Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-51993 State: PUBLISHED Published: 2024-11-07T17:59:18.617Z Last Updated: 2024-11-07T18:32:36.129Z Severity: LOW (CVSS 3.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-312 Description: Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misconfigured Users. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. Users unable to upgrade are advised to encrypt their backups independently of the iTop application. ### Patches Sanitize parameter ### References N°7631 - Password is stored in clear in the database. Addit
p application. ### Patches Sanitize parameter ### References N°7631 - Password is stored in clear in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-9mq5-349x-x427
CVE ID: CVE-2024-51994 State: PUBLISHED Published: 2024-11-07T17:57:54.681Z Last Updated: 2024-11-07T18:35:18.937Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal will trigger an Cross-site Scripting (XSS) vulnerability. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/ad
nerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-jjph-c25g-5c7g
CVE ID: CVE-2024-51995 State: PUBLISHED Published: 2024-11-07T17:55:15.598Z Last Updated: 2024-11-07T18:16:51.358Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-284 Description: Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php` to the `ajax.render.php` page which does not allow arbitrary `routes` to be dispatched. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additiona
es` to be dispatched. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-3mxr-8r3j-j2j9
CVE ID: CVE-2024-51996 State: PUBLISHED Published: 2024-11-13T16:18:49.473Z Last Updated: 2024-11-13T18:49:31.776Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: symfony Products: symfony Problem Types: CWE-287, CWE-289 Description: Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.c
is fixed in 5.4.47, 6.4.15, and 7.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/symfony/symfony/security/advisories/GHSA-cg23-qf8f-62rr - https://github.com/symfony/symfony/commit/81354d392c5f0b7a52bcbd729d6f82501e94135a
CVE ID: CVE-2024-51997 State: PUBLISHED Published: 2024-11-08T18:40:31.701Z Last Updated: 2024-11-12T17:17:50.487Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: confidential-containers Products: trustee Problem Types: CWE-287 Description: Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Token**) token, generated by AS, could be manipulated by MITM attacker, but the verifier (CoCo Verification Demander like KBS) could still verify it successfully. In the payload of ART token, the ‘jwk’ could be replaced by attacker with his own pub key. Then attacker can use his own corres
payload of ART token, the ‘jwk’ could be replaced by attacker with his own pub key. Then attacker can use his own corresponding private key to sign the crafted ART token. Based on current code implementation (v0.8.0), such replacement and modification can not be detected. This issue has been addressed in version 0.8.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/confidential-containers/trustee/security/advisories/GHSA-7jc6-j236-vvjw
CVE ID: CVE-2024-51998 State: PUBLISHED Published: 2024-11-07T23:34:07.183Z Last Updated: 2024-11-08T15:24:19.464Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: dgtlmoon Products: changedetection.io Problem Types: CWE-22 Description: changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and `ALLOW_FILE_URI` false or not defined. The check used for URL protocol, `is_safe_url`, allows `file:` as a URL scheme. It later checks if local files are permitted, but one
for URL protocol, `is_safe_url`, allows `file:` as a URL scheme. It later checks if local files are permitted, but one of the preconditions for the check is that the URL starts with `file://`. The issue comes with the fact that the file URI scheme is not required to have double slashes. This issue has been addressed in version 0.47.06 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-6jrf-rcjf-245r - https://github.com/dgtlmoon/changedetection.io/commit/49bc982c697169c98b79698889fb9d26f6b3317f - https://github.com
5r - https://github.com/dgtlmoon/changedetection.io/commit/49bc982c697169c98b79698889fb9d26f6b3317f - https://github.com/dgtlmoon/changedetection.io/blob/e0abf0b50507a8a3d0c1d8522ab23519b3e4cdf4/changedetectionio/model/Watch.py#L11-L13
CVE ID: CVE-2024-52000 State: PUBLISHED Published: 2024-11-08T22:20:02.422Z Last Updated: 2024-11-12T15:59:23.446Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-79 Description: Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editing a request's payload which can lead to malicious javascript execution. This issue has been addressed in version 3.2.0 via systematic escaping of error messages when rendering on the page. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additiona
endering on the page. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-r58g-p5r9-8hfg
CVE ID: CVE-2024-52001 State: PUBLISHED Published: 2024-11-08T22:18:17.828Z Last Updated: 2024-11-12T15:22:35.988Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-200 Description: Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue has been addressed in version 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-9p26-v3wj-6q34
CVE ID: CVE-2024-52002 State: PUBLISHED Published: 2024-11-08T22:16:35.543Z Last Updated: 2024-11-12T15:23:26.819Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Combodo Products: iTop Problem Types: CWE-352 Description: Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/se
this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-xr4x-xq7v-7gqm
CVE ID: CVE-2024-52003 State: PUBLISHED Published: 2024-11-29T18:15:34.123Z Last Updated: 2024-12-02T11:19:36.740Z Vendors: traefik Products: traefik Problem Types: CWE-601 Description: Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/traefik/traefik/security/advisories/GHSA-h924-8g65-j9wg - https://github.com/traefik/
: References: - https://github.com/traefik/traefik/security/advisories/GHSA-h924-8g65-j9wg - https://github.com/traefik/traefik/pull/11253 - https://github.com/traefik/traefik/releases/tag/v2.11.14 - https://github.com/traefik/traefik/releases/tag/v3.2.1
CVE ID: CVE-2024-52004 State: PUBLISHED Published: 2024-11-08T22:10:07.361Z Last Updated: 2024-11-12T19:56:53.955Z Vendors: mediacms-io Products: mediacms Problem Types: CWE-74 Description: MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon special cases can lead to remote code execution. All versions before v4.1.0 are susceptible, and users are highly recommended to upgrade. The vulnerabilities are related with insufficient input validation while uploading media content. The condition to exploit the vulnerability is that the portal allows users to upload content. This issue has been p
ent. The condition to exploit the vulnerability is that the portal allows users to upload content. This issue has been patched in version 4.1.0. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mediacms-io/mediacms/security/advisories/GHSA-x3p4-4442-q2c3 - https://github.com/mediacms-io/mediacms/blob/main/docs/admins_docs.md
CVE ID: CVE-2024-52005 State: PUBLISHED Published: 2025-01-15T17:35:02.379Z Last Updated: 2025-01-15T20:10:36.473Z Vendors: git Products: git Problem Types: CWE-116, CWE-150 Description: Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that ca
stands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329 - https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net
CVE ID: CVE-2024-52006 State: PUBLISHED Published: 2025-01-14T18:39:52.748Z Last Updated: 2025-11-03T20:45:24.231Z Vendors: git Products: git Problem Types: CWE-116, CWE-147, CWE-150 Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in thi
which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp - https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g - https://github.com
p - https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g - https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q - https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060
CVE ID: CVE-2024-52007 State: PUBLISHED Published: 2024-11-08T22:28:20.169Z Last Updated: 2024-11-12T18:47:14.559Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: hapifhir Products: org.hl7.fhir.core Problem Types: CWE-611 Description: HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within
roduce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This is related to GHSA-6cr6-ph3p-f5rf, in which its fix (#1571 & #1717) was incomplete. This issue has been addressed in release version 6.4.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gr3c-q7xf-47vh - https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf - https://github.com/hapifhir/org.hl7.fhir.core/issues/157
hir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf - https://github.com/hapifhir/org.hl7.fhir.core/issues/1571 - https://github.com/hapifhir/org.hl7.fhir.core/pull/1717 - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j - https://cwe.mitre.org/data/definitions/611.html
CVE ID: CVE-2024-52008 State: PUBLISHED Published: 2024-11-26T18:52:40.102Z Last Updated: 2024-11-26T19:16:54.451Z Vendors: ethyca Products: fides Problem Types: CWE-602 Description: Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the creation of accounts with passwords as short as a single character. When an email messaging provider is enabled and a new user account is created in the system, an invite emai
e character. When an email messaging provider is enabled and a new user account is created in the system, an invite email containing a special link is sent to the new user's email address. This link directs the new user to a page where they can set their initial password. While the user interface implements password complexity checks, these validations are only performed client-side. The underlying `/api/v1/user/accept-invite` API endpoint does not implement the same password policy validations. This vulnerability allows an invited user to set an extremely weak password for their own account during the initial account setup process. Therefore that specific user's account can be compromised e
their own account during the initial account setup process. Therefore that specific user's account can be compromised easily by an attacker guessing or brute forcing the password. The vulnerability has been patched in Fides version `2.50.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-v7vm-rhmg-8j2r
CVE ID: CVE-2024-52009 State: PUBLISHED Published: 2024-11-08T22:24:15.300Z Last Updated: 2024-11-12T19:19:58.293Z Vendors: runatlantis Products: atlantis Problem Types: CWE-532 Description: Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in A
administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/runatlantis/atlantis/security/advisories/GHSA-gppm-hq3p-h4rp - https://github.com/runatlantis/atlantis/issues/4060 - https://github.com/runatlantis/atlantis/pull/4667 - https://argo-cd.readthedocs.io/en/stable/operator-manual/security - https://github.com/runatlantis/atlantis/releases/tag/v0.30.0
CVE ID: CVE-2024-52010 State: PUBLISHED Published: 2024-11-12T16:06:31.719Z Last Updated: 2024-11-21T16:20:35.981Z Vendors: tobychui Products: zoraxy Problem Types: CWE-78 Description: Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH servers from their browsers. In HandleCreateProxySession the request to create an SSH session is handled. An attacker can exploit the username variable to escape from the bash command and inject arbitrary commands into
andled. An attacker can exploit the username variable to escape from the bash command and inject arbitrary commands into sshCommand. This is possible, because, unlike hostname and port, the username is not validated or sanitized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tobychui/zoraxy/security/advisories/GHSA-7hpf-g48v-hw3j - https://github.com/tobychui/zoraxy/commit/2e9bc77a5d832bff1093058d42ce7a61382e4bc6 - https://github.com/tobychui/zoraxy/commit/c07d5f85dfc37bd32819358ed7d4bc32c604e8f0
CVE ID: CVE-2024-52012 State: PUBLISHED Published: 2025-01-27T08:54:42.907Z Last Updated: 2025-02-06T16:11:37.353Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: CWE-23 Description: Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem. This issue affects Apache Solr: from 6.6 through 9.7.0. Users are recommended to upgrade to version 9.8.0, which fixes the issue. Users unab
pache Solr: from 6.6 through 9.7.0. Users are recommended to upgrade to version 9.8.0, which fixes the issue. Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd
CVE ID: CVE-2024-52013 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:51:13.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at wiz_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md
CVE ID: CVE-2024-52014 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:50:46.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at genie_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md
CVE ID: CVE-2024-52015 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T15:47:13.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at bsw_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md
CVE ID: CVE-2024-52016 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T16:13:58.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component wlg_adv.cgi via the apmode_dns1_pri and apmode_dns1_sec parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_49/49.md