Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d by an attacker; users are unable to change these passwords. Additional Analyst Notes: - CVE Program Container: References: - https://enphase.com/en-us/products-and-services/envoy-and-combiner - https://stage2sec.com - https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a
CVE ID: CVE-2020-25753 State: PUBLISHED Published: 2021-06-16T18:26:58 Last Updated: 2024-08-04T15:40:36.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml. Additional Analyst Notes: - CVE Program Container: References: - https://enphase.com/en-us/products-and-services/envoy-and-combiner - https://stage2sec.com - https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a
CVE ID: CVE-2020-25754 State: PUBLISHED Published: 2021-06-16T18:27:22 Last Updated: 2024-08-04T15:40:36.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an unauthenticated user at /info.xml. Attempts to change the user password via passwd or other tools have no effect. Additional Analyst Notes: - CVE Program Container: References: - https://enphase.com/en-us/products-and-services/envoy-a
Additional Analyst Notes: - CVE Program Container: References: - https://enphase.com/en-us/products-and-services/envoy-and-combiner - https://stage2sec.com - https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a
CVE ID: CVE-2020-25755 State: PUBLISHED Published: 2021-06-16T18:27:47 Last Updated: 2024-08-04T15:40:36.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter. Additional Analyst Notes: - CVE Program Container: References: - https://enphase.com/en-us/products-and-services/envoy-and-combiner - https://stage2sec.com - https://medium.com/stage-2-security/can-solar-controllers-be-used-to-generate-fake-clean-energy-credits-4a7322e7661a
CVE ID: CVE-2020-25756 State: PUBLISHED Published: 2020-09-18T04:44:50 Last Updated: 2024-08-04T15:40:36.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cesanta/mongoose/issues/1135
CVE ID: CVE-2020-25757 State: PUBLISHED Published: 2020-12-15T19:27:32 Last Updated: 2024-08-04T15:40:36.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195 - https://www.digitaldefense.com/news
tps://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195 - https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/
CVE ID: CVE-2020-25758 State: PUBLISHED Published: 2020-12-15T19:27:55 Last Updated: 2024-08-04T15:40:36.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could allow a remote, authenticated attacker to inject arbitrary crontab entries into saved configurations before uploading. These entries are executed as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195 - https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-
us.dlink.com/announcement/publication.aspx?name=SAP10195 - https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/
CVE ID: CVE-2020-25759 State: PUBLISHED Published: 2020-12-15T19:28:06 Last Updated: 2024-08-04T15:40:36.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interface could allow an authenticated attacker to execute arbitrary commands, due to a lack of validation of inputs provided in multipart HTTP POST requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10195 - https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-r
s.dlink.com/announcement/publication.aspx?name=SAP10195 - https://www.digitaldefense.com/news/zero-day-vuln-d-link-vpn-routers/
CVE ID: CVE-2020-25760 State: PUBLISHED Published: 2020-09-29T19:00:10.000Z Last Updated: 2025-11-11T16:57:59.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input validation on the 'rid' parameter. An attacker can append SQL queries to the input to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2020/Sep/43 - http://packetstormsecurity.com/files/159262/Visitor-Management-System-In-PHP-1.0-SQL-Injection.html - https://packetstormsecurity.com/files/author/15149/ - http:/
2/Visitor-Management-System-In-PHP-1.0-SQL-Injection.html - https://packetstormsecurity.com/files/author/15149/ - http://packetstormsecurity.com/files/159637/Visitor-Management-System-In-PHP-1.0-SQL-Injection.html - https://www.exploit-db.com/exploits/48911
CVE ID: CVE-2020-25761 State: PUBLISHED Published: 2020-09-29T19:06:00.000Z Last Updated: 2025-11-11T16:54:20.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2020/Sep/45 - http://packetstormsecurity.com/files/159263/Visitor-Management-System-In-PHP-1.0-Cross-Site-Scripting.html - https://packetst
//packetstormsecurity.com/files/159263/Visitor-Management-System-In-PHP-1.0-Cross-Site-Scripting.html - https://packetstormsecurity.com/files/author/15149/ - https://www.exploit-db.com/exploits/48830
CVE ID: CVE-2020-25762 State: PUBLISHED Published: 2020-09-29T19:11:53 Last Updated: 2024-08-04T15:40:36.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract sensitive information etc. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/159261/Seat-Reservation-System-1.0-SQL-Injection.html - http://seclists.org/fulldisclosure/2020/Sep/42 - ht
ty.com/files/159261/Seat-Reservation-System-1.0-SQL-Injection.html - http://seclists.org/fulldisclosure/2020/Sep/42 - https://packetstormsecurity.com/files/author/15149
CVE ID: CVE-2020-25763 State: PUBLISHED Published: 2020-09-29T19:17:30 Last Updated: 2024-08-04T15:40:36.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading PHP files. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/159260/Seat-Reservation-System-1.0-Shell-Upload.html - http://seclists.org/fulldisclosure/2020/Sep/41 - https://packetstormsecurity.com/files/author/15149
CVE ID: CVE-2020-25765 State: PUBLISHED Published: 2020-10-27T20:00:54 Last Updated: 2024-08-04T15:40:36.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Addressed remote code execution vulnerability in reg_device.php due to insufficient validation of user input.in Western Digital My Cloud Devices prior to 5.4.1140. Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/productsecurity - https://www.westerndigital.com/support/productsecurity/wdc-20007-my-cloud-firmware-version-5-04-114 - https://www.comparitech.com/blog/information-security/security-vulnerabilities-80000-devices-update-now/
CVE ID: CVE-2020-25766 State: PUBLISHED Published: 2020-09-18T17:36:26 Last Updated: 2024-08-04T15:40:36.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/164963100a830234744a6004d5eda55d24e97b2a - https://github.com/MISP/MISP/compare/v2.4.131...v2.4.132
CVE ID: CVE-2020-25767 State: PUBLISHED Published: 2021-08-18T18:39:26 Last Updated: 2024-08-04T15:40:36.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HCC Embedded NicheStack IPv4 4.1. The dnc_copy_in routine for parsing DNS domain names does not check whether a domain name compression pointer is pointing within the bounds of the packet (e.g., forward compression pointer jumps are allowed), which leads to an Out-of-bounds Read, and a Denial-of-Service as a consequence. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://ww
: - https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/ - https://www.kb.cert.org/vuls/id/608209
CVE ID: CVE-2020-25768 State: PUBLISHED Published: 2020-10-07T20:37:52 Last Updated: 2024-08-04T15:40:36.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Additional Analyst Notes: - CVE Program Container: References: - https://community.contao.org/en/forumdisplay.php?4-Announcements - https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html
CVE ID: CVE-2020-25770 State: PUBLISHED Published: 2020-09-28T23:30:43 Last Updated: 2024-08-04T15:40:36.949Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: OOB Read Info Disclosure Description: An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771. Additional Ana
in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.zerodayinitiative.com/advisories/ZDI-20-1221/
CVE ID: CVE-2020-25771 State: PUBLISHED Published: 2020-09-28T23:30:43 Last Updated: 2024-08-04T15:40:36.947Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: OOB Read Info Disclosure Description: An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25770. Additional Ana
in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25770. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.zerodayinitiative.com/advisories/ZDI-20-1223/
CVE ID: CVE-2020-25772 State: PUBLISHED Published: 2020-09-28T23:30:44 Last Updated: 2024-08-04T15:40:36.981Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: OOB Read Info Disclosure Description: An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771. Additional Ana
in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.zerodayinitiative.com/advisories/ZDI-20-1222/
CVE ID: CVE-2020-25773 State: PUBLISHED Published: 2020-09-28T23:30:44 Last Updated: 2024-08-04T15:40:36.970Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Double Free RCE Description: A vulnerability in the Trend Micro Apex One ServerMigrationTool component could allow an attacker to execute arbitrary code on affected products. User interaction is required to exploit this vulnerability in that the target must import a corrupted configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.zerodayinitiative.com/advisories/ZDI-20-1224/
CVE ID: CVE-2020-25774 State: PUBLISHED Published: 2020-09-28T23:30:45 Last Updated: 2024-08-04T15:40:36.979Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: OOB Read Info Disclosure Description: A vulnerability in the Trend Micro Apex One ServerMigrationTool component could allow an attacker to trigger an out-of-bounds red information disclosure which would disclose sensitive information to an unprivileged account. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.
l Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000271974 - https://www.zerodayinitiative.com/advisories/ZDI-20-1225/
CVE ID: CVE-2020-25775 State: PUBLISHED Published: 2020-09-28T23:30:45 Last Updated: 2024-08-04T15:40:36.947Z Vendors: Trend Micro Products: Trend Micro Security (Consumer) Problem Types: Security Race Condition Arbitrary File Deletion Description: The Trend Micro Security 2020 (v16) consumer family of products is vulnerable to a security race condition arbitrary file deletion vulnerability that could allow an unprivileged user to manipulate the product's secure erase feature to delete files with a higher set of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-09909 - https://www.zerodayinitiative.com/advisories
References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-09909 - https://www.zerodayinitiative.com/advisories/ZDI-20-1227/
CVE ID: CVE-2020-25776 State: PUBLISHED Published: 2020-10-02T22:00:17 Last Updated: 2024-08-04T15:40:36.983Z Vendors: Trend Micro Products: Trend Micro Antivirus for Mac (Consumer) Problem Types: Symbolic Link Privilege Escalation Description: Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a symbolic link privilege escalation attack where an attacker could exploit a critical file on the system to escalate their privileges. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-0992
ditional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-09924 - https://www.zerodayinitiative.com/advisories/ZDI-20-1236/
CVE ID: CVE-2020-25777 State: PUBLISHED Published: 2020-10-14T15:10:22 Last Updated: 2024-08-04T15:40:36.936Z Vendors: Trend Micro Products: Trend Micro Antivirus for Mac (Consumer) Problem Types: Protection Bypass Description: Trend Micro Antivirus for Mac 2020 (Consumer) is vulnerable to a specific kernel extension request attack where an attacker could bypass the Web Threat Protection feature of the product. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-09947 - https://www.zerodayinitiati
rogram Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-09947 - https://www.zerodayinitiative.com/advisories/ZDI-20-1242/
CVE ID: CVE-2020-25778 State: PUBLISHED Published: 2020-10-14T15:10:23 Last Updated: 2024-08-04T15:40:36.913Z Vendors: Trend Micro Products: Trend Micro Antivirus for Mac (Consumer) Problem Types: Information Disclosure Description: Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in a specific kernel extension where an attacker could supply a kernel pointer and leak several bytes of memory. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-09948 - https://www.zerodayinitiati
rogram Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-09948 - https://www.zerodayinitiative.com/advisories/ZDI-20-1241/
CVE ID: CVE-2020-25779 State: PUBLISHED Published: 2020-10-13T15:45:15 Last Updated: 2024-08-04T15:40:36.956Z Vendors: Trend Micro Products: Trend Micro Antivirus for Mac (Consumer) Problem Types: Protection Bypass Description: Trend Micro Antivirus for Mac 2020 (Consumer) has a vulnerability in which a Internationalized Domain Name homograph attack (Puny-code) could be used to add a malicious website to the approved websites list of Trend Micro Antivirus for Mac to bypass the web threat protection feature. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-09949
CVE ID: CVE-2020-25780 State: PUBLISHED Published: 2020-10-29T16:08:29 Last Updated: 2024-08-04T15:40:36.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can instead view a file outside of the log-files folder. Additional Analyst Notes: - CVE Program Container: References: - http://kb.commvault.com/article/63264
CVE ID: CVE-2020-25781 State: PUBLISHED Published: 2020-09-30T20:31:13 Last Updated: 2024-08-04T15:40:36.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly. Additional Analyst Notes: - CVE Program Container: References: - https://mantisbt.org/bugs/view.php?id=27039 - http://github.com/mantisbt/mantisbt/commit/5595c90f11c48164331a20bb9c66098980516e93 - http://github.com/mantisbt/mantisbt/commit/9de20c09e5a557e57159a61657ce62f
it/5595c90f11c48164331a20bb9c66098980516e93 - http://github.com/mantisbt/mantisbt/commit/9de20c09e5a557e57159a61657ce62f1a4f578fe
CVE ID: CVE-2020-25782 State: PUBLISHED Published: 2021-01-28T02:05:09 Last Updated: 2024-08-04T15:40:36.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accfly Wireless Security IR Camera 720P System with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CNetClientManage::ServerIP_Proto_Set during incoming message handling. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tezeb/accfly/blob/master/Readme.md
CVE ID: CVE-2020-25783 State: PUBLISHED Published: 2021-01-28T02:05:15 Last Updated: 2024-08-04T15:40:36.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated heap-based buffer overflow in the function CNetClientTalk::OprMsg during incoming message handling. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tezeb/accfly/blob/master/Readme.md
CVE ID: CVE-2020-25784 State: PUBLISHED Published: 2021-01-28T02:05:20 Last Updated: 2024-08-04T15:40:36.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CNetClientGuard::SubOprMsg during incoming message handling. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tezeb/accfly/blob/master/Readme.md
CVE ID: CVE-2020-25785 State: PUBLISHED Published: 2021-01-28T02:05:26 Last Updated: 2024-08-04T15:40:36.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. There is an unauthenticated stack-based buffer overflow in the function CFtpProtocol::FtpLogin during the update procedure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tezeb/accfly/blob/master/Readme.md
CVE ID: CVE-2020-25786 State: PUBLISHED Published: 2020-09-19T19:24:09 Last Updated: 2024-08-04T15:40:36.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: this is typically not exploitable because of URL encoding (except in Internet Explorer) and because a web page cannot specify that a client should make an additional HTTP request with an arbitrary Referer header Additional Analyst Notes: - CVE Program Container: References: - https://supportannouncement.us.d