Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-10691 State: PUBLISHED Published: 2018-06-04T16:00:00Z Last Updated: 2024-09-16T21:56:59.682Z Vendors: HackerOne Products: windows-seleniumjar node module Problem Types: CWE-311 Description: windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/2
the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/296
CVE ID: CVE-2016-10692 State: PUBLISHED Published: 2018-06-04T16:00:00 Last Updated: 2024-08-06T03:30:20.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: haxeshim haxe shim to deal with coexisting versions. haxeshim downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/300
CVE ID: CVE-2016-10693 State: PUBLISHED Published: 2018-06-04T16:00:00Z Last Updated: 2024-09-16T17:48:00.321Z Vendors: HackerOne Products: pm2-kafka node module Problem Types: CWE-311 Description: pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/299
CVE ID: CVE-2016-10694 State: PUBLISHED Published: 2018-06-04T16:00:00Z Last Updated: 2024-09-16T23:31:20.981Z Vendors: HackerOne Products: alto-saxophone node module Problem Types: CWE-311 Description: alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https:
ioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/172
CVE ID: CVE-2016-10695 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T22:02:16.686Z Vendors: HackerOne Products: npm-test-sqlite3-trunk node module Problem Types: CWE-311 Description: The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nod
in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/297
CVE ID: CVE-2016-10696 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-16T22:25:11.602Z Vendors: HackerOne Products: windows-latestchromedriver node module Problem Types: CWE-311 Description: windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodese
between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/295
CVE ID: CVE-2016-10697 State: PUBLISHED Published: 2018-06-04T19:00:00Z Last Updated: 2024-09-17T00:00:39.273Z Vendors: HackerOne Products: react-native-baidu-voice-synthesizer node module Problem Types: CWE-311 Description: react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: R
he network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/302
CVE ID: CVE-2016-10698 State: PUBLISHED Published: 2018-05-29T20:00:00Z Last Updated: 2024-09-17T03:02:38.654Z Vendors: HackerOne Products: mystem-fix node module Problem Types: CWE-311 Description: mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/301
CVE ID: CVE-2016-10699 State: PUBLISHED Published: 2017-10-31T07:00:00 Last Updated: 2024-08-06T03:30:20.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logins and passwords with script tags in them. Because there is no sanitization in the input fields, an unaware logged-in administrator may be a victim when checking the router logs. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101622 - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-018/?fid=8
ww.securityfocus.com/bid/101622 - https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-018/?fid=8411
CVE ID: CVE-2016-10700 State: PUBLISHED Published: 2017-11-24T05:00:00 Last Updated: 2024-08-06T03:30:20.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/commit/69983495cd41bf0903fe02baeef84b1fa85f2846 - http://www.cacti.net/release_notes_1_0_0.php - http://bugs.cacti.net/view.p
t/69983495cd41bf0903fe02baeef84b1fa85f2846 - http://www.cacti.net/release_notes_1_0_0.php - http://bugs.cacti.net/view.php?id=2697 - https://web.archive.org/web/20160817090458/http://bugs.cacti.net/view.php?id=2697
CVE ID: CVE-2016-10701 State: PUBLISHED Published: 2017-11-28T01:00:00 Last Updated: 2024-08-06T03:30:20.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application. Additional Analyst Notes: - CVE Program Container: References: - http://jira.pentaho.com/browse/BISERVER-3562 - http://jira.pentaho.com/browse/BISERVER-6599 - http://www.securityfocus.com/bid/102200 - http://jira.pentaho.com/browse/BISERVER-13207
CVE ID: CVE-2016-10702 State: PUBLISHED Published: 2017-11-28T07:00:00 Last Updated: 2024-08-06T03:30:20.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary application's JavaScript instance, by modifying a UUID value within the header of a crafted application binary. Additional Analyst Notes: - CVE Program Container: References: - https://blog.fletchto99.com/2016/november/pebble-app-sandbox-escape/
CVE ID: CVE-2016-10703 State: PUBLISHED Published: 2017-12-14T19:00:00 Last Updated: 2024-08-06T03:30:20.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string. Additional Analyst Notes: - CVE Program Container: References: - https://www.checkmarx.com/advisories/denial-of-service-dos-vulnerability-in-ecstatic-npm-package/ - https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01 - https://advisory.checkmarx.net/advisory
hub.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01 - https://advisory.checkmarx.net/advisory/CX-2016-4450
CVE ID: CVE-2016-10704 State: PUBLISHED Published: 2017-12-30T21:00:00Z Last Updated: 2024-09-16T18:50:24.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503. Additional Analyst Notes: - CVE Program Container: References: - https://magento.com/security/patches/magento-2010-and-212-security-update
CVE ID: CVE-2016-10705 State: PUBLISHED Published: 2018-01-12T19:00:00Z Last Updated: 2024-09-17T00:35:30.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2016/06/20/jetpack-4-0-4-bug-fixes/ - https://wpvulndb.com/vulnerabilities/8517
CVE ID: CVE-2016-10706 State: PUBLISHED Published: 2018-01-12T19:00:00Z Last Updated: 2024-09-17T03:43:37.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update/ - https://www.wordfence.com/blog/2016/05/jetpack-vulnerability/
CVE ID: CVE-2016-10707 State: PUBLISHED Published: 2018-01-18T23:00:00 Last Updated: 2024-08-06T03:30:20.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jquery/jquery/issues/3133 - https://snyk.io/vuln/npm:jquery:20160529 - https://github.com/jquery/jquery/pull/3134
CVE ID: CVE-2016-10708 State: PUBLISHED Published: 2018-01-21T22:00:00 Last Updated: 2024-08-06T03:30:20.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c. Additional Analyst Notes: - CVE Program Container: References: - https://www.openssh.com/releasenotes.html - https://security.netapp.com/advisory/ntap-20180423-0003/ - https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html - https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7
an.org/debian-lts-announce/2018/01/msg00031.html - https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737 - https://usn.ubuntu.com/3809-1/ - http://www.securityfocus.com/bid/102780 - https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html - http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html - https://kc.mcafee.com/corporate/index?page=content&id=SB10284 - https://support.f5.com/csp/article/K32485746?utm_source=f5support&amp%3Butm_medium=RSS - https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf
CVE ID: CVE-2016-10709 State: PUBLISHED Published: 2018-01-22T04:00:00 Last Updated: 2024-08-06T03:30:20.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_exec - https://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf - https://www.exploit-db.com/exploits/39709/ - https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.a
pdf - https://www.exploit-db.com/exploits/39709/ - https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc
CVE ID: CVE-2016-10710 State: PUBLISHED Published: 2018-01-25T23:00:00Z Last Updated: 2024-09-16T17:22:42.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authenticated users to overwrite or read files via crafted requests. Version 5.0.1050 contains the fix. Additional Analyst Notes: - CVE Program Container: References: - http://threat.tevora.com/biscom-secure-file-transfer-arbitrary-file-download/
CVE ID: CVE-2016-10711 State: PUBLISHED Published: 2018-01-29T20:00:00 Last Updated: 2024-08-06T03:30:20.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751. Additional Analyst Notes: - CVE Program Container: References: - http://www.apsis.ch/pound/pound_list/archive/2016/2016-10/1477235279000 - https://lists.debian.org/debian-lts-announce/2018/02/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/04/msg00028.html - https://lists.debian.org/debian-lts-announce/2020/05/msg00003.html
CVE ID: CVE-2016-10712 State: PUBLISHED Published: 2018-02-09T06:00:00 Last Updated: 2024-08-06T03:30:20.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during file uploads). For example, a "$uri = stream_get_meta_data(fopen($file, "r"))['uri']" call mishandles the case where $file is data:text/plain;uri=eviluri, -- in other words, metadata can be set by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3600-1/ - https://bugs.php.net/bug.php?id=71323 - https:
: - CVE Program Container: References: - https://usn.ubuntu.com/3600-1/ - https://bugs.php.net/bug.php?id=71323 - https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=6297a117d77fa3a0df2e21ca926a92c231819cd5 - https://usn.ubuntu.com/3566-2/
CVE ID: CVE-2016-10713 State: PUBLISHED Published: 2018-02-13T19:00:00 Last Updated: 2024-08-06T03:30:20.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3624-2/ - https://usn.ubuntu.com/3624-1/ - https://git.savannah.gnu.org/cgit/patch.git/commit/src/pch.c?id=a0d7fe4589651c64bd16ddaaa634030bb0455866 - http://www.securityfocus.com/bid/103063 - https://access.redhat.com/errata/RHSA-2019:2033
CVE ID: CVE-2016-10714 State: PUBLISHED Published: 2018-02-27T22:00:00 Last Updated: 2024-08-06T03:30:20.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3593-1/ - https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60
CVE ID: CVE-2016-10715 State: PUBLISHED Published: 2018-03-16T13:00:00Z Last Updated: 2024-09-16T22:26:38.718Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Artezio Kanban Board plugin 1.4 revision 1914 for Atlassian Jira has XSS via the Board Name in a Create New Board action, related to an artezioboard/mainPage.jspa?kanbanId=7#/kanban-view URI. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/137648/JIRA-Artezio-Board-1.4-Cross-Site-Scripting-Information-Disclosure.html
CVE ID: CVE-2016-10716 State: PUBLISHED Published: 2018-03-16T13:00:00Z Last Updated: 2024-09-17T02:21:35.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mail.ru Calendar plugin before 2.5.0.61 for Atlassian Jira has XSS via the Name field in a Create Calender action, related to a MailRuCalendar.jspa#period/month URI. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/plugins/ru.mail.jira.plugins.mailrucal/versions - https://packetstormsecurity.com/files/137649/JIRA-Mail.ru-Calendar-2.4.2.50_JIRA6-Cross-Site-Scripting.html
CVE ID: CVE-2016-10717 State: PUBLISHED Published: 2018-03-21T21:00:00 Last Updated: 2024-08-06T03:30:20.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP. Additional Analyst Notes: - CVE Progr
, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=LF5ic5nOoUY - http://www.securitytube.net/video/16690 - https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt - https://github.com/mspaling/mbam-exclusions-poc- - https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/
CVE ID: CVE-2016-10718 State: PUBLISHED Published: 2018-04-04T02:00:00 Last Updated: 2024-08-06T03:30:20.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44475/ - https://github.com/brave/browser-laptop/issues/5007 - https://hackerone.com/reports/176197 - https://github.com/brave/browser-laptop/issues/5006
CVE ID: CVE-2016-10719 State: PUBLISHED Published: 2019-05-15T13:11:13 Last Updated: 2024-08-06T03:30:20.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/138881/TP-Link-Archer-CR-700-Cross-Site-Scripting.html
CVE ID: CVE-2016-10721 State: PUBLISHED Published: 2018-05-02T23:00:00Z Last Updated: 2024-09-17T00:16:40.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: partclone.restore in Partclone 0.2.87 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to execute arbitrary code in the context of the user running the affected application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Thomas-Tsai/partclone/issues/82
CVE ID: CVE-2016-10722 State: PUBLISHED Published: 2018-05-02T23:00:00Z Last Updated: 2024-09-17T02:36:32.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: partclone.fat in Partclone before 0.2.88 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the FAT superblock, related to the mark_reserved_sectors function. An attacker may be able to execute arbitrary code in the context of the user running the affected application. Additional Analyst Notes: - CVE Program Container: References: - https://david.gnedt.at/blog/2016/11/14/advisory-partclone-fat-bitmap-heap-overflow/ - https://github.com/Thomas-Tsai/partclone/issues/71
CVE ID: CVE-2016-10723 State: PUBLISHED Published: 2018-06-21T13:00:00 Last Updated: 2024-08-06T03:30:20.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oom_lock mutex, a local unprivileged user can trivially lock up the system forever by wasting CPU resources from the page allocator (e.g., via concurrent page fault events) when the global OOM killer is invoked. NOTE: the software maintainer has not accepted certain proposed patches, in part because of a viewpoint that "the underlying problem is non-trivial to handle. Additional Analyst Notes:
atches, in part because of a viewpoint that "the underlying problem is non-trivial to handle. Additional Analyst Notes: - CVE Program Container: References: - https://patchwork.kernel.org/patch/9842889/ - https://www.spinics.net/lists/linux-mm/msg117896.html - https://patchwork.kernel.org/patch/10395909/
CVE ID: CVE-2016-10724 State: PUBLISHED Published: 2018-07-05T22:00:00 Last Updated: 2024-08-06T03:30:20.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker can sign a message with a certain private key that had been known by unintended actors, because of an infinitely sized map. This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins. Additional Analyst Notes: - CVE Program Container: References: - https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/01618
st Notes: - CVE Program Container: References: - https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016189.html - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://github.com/JinBean/CVE-Extension - https://bitcoin.org/en/posts/alert-key-and-vulnerabilities-disclosure