deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2509
Published: 2024-04-05
Description: The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://research.cleantalk.org/cve-2024-2509/; https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/; https://research.cleantalk.org/cve-2024-2509/
CVE: CVE-2023-52235
Published: 2024-04-05
Description: SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Rebinding attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-350
References: https://bugcrowd.com/disclosures/f529009b-90eb-4bf9-957d-6fe7ea890fa2/starlink-dishy-is-vulnerable-to-csrf-via-dns-rebinding; https://bugcrowd.com/disclosures/f529009b-90eb-4bf9-957d-6fe7ea890fa2/starlink-dishy-is-vulnerable-to-csrf-via-dns-rebinding
CVE: CVE-2024-22363
Published: 2024-04-05
Description: SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://cdn.sheetjs.com/advisories/CVE-2024-22363; https://cwe.mitre.org/data/definitions/1333.html; https://git.sheetjs.com/sheetjs/sheetjs/src/tag/v0.20.2
CVE: CVE-2024-27448
Published: 2024-04-05
Description: MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary code into the routes.js file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-352
References: https://gist.github.com/stypr/fe2003f00959f7e3d92ab9d5260433f8; https://github.com/Tim-Hoekstra/MailDev-2.1.0-Exploit-RCE; https://github.com/maildev/maildev/issues/467
CVE: CVE-2024-29672
Published: 2024-04-05
Description: Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG_RTC_REQUEST_SYNC_DATA in KeyCallbacks.kt.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://gist.github.com/apple502j/[PII_REDACTED]5fe1a6708309ce934e4ed; https://github.com/zly2006/reden-is-what-we-made/commit/44c5320f0a1ccaa764dd91df6a12e747f81fe63a; https://gist.github.com/apple502j/[PII_REDACTED]5fe1a6708309ce934e4ed
CVE: CVE-2024-26329
Published: 2024-04-05
Description: Chilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-331
References: https://x41-dsec.de/lab/advisories/x41-2024-001-chilkat-prng/; https://x41-dsec.de/lab/advisories/x41-2024-001-chilkat-prng/
CVE: CVE-2024-29863
Published: 2024-04-05
Description: A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may allow an existing lower privileged user to cause code to be executed in the context of a Windows Administrator.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://community.qlik.com/t5/Official-Support-Articles/High-Severity-Security-fix-for-QlikView-CVE-2024-29863/ta-p/2432661; https://community.qlik.com/t5/Official-Support-Articles/High-Severity-Security-fix-for-QlikView-CVE-2024-29863/ta-p/2432661
CVE: CVE-2024-2115
Published: 2024-04-05
Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due to missing or incorrect nonce validation on the filter_users functions. This makes it possible for unauthenticated attackers to elevate their privileges to that of a teacher via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3061953/learnpress/tags/4.0.1/inc/admin/class-lp-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/342a4482-f5d3-4cc9-a998-e3abac7142cf?source=cve; https://plugins.trac.wordpress.org/changeset/3061953/learnpress/tags/4.0.1/inc/admin/class-lp-admin.php
CVE: CVE-2024-30849
Published: 2024-04-05
Description: Arbitrary file upload vulnerability in Sourcecodester Complete E-Commerce Site v1.0, allows remote attackers to execute arbitrary code via filename parameter in admin/products_photo.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://github.com/wkeyi0x1/vul-report/issues/3; https://github.com/wkeyi0x1/vul-report/issues/3
CVE: CVE-2024-30891
Published: 2024-04-05
Description: A command injection vulnerability exists in /goform/exeCommand in Tenda AC18 v15.03.05.05, which allows attackers to construct cmdinput parameters for arbitrary command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/Lantern-r/IoT-vuln/blob/main/Tenda/AC18/formexeCommand.md; https://github.com/Lantern-r/IoT-vuln/blob/main/Tenda/AC18/formexeCommand.md
CVE: CVE-2024-3217
Published: 2024-04-05
Description: The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/application/controllers/Wdk_frontendajax.php#L72; https://plugins.trac.wordpress.org/changeset/3064842/wpdirectorykit/trunk/application/controllers/Wdk_frontendajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/09b315e6-d973-467d-8b8d-4b7b4a7ca3f8?source=cve
CVE: CVE-2024-21848
Published: 2024-04-05
Description: Improper Access Control in Mattermost Server versions 8.1.x before 8.1.11 allows an attacker that is in a channel with an active call to keep participating in the call even if they are removed from the channel


CVSS Score: 3.1 (LOW)
CWE: CWE-284, CWE-273
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-26810
Published: 2024-04-05
Description: In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Lock external INTx masking ops

Mask operations through config space changes to DisINTx may race INTx
configuration changes via ioctl.  Create wrappers that add locking for
paths outside of the core interrupt code.

In particular, irq_type is updated holding igate, therefore testing
is_intx() requires holding igate.  For example clearing DisINTx from
config space can otherwise race changes of the interrupt configuration.

This aligns interfaces which may trigger the INTx eventfd into two
camps, one side serialized by igate and the other only enabled while
INTx is configured.  A subsequent patch introduces synchronization for
the latter flows.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/03505e3344b0576fd619416793a31eae9c5b73bf; https://git.kernel.org/stable/c/04a4a017b9ffd7b0f427b8c376688d14cb614651; https://git.kernel.org/stable/c/1e71b6449d55179170efc8dee8664510bb813b42
CVE: CVE-2024-26812
Published: 2024-04-05
Description: In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Create persistent INTx handler

A vulnerability exists where the eventfd for INTx signaling can be
deconfigured, which unregisters the IRQ handler but still allows
eventfds to be signaled with a NULL context through the SET_IRQS ioctl
or through unmask irqfd if the device interrupt is pending.

Ideally this could be solved with some additional locking; the igate
mutex serializes the ioctl and config space accesses, and the interrupt
handler is unregistered relative to the trigger, but the irqfd path
runs asynchronous to those.  The igate mutex cannot be acquired from the
atomic context of the eventfd wake function.  Disabling the irqfd
relative to the eventfd registration is potentially incompatible with
existing userspace.

As a result, the solution implemented here moves configuration of the
INTx interrupt handler to track the lifetime of the INTx context object
and irq_type configuration, rather than registration of a particular
trigger eventfd.  Synchronization is added between the ioctl path and
eventfd_signal() wrapper such that the eventfd trigger can be
dynamically updated relative to in-flight interrupts or irqfd callbacks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034; https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d; https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897
CVE: CVE-2024-26813
Published: 2024-04-05
Description: In the Linux kernel, the following vulnerability has been resolved:

vfio/platform: Create persistent IRQ handlers

The vfio-platform SET_IRQS ioctl currently allows loopback triggering of
an interrupt before a signaling eventfd has been configured by the user,
which thereby allows a NULL pointer dereference.

Rather than register the IRQ relative to a valid trigger, register all
IRQs in a disabled state in the device open path.  This allows mask
operations on the IRQ to nest within the overall enable state governed
by a valid eventfd signal.  This decouples @masked, protected by the
@locked spinlock from @trigger, protected via the @igate mutex.

In doing so, it's guaranteed that changes to @trigger cannot race the
IRQ handlers because the IRQ handler is synchronously disabled before
modifying the trigger, and loopback triggering of the IRQ via ioctl is
safe due to serialization with trigger changes via igate.

For compatibility, request_irq() failures are maintained to be local to
the SET_IRQS ioctl rather than a fatal error in the open device path.
This allows, for example, a userspace driver with polling mode support
to continue to work regardless of moving the request_irq() call site.
This necessarily blocks all SET_IRQS access to the failed index.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/07afdfd8a68f9eea8db0ddc4626c874f29d2ac5e; https://git.kernel.org/stable/c/09452c8fcbd7817c06e8e3212d99b45917e603a5; https://git.kernel.org/stable/c/0f8d8f9c2173a541812dd750529f4a415117eb29
CVE: CVE-2024-26814
Published: 2024-04-05
Description: In the Linux kernel, the following vulnerability has been resolved:

vfio/fsl-mc: Block calling interrupt handler without trigger

The eventfd_ctx trigger pointer of the vfio_fsl_mc_irq object is
initially NULL and may become NULL if the user sets the trigger
eventfd to -1.  The interrupt handler itself is guaranteed that
trigger is always valid between request_irq() and free_irq(), but
the loopback testing mechanisms to invoke the handler function
need to test the trigger.  The triggering and setting ioctl paths
both make use of igate and are therefore mutually exclusive.

The vfio-fsl-mc driver does not make use of irqfds, nor does it
support any sort of masking operations, therefore unlike vfio-pci
and vfio-platform, the flow can remain essentially unchanged.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/083e750c9f5f4c3bf61161330fb84d7c8e8bb417; https://git.kernel.org/stable/c/250219c6a556f8c69c5910fca05a59037e24147d; https://git.kernel.org/stable/c/6ec0d88166dac43f29e96801c0927d514f17add9
CVE: CVE-2024-27437
Published: 2024-04-05
Description: In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Disable auto-enable of exclusive INTx IRQ

Currently for devices requiring masking at the irqchip for INTx, ie.
devices without DisINTx support, the IRQ is enabled in request_irq()
and subsequently disabled as necessary to align with the masked status
flag.  This presents a window where the interrupt could fire between
these events, resulting in the IRQ incrementing the disable depth twice.
This would be unrecoverable for a user since the masked flag prevents
nested enables through vfio.

Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx
is never auto-enabled, then unmask as required.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/139dfcc4d723ab[PII_REDACTED]c7d80f49d776060; https://git.kernel.org/stable/c/26389925d6c2126fb777821a0a983adca7ee6351; https://git.kernel.org/stable/c/2a4a666c[PII_REDACTED]5b7b5bc20545f8aabc4fa2
CVE: CVE-2024-28949
Published: 2024-04-05
Description: Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-29221
Published: 2024-04-05
Description: Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the `/api/v4/users/me/teams` endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users, even if the "Add Members" permission was explicitly removed from team admins. 


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-2447
Published: 2024-04-05
Description: Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-346
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-6522
Published: 2024-04-05
Description: Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3914.
CVSS Score: 7.2 (HIGH)
CWE: CWE-648
References: https://www.usom.gov.tr/bildirim/tr-24-0276; https://www.usom.gov.tr/bildirim/tr-24-0276
CVE: CVE-2023-6523
Published: 2024-04-05
Description: Authorization Bypass Through User-Controlled Key vulnerability in ExtremePacs Extreme XDS allows Authentication Abuse.This issue affects Extreme XDS: before 3914.


CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-24-0276; https://www.usom.gov.tr/bildirim/tr-24-0276
CVE: CVE-2024-31083
Published: 2024-04-05
Description: A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2024:1785; https://access.redhat.com/errata/RHSA-2024:2036; https://access.redhat.com/errata/RHSA-2024:2037
CVE: CVE-2023-5692
Published: 2024-04-05
Description: WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including,  6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://core.trac.wordpress.org/changeset/57645; https://developer.wordpress.org/reference/functions/is_post_publicly_viewable/; https://developer.wordpress.org/reference/functions/is_post_type_viewable/
CVE: CVE-2024-2380
Published: 2024-04-05
Description: Stored XSS in graph rendering in Checkmk <2.3.0b4.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://checkmk.com/werk/16618; https://checkmk.com/werk/16618
CVE: CVE-2024-2499
Published: 2024-04-05
Description: The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'accordions' shortcode in all versions up to, and including, 0.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3052812/squelch-tabs-and-accordions-shortcodes; https://www.wordfence.com/threat-intel/vulnerabilities/id/adf10ad4-38b2-44be-bdc6-ba6b62e9fbe6?source=cve; https://plugins.trac.wordpress.org/changeset/3052812/squelch-tabs-and-accordions-shortcodes
CVE: CVE-2023-49965
Published: 2024-04-05
Description: SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://hackintoanetwork.com/blog/2023-starlink-router-gen2-xss-eng/; https://hackintoanetwork.com/blog/2023-starlink-router-gen2-xss-eng/
CVE: CVE-2024-31213
Published: 2024-04-05
Description: InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available.
CVSS Score: 3.5 (LOW)
CWE: CWE-601, CWE-601
References: https://github.com/instantsoft/icms2/security/advisories/GHSA-6v3c-p92q-prfq; https://github.com/instantsoft/icms2/security/advisories/GHSA-6v3c-p92q-prfq
CVE: CVE-2024-31218
Published: 2024-04-05
Description: Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and earlier are subject to Missing Authentication for Critical Function vulnerability. This vulnerability allows an unauthenticated attacker to send a HTTP request to the database (Pocketbase) admin API to create an admin account. The Pocketbase admin API does not check for authentication/authorization when creating an admin account when no admin accounts have been added. In its default deployment, Webhood does not create a database admin account. Therefore, unless users have manually created an admin account in the database, an admin account will not exist in the deployment and the deployment is vulnerable. Versions starting from 0.9.1 are patched. The patch creates a randomly generated admin account if admin accounts have not already been created i.e. the vulnerability is exploitable in the deployment. As a workaround, users can disable access to URL path starting with `/api/admins` entirely. With this workaround, the vulnerability is not exploitable via network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/webhood-io/webhood/commit/735e7fa2814edeec9a2c07778ed51b3c018609f9; https://github.com/webhood-io/webhood/security/advisories/GHSA-h533-rxhm-73j2; https://github.com/webhood-io/webhood/commit/735e7fa2814edeec9a2c07778ed51b3c018609f9
CVE: CVE-2024-31220
Published: 2024-04-05
Description: Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface outside of localhost may be affected, depending on firewall configuration. To exploit vulnerability, attacker could make an http/s request to the `node_modules` endpoint if user exposed Sunshine config web server to internet or attacker is on the LAN. Version 0.18.0 contains a patch for this issue. As a workaround, one may block access to Sunshine via firewall.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://github.com/LizardByte/Sunshine/releases/tag/v0.18.0; https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6rg7-7m3w-w5wc; https://github.com/LizardByte/Sunshine/releases/tag/v0.18.0
CVE: CVE-2024-31852
Published: 2024-04-05
Description: LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
CVSS Score: 5.9 (MEDIUM)
References: https://bugs.chromium.org/p/llvm/issues/detail?id=69; https://github.com/llvm/llvm-project/issues/80287; https://github.com/llvmbot/llvm-project/commit/0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2
CVE: CVE-2023-48426
Published: 2024-04-05
Description: u-boot bug that allows for u-boot shell and interrupt over UART

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306
References: https://source.android.com/docs/security/bulletin/chromecast/2023-12-01; https://source.android.com/docs/security/bulletin/chromecast/2023-12-01
CVE: CVE-2024-3346
Published: 2024-04-05
Description: A vulnerability was found in Byzoro Smart S80 up to 20240328. It has been declared as critical. This vulnerability affects unknown code of the file /log/webmailattach.php. The manipulation of the argument mail_file_path leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259450 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/Yu1e/vuls/blob/main/Byzro%20Networks%20Smart%20S80%20management%20platform%20has%20rce%20vulnerability.md; https://vuldb.com/?ctiid.259450; https://vuldb.com/?id.259450
CVE: CVE-2024-3347
Published: 2024-04-05
Description: A vulnerability was found in SourceCodester Airline Ticket Reservation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file activate_jet_details_form_handler.php. The manipulation of the argument jet_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259451.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/thisissuperann/Vul/blob/main/Airline-Ticket-Reservation-System-01.md; https://vuldb.com/?ctiid.259451; https://vuldb.com/?id.259451