Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-27192 State: PUBLISHED Published: 2022-03-23T21:22:38 Last Updated: 2024-08-03T05:25:31.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files. Additional Analyst Notes: - CVE Program Container: References: - https://lt.asseco.com/sprendimai/dokumentu-valdymas/dvs-avilys/ - https://github.com/transcendent-group/advisories/blob/main/CVE-2022-27192.md
CVE ID: CVE-2022-27193 State: PUBLISHED Published: 2022-03-15T04:15:26 Last Updated: 2024-08-03T05:25:31.128Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AC:L/AV:L/A:L/C:H/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2
CVE ID: CVE-2022-27194 State: PUBLISHED Published: 2022-04-12T09:07:59 Last Updated: 2024-08-03T05:25:31.062Z Vendors: Siemens Products: SIMATIC PCS neo (Administration Console), SINETPLAN, TIA Portal Problem Types: CWE-400 Description: A vulnerability has been identified in SIMATIC PCS neo (Administration Console) (All versions < V3.1 SP1), SINETPLAN (All versions), TIA Portal (V15, V15.1, V16 and V17). The affected system cannot properly process specially crafted packets sent to port 8888/tcp. A remote attacker could exploit this vulnerability to cause a Denial-of-Service condition. The affected devices must be restarted manually. Additional Analyst Notes: - CVE Program Container: Referenc
condition. The affected devices must be restarted manually. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-711829.pdf
CVE ID: CVE-2022-27195 State: PUBLISHED Published: 2022-03-15T16:45:37 Last Updated: 2024-08-03T05:25:31.103Z Vendors: Jenkins project Products: Jenkins Parameterized Trigger Plugin Description: Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2185 - http://www.openwall.com/lists/oss-se
References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2185 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27196 State: PUBLISHED Published: 2022-03-15T16:45:38 Last Updated: 2024-08-03T05:25:31.127Z Vendors: Jenkins project Products: Jenkins Favorite Plugin Description: Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2557 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27197 State: PUBLISHED Published: 2022-03-15T16:45:40 Last Updated: 2024-08-03T05:25:32.462Z Vendors: Jenkins project Products: Jenkins Dashboard View Plugin Description: Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2559 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27198 State: PUBLISHED Published: 2022-03-15T16:45:41 Last Updated: 2024-08-03T05:25:32.083Z Vendors: Jenkins project Products: Jenkins CloudBees AWS Credentials Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2351 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27199 State: PUBLISHED Published: 2022-03-15T16:45:43 Last Updated: 2024-08-03T05:25:31.111Z Vendors: Jenkins project Products: Jenkins CloudBees AWS Credentials Plugin Description: A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2351 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27200 State: PUBLISHED Published: 2022-03-15T16:45:45 Last Updated: 2024-08-03T05:25:32.336Z Vendors: Jenkins project Products: Jenkins Folder-based Authorization Strategy Plugin Description: Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2646 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27201 State: PUBLISHED Published: 2022-03-15T16:45:46 Last Updated: 2024-08-03T05:25:32.222Z Vendors: Jenkins project Products: Jenkins Semantic Versioning Plugin Description: Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03
rgery. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2124 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27202 State: PUBLISHED Published: 2022-03-15T16:45:48 Last Updated: 2024-08-03T05:25:32.222Z Vendors: Jenkins project Products: Jenkins Extended Choice Parameter Plugin Description: Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2232 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27203 State: PUBLISHED Published: 2022-03-15T16:45:49 Last Updated: 2024-08-03T05:25:32.336Z Vendors: Jenkins project Products: Jenkins Extended Choice Parameter Plugin Description: Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1351 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27204 State: PUBLISHED Published: 2022-03-15T16:45:50 Last Updated: 2024-08-03T05:25:32.320Z Vendors: Jenkins project Products: Jenkins Extended Choice Parameter Plugin Description: A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacker-specified URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1350 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27205 State: PUBLISHED Published: 2022-03-15T16:45:52 Last Updated: 2024-08-03T05:25:31.110Z Vendors: Jenkins project Products: Jenkins Extended Choice Parameter Plugin Description: A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1350 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27206 State: PUBLISHED Published: 2022-03-15T16:45:53 Last Updated: 2024-08-03T05:25:32.328Z Vendors: Jenkins project Products: Jenkins GitLab Authentication Plugin Description: Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1891 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27207 State: PUBLISHED Published: 2022-03-15T16:45:55 Last Updated: 2024-08-03T05:25:32.491Z Vendors: Jenkins project Products: Jenkins global-build-stats Plugin Description: Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1886 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27208 State: PUBLISHED Published: 2022-03-15T16:45:56 Last Updated: 2024-08-03T05:25:32.460Z Vendors: Jenkins project Products: Jenkins Kubernetes Continuous Deploy Plugin Description: Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2096 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27209 State: PUBLISHED Published: 2022-03-15T16:45:58 Last Updated: 2024-08-03T05:25:31.115Z Vendors: Jenkins project Products: Jenkins Kubernetes Continuous Deploy Plugin Description: A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2636 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27210 State: PUBLISHED Published: 2022-03-15T16:45:59 Last Updated: 2024-08-03T05:25:32.252Z Vendors: Jenkins project Products: Jenkins Kubernetes Continuous Deploy Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2681 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27211 State: PUBLISHED Published: 2022-03-15T16:46:01 Last Updated: 2024-10-15T17:13:37.197Z Vendors: Jenkins project Products: Jenkins Kubernetes Continuous Deploy Plugin Description: A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2681 - http://www.openwall.com/lists/oss-secur
ferences: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2681 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27212 State: PUBLISHED Published: 2022-03-15T16:46:03 Last Updated: 2024-08-03T05:25:32.367Z Vendors: Jenkins project Products: Jenkins List Git Branches Parameter Plugin Description: Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2167 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27213 State: PUBLISHED Published: 2022-03-15T16:46:04 Last Updated: 2024-08-03T05:25:32.559Z Vendors: Jenkins project Products: Jenkins Environment Dashboard Plugin Description: Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2252 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27214 State: PUBLISHED Published: 2022-03-15T16:46:06 Last Updated: 2024-11-19T19:34:35.761Z Vendors: Jenkins project Products: Jenkins Release Helper Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2274 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27215 State: PUBLISHED Published: 2022-03-15T16:46:07 Last Updated: 2024-08-03T05:25:32.279Z Vendors: Jenkins project Products: Jenkins Release Helper Plugin Description: A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2274 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27216 State: PUBLISHED Published: 2022-03-15T16:46:08 Last Updated: 2024-08-03T05:25:32.295Z Vendors: Jenkins project Products: Jenkins dbCharts Plugin Description: Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2159 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27217 State: PUBLISHED Published: 2022-03-15T16:46:10 Last Updated: 2024-08-03T05:25:32.347Z Vendors: Jenkins project Products: Jenkins Vmware vRealize CodeStream Plugin Description: Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2238 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27218 State: PUBLISHED Published: 2022-03-15T16:46:12 Last Updated: 2024-08-03T05:25:32.671Z Vendors: Jenkins project Products: Jenkins incapptic connect uploader Plugin Description: Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2273 - http://www.openwall.com/lists/oss-security/2022/03/15/2
CVE ID: CVE-2022-27219 State: PUBLISHED Published: 2022-06-14T09:21:40 Last Updated: 2024-08-03T05:25:32.313Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-358 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf
CVE ID: CVE-2022-27220 State: PUBLISHED Published: 2022-06-14T09:21:41 Last Updated: 2024-08-03T05:25:32.200Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-358 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf
CVE ID: CVE-2022-27221 State: PUBLISHED Published: 2022-06-14T09:21:43.000Z Last Updated: 2025-04-21T13:53:16.606Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-203 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack. Additional Analyst Notes: - CVE Program Container: - C
n unknown string in an HTTP response body, aka a "BREACH" attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf - https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE ID: CVE-2022-27223 State: PUBLISHED Published: 2022-03-15T23:51:07 Last Updated: 2024-08-03T05:25:32.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/7f14c7227f342d9932f9b918893c8814f86d2a0d - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.12 - https://security.netapp.com/advisory/ntap-20220419-0001/ - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
CVE ID: CVE-2022-27224 State: PUBLISHED Published: 2022-05-09T14:29:56 Last Updated: 2024-08-03T05:25:31.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell metacharacters within the Network Tools section of the web-management interface. All three networking tools are affected (Ping, Traceroute, and DNS Lookup) and their respective input fields (ping_address, trace_address, nslookup_address). Additional Analyst Notes: - CVE Program Container: References: - https://www.galsys.co.uk/support/software-download.html - https://gist.g
t Notes: - CVE Program Container: References: - https://www.galsys.co.uk/support/software-download.html - https://gist.github.com/somerandomdudeonetheinternet/2caeb201e249160fa82204ef640c8cdf - https://www.pentestpartners.com/security-blog/galleon-nts-6002-gps-command-injection-vulnerability-cve-2022-27224/
CVE ID: CVE-2022-27225 State: PUBLISHED Published: 2022-03-16T00:10:18 Last Updated: 2024-08-03T05:25:32.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safari versions, Keycloak sets a duplicate of the cookie without the Secure attribute, which allows the cookie to be sent when accessing the location that cookie is set for via HTTP. This creates the potential for an attacker (with the abi
nt when accessing the location that cookie is set for via HTTP. This creates the potential for an attacker (with the ability to impersonate the Gradle Enterprise host) to capture the login session of a user by having them click an http:// link to the server, despite the real server requiring HTTPS. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com/advisory/2022-03
CVE ID: CVE-2022-27226 State: PUBLISHED Published: 2022-03-19T03:04:03 Last Updated: 2024-08-03T05:25:32.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction. Additional Analyst Notes: -
discovers valid credentials, remote code execution can be achieved without user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://en.irz.ru - https://johnjhacking.com/blog/cve-2022-27226/ - https://github.com/SakuraSamuraii/ez-iRZ - http://packetstormsecurity.com/files/166396/iRZ-Mobile-Router-Cross-Site-Request-Forgery-Remote-Code-Execution.html