deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-42584
Published: 2021-12-17
Description: A Stored Cross Site Scripting (XSS) issue exists in Convos-Chat before 6.32.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://dev696.github.io/Writeup/; https://github.com/convos-chat/convos/commit/14a3b1e98cd1a3211c0ef3d4f5ffdbc60baaca54; https://github.com/convos-chat/convos/issues/623
CVE: CVE-2021-45042
Published: 2021-12-17
Description: In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.
CVSS Score: 4.9 (MEDIUM)
References: https://discuss.hashicorp.com/t/hcsec2-21-33-vault-s-kv-secrets-engine-with-integrated-storage-exposed-to-authenticated-denial-of-service/33157; https://security.gentoo.org/glsa/202207-01; https://www.hashicorp.com/blog/category/vault
CVE: CVE-2021-41451
Published: 2021-12-17
Description: A misconfiguration in HTTP/1.0 and HTTP/1.1 of the web interface in TP-Link AX10v1 before V1_211117 allows a remote unauthenticated attacker to send a specially crafted HTTP request and receive a misconfigured HTTP/0.9 response, potentially leading into a cache poisoning attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: http://ax10v1.com; http://tp-link.com; https://www.tp-link.com/us/support/download/archer-ax10/v1/#Firmware
CVE: CVE-2021-44035
Published: 2021-12-17
Description: Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious files.
CVSS Score: 4.4 (MEDIUM)
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-44035; https://excellium-services.com/cert-xlm-advisory/CVE-2021-44035; https://www.wolterskluwer.com/en/solutions/teammate
CVE: CVE-2020-18077
Published: 2021-12-17
Description: A buffer overflow vulnerability in the Virtual Path Mapping component of FTPShell v6.83 allows attackers to cause a denial of service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/cve-vul/vul/blob/master/FTPShell/FTPShell_Server_6.83_DOS.md; https://github.com/cve-vul/vul/blob/master/FTPShell/FTPShell_Server_6.83_DOS.md
CVE: CVE-2020-18078
Published: 2021-12-17
Description: A vulnerability in /include/web_check.php of SEMCMS v3.8 allows attackers to reset the Administrator account's password.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/cve-vul/vul/blob/master/SEMCMS/back_password_reset.md; https://github.com/cve-vul/vul/blob/master/SEMCMS/back_password_reset.md
CVE: CVE-2020-18081
Published: 2021-12-17
Description: The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext through a SQL query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/cve-vul/vul/blob/master/SEMCMS/backstage_access_control.md; https://github.com/cve-vul/vul/blob/master/SEMCMS/backstage_access_control.md
CVE: CVE-2020-8968
Published: 2021-12-17
Description: Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of the user could be compromised if an attacker is able to recover the profile password.
CVSS Score: 7.1 (HIGH)
CWE: CWE-255
References: https://www.incibe.es/en/incibe-cert/notices/aviso/parallels-remote-application-server-credentials-management-errors; https://www.incibe.es/en/incibe-cert/notices/aviso/parallels-remote-application-server-credentials-management-errors
CVE: CVE-2021-0673
Published: 2021-12-17
Description: In Audio Aurisys HAL, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05977326; Issue ID: ALPS05977326.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0674
Published: 2021-12-17
Description: In alac decoder, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06064258; Issue ID: ALPS06064237.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0676
Published: 2021-12-17
Description: In geniezone driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05863009; Issue ID: ALPS05863009.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0677
Published: 2021-12-17
Description: In ccu driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05827154; Issue ID: ALPS05827154.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0678
Published: 2021-12-17
Description: In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05722511.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0679
Published: 2021-12-17
Description: In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05687781.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0893
Published: 2021-12-17
Description: In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05687474.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0894
Published: 2021-12-17
Description: In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672038.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0895
Published: 2021-12-17
Description: In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672003.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0896
Published: 2021-12-17
Description: In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05671206.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0897
Published: 2021-12-17
Description: In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05670549.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-367, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0898
Published: 2021-12-17
Description: In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672071.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0899
Published: 2021-12-17
Description: In apusys, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672059.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0900
Published: 2021-12-17
Description: In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672055.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0901
Published: 2021-12-17
Description: In apusys, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05664618.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0902
Published: 2021-12-17
Description: In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05656484.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-0903
Published: 2021-12-17
Description: In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05656488.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2021; https://corp.mediatek.com/product-security-bulletin/December-2021
CVE: CVE-2021-20606
Published: 2021-12-17
Description: Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and Mitsubishi Electric EZSocket versions 5.4 and prior allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://jvn.jp/vu/JVNVU93817405/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-021_en.pdf
CVE: CVE-2021-20607
Published: 2021-12-17
Description: Integer Underflow vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and Mitsubishi Electric EZSocket versions 5.4 and prior allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: https://jvn.jp/vu/JVNVU93817405/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-021_en.pdf
CVE: CVE-2021-20608
Published: 2021-12-17
Description: Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote unauthenticated attacker to cause a DoS condition in GX Works2 by getting GX Works2 to read a tampered program file from a Mitsubishi Electric PLC by sending malicious crafted packets to tamper with the program file.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/vu/JVNVU93019896/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-21-350-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-020_en.pdf
CVE: CVE-2021-22054
Published: 2021-12-17
Description: VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://www.vmware.com/security/advisories/VMSA-2021-0029.html; https://www.vmware.com/security/advisories/VMSA-2021-0029.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22054
CVE: CVE-2021-32497
Published: 2021-12-17
Description: SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user. When a user starts the emulator the executable is run without further checks.
CVSS Score: 8.6 (HIGH)
References: https://sick.com/psirt#advisories; https://sick.com/psirt#advisories
CVE: CVE-2021-32498
Published: 2021-12-17
Description: SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary executable located on the host system. When the user starts the emulator from SOPAS ET the corresponding executable will be started instead of the emulator
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://sick.com/psirt#advisories; https://sick.com/psirt#advisories
CVE: CVE-2021-32499
Published: 2021-12-17
Description: SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://sick.com/psirt#advisories; https://sick.com/psirt#advisories
CVE: CVE-2021-37862
Published: 2021-12-17
Description: Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.
CVSS Score: 3.7 (LOW)
CWE: CWE-754, CWE-754
References: https://hackerone.com/reports/1357013; https://mattermost.com/security-updates/; https://hackerone.com/reports/1357013
CVE: CVE-2021-37863
Published: 2021-12-17
Description: Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.
CVSS Score: 3.5 (LOW)
CWE: CWE-20, CWE-20
References: https://hackerone.com/reports/1253732; https://mattermost.com/security-updates/; https://hackerone.com/reports/1253732
CVE: CVE-2021-38883
Published: 2021-12-17
Description: IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209165.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209165; https://www.ibm.com/support/pages/node/6527270; https://exchange.xforce.ibmcloud.com/vulnerabilities/209165
CVE: CVE-2021-40850
Published: 2021-12-17
Description: TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-sql-injection-vulnerability; https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-sql-injection-vulnerability
CVE: CVE-2021-40851
Published: 2021-12-17
Description: TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-sql-improper-authentication; https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-sql-improper-authentication
CVE: CVE-2021-40852
Published: 2021-12-17
Description: TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by the attacker. The exploitation of this vulnerability might allow a remote attacker to obtain information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-open-redirect-vulnerability; https://www.incibe-cert.es/en/early-warning/security-advisories/tcman-gim-open-redirect-vulnerability
CVE: CVE-2021-40853
Published: 2021-12-17
Description: TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL that require privileges without having them. The exploitation of this vulnerability might allow a remote attacker to obtain sensible information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.incibe.es/en/incibe-cert/notices/aviso/tcman-gim-missing-authorization-vulnerability; https://www.incibe.es/en/incibe-cert/notices/aviso/tcman-gim-missing-authorization-vulnerability
CVE: CVE-2021-4008
Published: 2021-12-17
Description: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://lists.debian.org/debian-lts-announce/2021/12/msg00035.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXTRPFEQLFZ6NT2LPLZEID664RGC3OCC/
CVE: CVE-2021-4009
Published: 2021-12-17
Description: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcXFixesCreatePointerBarrier function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://lists.debian.org/debian-lts-announce/2021/12/msg00035.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXTRPFEQLFZ6NT2LPLZEID664RGC3OCC/
CVE: CVE-2021-4010
Published: 2021-12-17
Description: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcScreenSaverSuspend function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXTRPFEQLFZ6NT2LPLZEID664RGC3OCC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDHYZM6FII35JA7J275MFCJO6ADJUPQX/
CVE: CVE-2021-4011
Published: 2021-12-17
Description: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SwapCreateRegister function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://lists.debian.org/debian-lts-announce/2021/12/msg00035.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKLSZCY47QK4RCJFXITYFALCGPJAFXOK/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXTRPFEQLFZ6NT2LPLZEID664RGC3OCC/
CVE: CVE-2021-33430
Published: 2021-12-17
Description: A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/numpy/numpy/issues/18939; https://github.com/numpy/numpy/issues/18939
CVE: CVE-2021-34141
Published: 2021-12-17
Description: An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-697
References: https://github.com/numpy/numpy/issues/18993; https://www.oracle.com/security-alerts/cpujul2022.html; https://github.com/numpy/numpy/issues/18993