain member display names, email addresses, and workspace labels. The advisory has not identified exposure of passwords or authentication tokens through this issue. Single-tenant deployments are not affected.\n\nUpdate to 3.1.8 or 3.2.3. If an update cannot be applied promptly, disable Scheduled Report Export and remove cached export files. Review access logs for cross-tenant export downloads. The fix enforces tenant ownership checks when an export is requested.","The deployment must be shared and multi-tenant, Scheduled Report Export must be enabled, and the requester must be signed in and obtain another tenant’s export job identifier. The vulnerable handler checks authentication but fails to verify that the export belongs to the requester’s tenant. Single-tenant deployments are outside the advisory’s affected scope.",{"id":657,"relate_table":643,"relate_id":658,"file_size":572,"file_name":659,"path":8,"duration":572,"cate":483,"file_format":646,"audio_rate":8,"audio_channel":522,"audio_bit_depth":522,"quality":8,"annotation":660,"cate_name":648,"question":661,"impact_scope":662,"expert_answer":663,"evidence_basis":664,"protection_points":665,"advisory_materials":666,"applicability_conditions":667},15343,552892773,"样例_1.json","{\"question\": \"Which deployments and users are in scope, what could an attacker accomplish, and what remediation should operators prioritize?\", \"impact_scope\": \"Affected products are Morrowfen CMS 5.4.0–5.4.3 and 5.5.0–5.5.1. The affected component is Remote Media Import. An authenticated user with media-management permission may cause server-side requests to reachable private or local services and may view returned responses in the import preview. The advisory does not identify unauthenticated access or server-side code execution. Versions earlier than 5.4.0 were not evaluated.\", \"expert_answer\": \"Morrowfen CMS 5.4.0–5.4.3 and 5.5.0–5.5.1 are affected. The issue requires Remote Media Import to be available and an authenticated user to have media-management permission; it is not an unauthenticated attack. Such a user may cause the application server to contact services on networks it can reach and may see a returned response in the import preview. The advisory does not report server-side code execution. Upgrade to 5.4.4 or 5.5.2, or disable Remote Media Import until patched. Also restrict the server’s outbound access to private and local networks and review media-import logs. The fix revalidates destinations after DNS resolution and redirects.\", \"evidence_basis\": \"The advisory identifies the affected and fixed version ranges, names Remote Media Import, and states that media managers can supply a URL. It explains that affected releases follow redirects without rechecking private or local destinations and that the import preview returns fetched responses to the initiating user. It also states that the component is enabled by default, requires media-management permission, does not provide unauthenticated access, and has no identified server-side code-execution path. The listed mitigations and the fixed releases’ destination-validation behavior are stated in the advisory.\", \"protection_points\": \"Upgrade to 5.4.4 or 5.5.2. If an update cannot be applied immediately, disable Remote Media Import. Restrict outbound access from the application server to private and local address ranges, and review media-import logs for unusual requests. The fixed releases validate destinations after DNS resolution and after each redirect.\", \"advisory_materials\": \"## Security advisory: Morrowfen CMS remote media import\\n\\n**Affected component:** Remote Media Import\\n\\n**Affected versions:** 5.4.0 through 5.4.3 and 5.5.0 through 5.5.1. Versions earlier than 5.4.0 have not been evaluated.\\n\\n**Fixed versions:** 5.4.4 and 5.5.2.\\n\\nThe Remote Media Import component retrieves media from a URL supplied by a user with permission to manage media. In affected releases, the server follows redirects without rechecking whether the destination resolves to a private or local network address. The import preview returns the fetched response to the initiating user. An authenticated media manager could therefore use the component to make the application server contact services reachable from its network and, where a response is returned, view that response in the preview. The issue does not provide unauthenticated access and the advisory has not identified a path to execute code on the server.\\n\\nThe component is enabled by default. The issue applies only when Remote Media Import is available and the user has media-management permission. Update to a fixed version. Until the update is applied, disable Remote Media Import. Restrict outbound network access from the application server, including access to private and local address ranges, and review media-import logs for unusual requests. The fixed releases validate destinations after DNS resolution and after each redirect.\", \"applicability_conditions\": \"Remote Media Import must be available, and the user must have permission to manage media. The vulnerable behavior occurs when the application follows a redirect without rechecking whether its destination resolves to a private or local network address. The component is enabled by default. The advisory does not establish applicability to versions earlier than 5.4.0.\"}","Which deployments and users are in scope, what could an attacker accomplish, and what remediation should operators prioritize?","Affected products are Morrowfen CMS 5.4.0–5.4.3 and 5.5.0–5.5.1. The affected component is Remote Media Import. An authenticated user with media-management permission may cause server-side requests to reachable private or local services and may view returned responses in the import preview. The advisory does not identify unauthenticated access or server-side code execution. Versions earlier than 5.4.0 were not evaluated.","Morrowfen CMS 5.4.0–5.4.3 and 5.5.0–5.5.1 are affected. The issue requires Remote Media Import to be available and an authenticated user to have media-management permission; it is not an unauthenticated attack. Such a user may cause the application server to contact services on networks it can reach and may see a returned response in the import preview. The advisory does not report server-side code execution. Upgrade to 5.4.4 or 5.5.2, or disable Remote Media Import until patched. Also restrict the server’s outbound access to private and local networks and review media-import logs. The fix revalidates destinations after DNS resolution and redirects.","The advisory identifies the affected and fixed version ranges, names Remote Media Import, and states that media managers can supply a URL. It explains that affected releases follow redirects without rechecking private or local destinations and that the import preview returns fetched responses to the initiating user. It also states that the component is enabled by default, requires media-management permission, does not provide unauthenticated access, and has no identified server-side code-execution path. The listed mitigations and the fixed releases’ destination-validation behavior are stated in the advisory.","Upgrade to 5.4.4 or 5.5.2. If an update cannot be applied immediately, disable Remote Media Import. Restrict outbound access from the application server to private and local address ranges, and review media-import logs for unusual requests. The fixed releases validate destinations after DNS resolution and after each redirect.","## Security advisory: Morrowfen CMS remote media import\n\n**Affected component:** Remote Media Import\n\n**Affected versions:** 5.4.0 through 5.4.3 and 5.5.0 through 5.5.1. Versions earlier than 5.4.0 have not been evaluated.\n\n**Fixed versions:** 5.4.4 and 5.5.2.\n\nThe Remote Media Import component retrieves media from a URL supplied by a user with permission to manage media. In affected releases, the server follows redirects without rechecking whether the destination resolves to a private or local network address. The import preview returns the fetched response to the initiating user. An authenticated media manager could therefore use the component to make the application server contact services reachable from its network and, where a response is returned, view that response in the preview. The issue does not provide unauthenticated access and the advisory has not identified a path to execute code on the server.\n\nThe component is enabled by default. The issue applies only when Remote Media Import is available and the user has media-management permission. Update to a fixed version. Until the update is applied, disable Remote Media Import. Restrict outbound network access from the application server, including access to private and local address ranges, and review media-import logs for unusual requests. The fixed releases validate destinations after DNS resolution and after each redirect.","Remote Media Import must be available, and the user must have permission to manage media. The vulnerable behavior occurs when the application follows a redirect without rechecking whether its destination resolves to a private or local network address. The component is enabled by default. The advisory does not establish applicability to versions earlier than 5.4.0.","{\"question\":\"What deployment conditions make this access-control issue applicable, what information is exposed, and what should administrators do?\",\"impact_scope\":\"Northmere Workspace Portal 3.1.0–3.1.7 and 3.2.0–3.2.2 are affected in shared multi-tenant deployments with Scheduled Report Export enabled. A signed-in user who obtains another tenant’s export job identifier may retrieve that export. The exposed file contents include member display names, email addresses, and workspace labels. The advisory does not identify exposure of passwords or authentication tokens, and states that single-tenant deployments are not affected.\",\"expert_answer\":\"The issue affects Northmere Workspace Portal 3.1.0–3.1.7 and 3.2.0–3.2.2 only in shared multi-tenant deployments where Scheduled Report Export is enabled. A signed-in user who obtains another tenant’s export job identifier may retrieve that export because the download handler checks authentication but not tenant ownership. The files contain member display names, email addresses, and workspace labels; the advisory does not identify password or authentication-token exposure. Upgrade to 3.1.8 or 3.2.3. Until then, disable Scheduled Report Export, remove cached export files, and review access logs for cross-tenant downloads. Single-tenant deployments are not affected.\",\"evidence_basis\":\"The advisory provides the affected and fixed version ranges and limits the issue to shared multi-tenant deployments with Scheduled Report Export enabled. It states that the handler checks sign-in status but not tenant ownership, and that a signed-in user with another tenant’s export job identifier may retrieve the file. It lists the file contents as member display names, email addresses, and workspace labels, explicitly notes that passwords and authentication tokens have not been identified as exposed, and excludes single-tenant deployments. The recommended actions and the tenant-ownership check in the fix are also specified in the advisory.\",\"protection_points\":\"Upgrade to 3.1.8 or 3.2.3. Until patched, disable Scheduled Report Export and remove cached export files. Review access logs for cross-tenant export downloads. The fixed releases enforce tenant ownership checks when an export is requested.\",\"advisory_materials\":\"## Security advisory: Northmere Workspace Portal tenant export access control\\n\\n**Affected component:** Scheduled Report Export\\n\\n**Affected versions:** 3.1.0 through 3.1.7 and 3.2.0 through 3.2.2.\\n\\n**Fixed versions:** 3.1.8 and 3.2.3.\\n\\nIn affected releases, the authenticated download handler verifies that a user is signed in but does not verify that the requested export job belongs to the user's tenant. In a shared multi-tenant deployment with Scheduled Report Export enabled, a signed-in user who obtains another tenant's export job identifier may retrieve that export. Export files contain member display names, email addresses, and workspace labels. The advisory has not identified exposure of passwords or authentication tokens through this issue. Single-tenant deployments are not affected.\\n\\nUpdate to 3.1.8 or 3.2.3. If an update cannot be applied promptly, disable Scheduled Report Export and remove cached export files. Review access logs for cross-tenant export downloads. The fix enforces tenant ownership checks when an export is requested.\",\"applicability_conditions\":\"The deployment must be shared and multi-tenant, Scheduled Report Export must be enabled, and the requester must be signed in and obtain another tenant’s export job identifier. The vulnerable handler checks authentication but fails to verify that the export belongs to the requester’s tenant. Single-tenant deployments are outside the advisory’s affected scope.\"}","MOBIUSI INC","https:\u002F\u002Fstatic.mobiusi.com\u002Fmobiwusi\u002F20250829\u002F7bf4ac62b4533e2b809998a6f1c5491e.png?Expires=1792463130&OSSAccessKeyId=LTAI5tH8MQqhgeiAtrzCHrxM&Signature=v6Tr8jBrdm4s5wU1SnnyGsYg%2Bhw%3D&x-oss-process=image%2Fresize%2Cm_fill%2Cw_35%2Ch_35",[672,678],{"type":673,"title":674,"count_data":675},"bar","Length distribution",[676],{"name":677,"value":480},"1k lower",{"type":679,"title":680,"count_data":681},"pie","Language distribution",[682],{"name":683,"value":480},"English"]