deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-33592
Published: 2024-04-25
Description: Server-Side Request Forgery (SSRF) vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/radio-player/wordpress-radio-player-plugin-2-0-73-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/radio-player/wordpress-radio-player-plugin-2-0-73-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2023-5675
Published: 2024-04-25
Description: A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://access.redhat.com/errata/RHSA-2024:0494; https://access.redhat.com/errata/RHSA-2024:0495; https://access.redhat.com/security/cve/CVE-2023-5675
CVE: CVE-2023-6484
Published: 2024-04-25
Description: A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-117
References: https://access.redhat.com/errata/RHSA-2024:0798; https://access.redhat.com/errata/RHSA-2024:0799; https://access.redhat.com/errata/RHSA-2024:0800
CVE: CVE-2023-6544
Published: 2024-04-25
Description: A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-625
References: https://access.redhat.com/errata/RHSA-2024:1860; https://access.redhat.com/errata/RHSA-2024:1861; https://access.redhat.com/errata/RHSA-2024:1862
CVE: CVE-2023-6596
Published: 2024-04-25
Description: An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2024:0485; https://access.redhat.com/errata/RHSA-2024:0682; https://access.redhat.com/security/cve/CVE-2023-6596
CVE: CVE-2023-6717
Published: 2024-04-25
Description: A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/errata/RHSA-2024:1353; https://access.redhat.com/errata/RHSA-2024:1867; https://access.redhat.com/errata/RHSA-2024:1868
CVE: CVE-2023-6787
Published: 2024-04-25
Description: A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login," an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://access.redhat.com/errata/RHSA-2024:1867; https://access.redhat.com/errata/RHSA-2024:1868; https://access.redhat.com/security/cve/CVE-2023-6787
CVE: CVE-2024-0874
Published: 2024-04-25
Description: A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-524
References: https://access.redhat.com/errata/RHSA-2024:0041; https://access.redhat.com/errata/RHSA-2024:4850; https://access.redhat.com/errata/RHSA-2024:6009
CVE: CVE-2024-1102
Published: 2024-04-25
Description: A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-523, CWE-200
References: https://access.redhat.com/errata/RHSA-2024:1677; https://access.redhat.com/errata/RHSA-2024:3580; https://access.redhat.com/errata/RHSA-2024:3581
CVE: CVE-2024-1139
Published: 2024-04-25
Description: A credentials leak vulnerability was found in the cluster monitoring operator in OCP.  This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2024:1887; https://access.redhat.com/errata/RHSA-2024:1891; https://access.redhat.com/errata/RHSA-2024:2047
CVE: CVE-2024-1657
Published: 2024-04-25
Description: A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: https://access.redhat.com/errata/RHSA-2024:1057; https://access.redhat.com/security/cve/CVE-2024-1657; https://bugzilla.redhat.com/show_bug.cgi?id=2265085
CVE: CVE-2024-1726
Published: 2024-04-25
Description: A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-281
References: https://access.redhat.com/errata/RHSA-2024:1662; https://access.redhat.com/security/cve/CVE-2024-1726; https://bugzilla.redhat.com/show_bug.cgi?id=2265158
CVE: CVE-2024-25624
Published: 2024-04-25
Description: Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 environment, reports generation in `iris-web` is prone to a Server Side Template Injection (SSTI). Successful exploitation of the vulnerability can lead to an arbitrary Remote Code Execution. An authenticated administrator has to upload a crafted report template containing the payload. Upon generation of a report based on the weaponized report, any user can trigger the vulnerability.  The vulnerability is patched in IRIS v2.4.6. No workaround is available. It is recommended to update as soon as possible. Until patching, review the report templates and keep the administrative privileges that include the upload of report templates limited to dedicated users. 

CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1336, CWE-94
References: https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m64w-f7fg-hpcr; https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m64w-f7fg-hpcr
CVE: CVE-2024-28240
Published: 2024-04-25
Description: The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy task is installed, a local malicious user can trigger privilege escalation configuring a malicious server providing its own deploy task payload. GLPI-Agent 1.7.2 contains a patch for this issue. As a workaround, edit GLPI-Agent related key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and add `SystemComponent` DWORD value setting it to `1` to hide GLPI-Agent from installed applications.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://github.com/glpi-project/glpi-agent/commit/41bbb1169e899bd15350a9e2fdbf9269a3b7a14f; https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-hx3x-mmqg-h3jp; https://github.com/glpi-project/glpi-agent/commit/41bbb1169e899bd15350a9e2fdbf9269a3b7a14f
CVE: CVE-2024-28241
Published: 2024-04-25
Description: The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which involves installed folder is automatically secured by the system.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269, CWE-269
References: https://github.com/glpi-project/glpi-agent/commit/9a97114f595562c91b0833b4a800dd51e9df65e9; https://github.com/glpi-project/glpi-agent/security/advisories/GHSA-3268-p58w-86hw; https://github.com/glpi-project/glpi-agent/commit/9a97114f595562c91b0833b4a800dd51e9df65e9
CVE: CVE-2024-29660
Published: 2024-04-25
Description: Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/ysl1415926/cve/blob/main/DedeCMSv5.7.md; https://github.com/ysl1415926/cve/blob/main/DedeCMSv5.7.md
CVE: CVE-2024-2467
Published: 2024-04-25
Description: A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-208
References: https://access.redhat.com/security/cve/CVE-2024-2467; https://bugzilla.redhat.com/show_bug.cgi?id=2269567; https://github.com/toddr/Crypt-OpenSSL-RSA/issues/42
CVE: CVE-2024-30890
Published: 2024-04-25
Description: Cross Site Scripting vulnerability in ED01-CMS v.1.0 allows an attacker to obtain sensitive information via the categories.php component.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/rootlili/198922ef72c9bef973e04eb6b36a8aad; https://gist.github.com/rootlili/198922ef72c9bef973e04eb6b36a8aad
CVE: CVE-2024-31574
Published: 2024-04-25
Description: Cross Site Scripting vulnerability in TWCMS v.2.6 allows a local attacker to execute arbitrary code via a crafted script
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79
References: https://github.com/ysl1415926/cve/blob/main/CVE-2024-31574.md; https://github.com/ysl1415926/cve/blob/main/CVE-2024-31574.md
CVE: CVE-2024-32236
Published: 2024-04-25
Description: An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component.
CVSS Score: 3.5 (LOW)
CWE: CWE-922
References: https://github.com/cidengcc/cmseasy/issues/1; https://github.com/cidengcc/cmseasy/issues/1
CVE: CVE-2024-32358
Published: 2024-04-25
Description: An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://gist.github.com/rootlili/a6b6c89591f4773857ae81b7ca5898bc; https://gitee.com/JPressProjects/jpress/releases/tag/v5.1.0; https://github.com/JPressProjects/jpress/releases/tag/v5.1.0
CVE: CVE-2024-32467
Published: 2024-04-25
Description: MeterSphere is an open source continuous testing platform. Prior to version 2.10.14-lts, members without space permissions can view member information from other workspaces beyond their authority. Version 2.10.14-lts fixes this issue.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://github.com/metersphere/metersphere/security/advisories/GHSA-7499-q88f-mxqp; https://github.com/metersphere/metersphere/security/advisories/GHSA-7499-q88f-mxqp
CVE: CVE-2024-32481
Published: 2024-04-25
Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range` of the form `range(start, start + N)`, if `start` is negative, the execution will always revert. This issue is caused by an incorrect assertion inserted by the code generation of the range `stmt.parse_For_range()`. The issue arises when `start` is signed, instead of using `sle`, `le` is used and `start` is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to `1` and is hence interpreted as a very large unsigned integer making the assertion always fail. Any contract having a `range(start, start + N)` where `start` is a signed integer with the possibility for `start` to be negative is affected. If a call goes through the loop while supplying a negative `start` the execution will revert. Version 0.4.0b1 fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-681, CWE-681
References: https://github.com/vyperlang/vyper/blob/[PII_REDACTED]f317a53b4e7448389aa315f90b95ba/vyper/codegen/stmt.py#L286-L287; https://github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868; https://github.com/vyperlang/vyper/commit/5319cfbe14951e007ccdb323257e5ada869b35d5
CVE: CVE-2024-2905
Published: 2024-04-25
Description: A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-732
References: https://access.redhat.com/errata/RHBA-2025:4872; https://access.redhat.com/errata/RHSA-2024:3401; https://access.redhat.com/errata/RHSA-2024:3823
CVE: CVE-2024-32645
Published: 2024-04-25
Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics. As of time of publication, no fixed version is available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/vyperlang/vyper/security/advisories/GHSA-xchq-w5r3-4wg3; https://github.com/vyperlang/vyper/security/advisories/GHSA-xchq-w5r3-4wg3
CVE: CVE-2024-32646
Published: 2024-04-25
Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `<address>.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the versions `<0.3.4` as `0.3.4` introduced the unique symbol fence. No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/vyperlang/vyper/security/advisories/GHSA-r56x-j438-vw5m; https://github.com/vyperlang/vyper/security/advisories/GHSA-r56x-j438-vw5m
CVE: CVE-2024-32647
Published: 2024-04-25
Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions exist.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-95
References: https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847; https://github.com/vyperlang/vyper/security/advisories/GHSA-3whq-64q2-qfj6; https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847
CVE: CVE-2024-32648
Published: 2024-04-25
Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is low. Version 0.3.0 contains a patch for the issue.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://github.com/vyperlang/vyper/commit/93287e5ac184b53b395c907d40701f721daf8177; https://github.com/vyperlang/vyper/issues/2455; https://github.com/vyperlang/vyper/security/advisories/GHSA-m2v9-w374-5hj9
CVE: CVE-2024-32649
Published: 2024-04-25
Description: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-95
References: https://github.com/vyperlang/vyper/security/advisories/GHSA-5jrj-52x8-m64h; https://github.com/vyperlang/vyper/security/advisories/GHSA-5jrj-52x8-m64h
CVE: CVE-2024-3508
Published: 2024-04-25
Description: A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-434
References: https://access.redhat.com/security/cve/CVE-2024-3508; https://bugzilla.redhat.com/show_bug.cgi?id=2274109; https://access.redhat.com/security/cve/CVE-2024-3508
CVE: CVE-2024-3622
Published: 2024-04-25
Description: A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a malicious actor to craft session cookies and as a consequence, it may lead to gaining access to the affected Quay instance.
CVSS Score: 8.8 (HIGH)
CWE: CWE-256
References: https://access.redhat.com/security/cve/CVE-2024-3622; https://bugzilla.redhat.com/show_bug.cgi?id=2274400; https://access.redhat.com/security/cve/CVE-2024-3622
CVE: CVE-2024-3623
Published: 2024-04-25
Description: A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. This flaw allows a malicious actor to access sensitive information from Quay's database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-256
References: https://access.redhat.com/security/cve/CVE-2024-3623; https://bugzilla.redhat.com/show_bug.cgi?id=2274404; https://access.redhat.com/security/cve/CVE-2024-3623
CVE: CVE-2024-3624
Published: 2024-04-25
Description: A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database.
CVSS Score: 7.3 (HIGH)
CWE: CWE-256
References: https://access.redhat.com/security/cve/CVE-2024-3624; https://bugzilla.redhat.com/show_bug.cgi?id=2274407; https://access.redhat.com/security/cve/CVE-2024-3624
CVE: CVE-2024-3625
Published: 2024-04-25
Description: A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.
CVSS Score: 7.3 (HIGH)
CWE: CWE-256
References: https://access.redhat.com/security/cve/CVE-2024-3625; https://bugzilla.redhat.com/show_bug.cgi?id=2274408; https://access.redhat.com/security/cve/CVE-2024-3625
CVE: CVE-2024-30939
Published: 2024-04-25
Description: An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control of an account via a flaw in the factory reset procedure.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://medium.com/%40deepsahu1/yealink-ip-phone-account-take-over-9bf9e7b847c0?source=friends_link&sk=b0d664dd5b3aad5b758e4934aca997ad; https://medium.com/%40deepsahu1/yealink-ip-phone-account-take-over-9bf9e7b847c0?source=friends_link&sk=b0d664dd5b3aad5b758e4934aca997ad
CVE: CVE-2024-31615
Published: 2024-04-25
Description: ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/huajiuqi/bug/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md; https://github.com/huajiuqi/bug/blob/main/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
CVE: CVE-2024-32324
Published: 2024-04-25
Description: Buffer Overflow vulnerability in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v.3.2 allows a local attacker to execute arbitrary code via the vpn_client_ip variable of the config_vpn_pptp function in rc program.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/teamoever/CVE/blob/main/LBT-T300-T400.md; https://github.com/teamoever/CVE/blob/main/LBT-T300-T400.md
CVE: CVE-2022-36028
Published: 2024-04-25
Description: Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.

CVSS Score: 9.1 (CRITICAL)
CWE: CWE-601, CWE-601
References: https://github.com/bigbluebutton/greenlight/commit/20fe1ee71b5703fcc4ed698a959ad224fed19623; https://huntr.com/bounties/ba5834bd-1f04-4936-8e93-2442d45403bahttps://; https://github.com/bigbluebutton/greenlight/commit/20fe1ee71b5703fcc4ed698a959ad224fed19623