Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15567 State: PUBLISHED Published: 2020-07-07T12:26:26 Last Updated: 2024-08-04T13:22:29.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileg
to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in this case Intel EPT) are vulnerable. Only HVM and PVH guests can exploit the vulnerability. The presence and scope of the vulnerability depends on the precise optimisations performed by the compiler used to build Xen. If the compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write op
compiler used to build Xen. If the compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write operations in the same order as the source code, the hypervisor is not vulnerable. For example, in one test build using GCC 8.3 with normal settings, the compiler generated multiple (unlocked) read-modify-write operations in source-code order, which did not constitute a vulnerability. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code-generation options). The source code clearly violates the C rules, and thus should be considered vulnerable. Additional Analyst Notes: - CVE Program Container: R
rly violates the C rules, and thus should be considered vulnerable. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-328.html - http://www.openwall.com/lists/oss-security/2020/07/07/6 - https://www.debian.org/security/2020/dsa-4723 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00024.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB3QJJZV23Z2IDYEMIHELWYSQBUEW6JP/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00031.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXESCOVI7AVRNC7HEAMFM7PMEO6D3A
/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXESCOVI7AVRNC7HEAMFM7PMEO6D3AUH/ - https://security.gentoo.org/glsa/202007-02
CVE ID: CVE-2020-15568 State: PUBLISHED Published: 2021-01-30T04:59:40 Last Updated: 2024-08-04T13:22:29.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter. Additional Analyst Notes: - CVE Program Container: References: - https://help.terra-master.com/TOS/view/ - https://ssd-disclosure.com/ssd-advisory-terramaster-os-exportuser-php-remote-code-execution/
CVE ID: CVE-2020-15569 State: PUBLISHED Published: 2020-07-06T13:48:48 Last Updated: 2024-08-04T13:22:29.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/milkytracker/MilkyTracker/commit/7afd55c42ad80d01a339197a2d8b5461d214edaf - https://lists.debian.org/debian-lts-announce/2020/07/msg00023.html
CVE ID: CVE-2020-15570 State: PUBLISHED Published: 2020-07-06T13:59:15 Last Updated: 2024-08-04T13:22:29.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of service via a malformed crash file. Additional Analyst Notes: - CVE Program Container: References: - https://www.youtube.com/watch?v=oZXGwC7PWYE - https://github.com/sungjungk/whoopsie_killer2/blob/master/whoopsie_killer2.py - https://github.com/sungjungk/whoopsie_killer2/blob/master/README.md - https://launchpad.net/ubuntu/+source/whoopsie - https://usn.ubuntu.com/4450-1/
CVE ID: CVE-2020-15572 State: PUBLISHED Published: 2020-07-15T16:02:10 Last Updated: 2024-08-04T13:22:29.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.torproject.org/tpo/core/tor/-/issues/33119 - https://trac.torproject.org/projects/tor/wiki/TROVE - https://blog.torproject.org/new-release-tor-03511-0428-0436-security-fixes
CVE ID: CVE-2020-15573 State: PUBLISHED Published: 2020-07-07T13:15:28 Last Updated: 2024-08-04T13:22:29.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE ID: CVE-2020-15574 State: PUBLISHED Published: 2020-07-07T13:14:50 Last Updated: 2024-08-04T13:22:29.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE ID: CVE-2020-15575 State: PUBLISHED Published: 2020-07-07T13:14:03 Last Updated: 2024-08-04T13:22:30.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE ID: CVE-2020-15576 State: PUBLISHED Published: 2020-07-07T13:13:01 Last Updated: 2024-08-04T13:22:30.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE ID: CVE-2020-15577 State: PUBLISHED Published: 2020-07-07T13:33:18 Last Updated: 2024-08-04T13:22:29.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Cameralyzer allows attackers to write files to the SD card. The Samsung ID is SVE-2020-16830 (July 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-15578 State: PUBLISHED Published: 2020-07-07T13:32:38 Last Updated: 2024-08-04T13:22:29.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x) software. FactoryCamera does not properly restrict runtime permissions. The Samsung ID is SVE-2020-17270 (July 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-15579 State: PUBLISHED Published: 2020-07-07T13:31:45 Last Updated: 2024-08-04T13:22:30.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via the KNOX API. The Samsung ID is SVE-2020-17318 (July 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-15580 State: PUBLISHED Published: 2020-07-07T13:24:52 Last Updated: 2024-08-04T13:22:29.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) by enrolling a new lock password. The Samsung ID is SVE-2020-17328 (July 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-15581 State: PUBLISHED Published: 2020-07-07T13:23:55 Last Updated: 2024-08-04T13:22:30.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The kernel logging feature allows attackers to discover virtual addresses via vectors involving shared memory. The Samsung ID is SVE-2020-17605 (July 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-15582 State: PUBLISHED Published: 2020-07-07T13:23:03 Last Updated: 2024-08-04T13:22:30.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 7885 chipsets) software. The Bluetooth Low Energy (BLE) component has a buffer overflow with a resultant deadlock or crash. The Samsung ID is SVE-2020-16870 (July 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-15583 State: PUBLISHED Published: 2020-07-07T13:22:10 Last Updated: 2024-08-04T13:22:29.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. StickerProvider allows directory traversal for access to system files. The Samsung ID is SVE-2020-17665 (July 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-15584 State: PUBLISHED Published: 2020-07-07T13:20:52 Last Updated: 2024-08-04T13:22:29.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can trigger an out-of-bounds access and device reset via a 4K wallpaper image because ImageProcessHelper mishandles boundary checks. The Samsung ID is SVE-2020-18056 (July 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-15586 State: PUBLISHED Published: 2020-07-17T15:38:24 Last Updated: 2024-08-04T13:22:29.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCR6
07/msg00082.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCR6LAKCVKL55KJQPPBBWVQGOP7RL2RW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WIRVUHD7TJIT7JJ33FKHIVTHPYABYPHR/ - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html - https://www.debian.org/security/2021/dsa-4848 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://groups.goo
ps://www.debian.org/security/2021/dsa-4848 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w - https://security.netapp.com/advisory/ntap-20200731-0005/ - https://groups.google.com/forum/#%21topic/golang-announce/f2c5bqrGH_g - https://www.cloudfoundry.org/blog/cve-2020-15586/
CVE ID: CVE-2020-15588 State: PUBLISHED Published: 2020-07-29T17:35:50 Last Updated: 2024-08-04T13:22:30.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. This issue will occur only when untrusted communication is initiated with server. In cloud, Agent will always connect with trusted communication. Additional Analyst Notes: - CVE Program Container: References: - https://www.man
ays connect with trusted communication. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/integer-overflow-vulnerability.html
CVE ID: CVE-2020-15589 State: PUBLISHED Published: 2020-10-02T19:13:23 Last Updated: 2024-08-04T13:22:30.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/produ
mote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/ - https://www.manageengine.com/products/desktop-central/untrusted-agent-server-communication.html
CVE ID: CVE-2020-15590 State: PUBLISHED Published: 2020-09-14T21:11:35 Last Updated: 2024-08-04T13:22:29.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Private Internet Access (PIA) VPN Client for Linux 1.5 through 2.3+ allows remote attackers to bypass an intended VPN kill switch mechanism and read sensitive information via intercepting network traffic. Since 1.5, PIA has supported a “split tunnel” OpenVPN bypass option. The PIA killswitch & associated iptables firewall is designed to protect you while using the Internet. When the kill switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending
ll switch is configured to block all inbound and outbound network traffic, privileged applications can continue sending & receiving network traffic if net.ipv4.ip_forward has been enabled in the system kernel parameters. For example, a Docker container running on a host with the VPN turned off, and the kill switch turned on, can continue using the internet, leaking the host IP (CWE 200). In PIA 2.4.0+, policy-based routing is enabled by default and is used to direct all forwarded packets to the VPN interface automatically. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sickcodes - https://sick.codes/cve-2020-15590/ - https://github.com/sickcodes/security/
References: - https://github.com/sickcodes - https://sick.codes/cve-2020-15590/ - https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-001.md
CVE ID: CVE-2020-15591 State: PUBLISHED Published: 2022-03-17T15:39:22 Last Updated: 2024-08-04T13:22:29.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution). Additional Analyst Notes: - CVE Program Container: References: - https://fex.rus.uni-stuttgart.de - https://secfault-security.com/advisories/cve2020-15591.html - https://cwe.mitre.org/data/definitions/95.html
CVE ID: CVE-2020-15592 State: PUBLISHED Published: 2020-07-27T13:33:46 Last Updated: 2024-08-04T13:22:30.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. It uses an executable running as a high privileged Windows service to perform administrative tasks and collect data from other processes. It distributes functionality among different processes and uses IPC (Inter-Process Communication) primitives to enable the processes to cooperate. The remotely callable methods from remotable objects available through interprocess communication allow loading of arbitrary plugins (i.e., C
methods from remotable objects available through interprocess communication allow loading of arbitrary plugins (i.e., C# assemblies) from the "%PROGRAMFILES(X86)%/Aternity Information Systems/Assistant/plugins” directory, where the name of the plugin is passed as part of an XML-serialized object. However, because the name of the DLL is concatenated with the “.\plugins” string, a directory traversal vulnerability exists in the way plugins are resolved. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/article/Recorder-tool-security-notification-mitigation-steps-for-On-Prem - https://sec-consult.com/en/blog/advisories/privilege-escal
der-tool-security-notification-mitigation-steps-for-On-Prem - https://sec-consult.com/en/blog/advisories/privilege-escalation-vulnerability-in-steelcentral-aternity-agent-cve-2020-15592-cve-2020-15593/
CVE ID: CVE-2020-15593 State: PUBLISHED Published: 2020-07-27T13:36:02 Last Updated: 2024-08-04T13:22:30.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: SteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. It uses an executable running as a high privileged Windows service to perform administrative tasks and collect data from other processes. It distributes functionality among different processes and uses IPC (Inter-Process Communication) primitives to enable the processes to cooperate. Any user in the system is allowed to access the interprocess communication channel AternityAgentAssistantIpc, retrieve a serialized object and call object methods remotely. Among o
communication channel AternityAgentAssistantIpc, retrieve a serialized object and call object methods remotely. Among others, the methods allow any user to: (1) Create and/or overwrite arbitrary XML files across the system; (2) Create arbitrary directories across the system; and (3) Load arbitrary plugins (i.e., C# assemblies) from the "%PROGRAMFILES(X86)/Aternity Information Systems/Assistant/plugins” directory and execute code contained in them. Additional Analyst Notes: - CVE Program Container: References: - https://aternity.force.com/customersuccess/s/article/Recorder-tool-security-notification-mitigation-steps-for-On-Prem - https://sec-consult.com/en/blog/advisories/privilege-escalatio
tool-security-notification-mitigation-steps-for-On-Prem - https://sec-consult.com/en/blog/advisories/privilege-escalation-vulnerability-in-steelcentral-aternity-agent-cve-2020-15592-cve-2020-15593/
CVE ID: CVE-2020-15594 State: PUBLISHED Published: 2020-09-29T13:16:05.000Z Last Updated: 2025-05-30T16:01:28.654Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to perform a scan in order to discover open ports on a machine as well as available machines on the network segment on which the instance of the product is deployed. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2020-15594/ - https://cd
es: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/cve-2020-15594/ - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-15594
CVE ID: CVE-2020-15595 State: PUBLISHED Published: 2020-09-29T12:56:55.000Z Last Updated: 2025-05-30T16:01:24.120Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access. Additional Analyst Notes: - CVE Progra
n about the cartography of the internal networks to which the product has access. Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2020-15595 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-15595
CVE ID: CVE-2020-15596 State: PUBLISHED Published: 2020-08-12T21:35:44 Last Updated: 2024-08-04T13:22:30.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/document/c06706305 - https://seclists.org/fulldisclosure/2020/Jul/30
CVE ID: CVE-2020-15597 State: PUBLISHED Published: 2020-08-11T15:49:46 Last Updated: 2024-08-04T13:22:30.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field. Additional Analyst Notes: - CVE Program Container: References: - https://www.soplanning.org - https://www.sevenlayers.com/index.php/364-soplanning-v1-46-01-xss-session-hijack
CVE ID: CVE-2020-15598 State: PUBLISHED Published: 2020-10-06T13:38:50 Last Updated: 2024-08-04T13:22:30.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in
ration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit Additional Analyst Notes: - CVE Program Container: References: - https://www.modsecurity.org - http://packetstormsecurity.com/files/159185/ModSecurity-3.0.x-Denial-Of-Service.html - http://seclists.org/fulldisclosure/2020/Sep/32 - h