deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28641
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-28642
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Out-of-bounds write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-28643
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by a Type Confusion vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-843
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-35981
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-35983
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-35984
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by a Null pointer dereference vulnerability. An authenticated attacker could leverage this vulnerability achieve an application denial-of-service in the context of the current user. Exploitation of this issue does not requires user interaction.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-35985
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-35986
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Type Confusion vulnerability. An unauthenticated attacker could leverage this vulnerability to read arbitrary system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-843
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1145/; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-35987
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-35988
Published: 2021-08-20
Description: Acrobat Reader DC versions 2[PII_REDACTED]4 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]7 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb21-51.html; https://helpx.adobe.com/security/products/acrobat/apsb21-51.html
CVE: CVE-2021-35989
Published: 2021-08-20
Description: Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb21-53.html; https://helpx.adobe.com/security/products/bridge/apsb21-53.html
CVE: CVE-2021-35990
Published: 2021-08-20
Description: Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb21-53.html; https://helpx.adobe.com/security/products/bridge/apsb21-53.html
CVE: CVE-2021-35991
Published: 2021-08-20
Description: Adobe Bridge version 11.0.2 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information  in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-824, CWE-824
References: https://helpx.adobe.com/security/products/bridge/apsb21-53.html; https://helpx.adobe.com/security/products/bridge/apsb21-53.html
CVE: CVE-2021-35992
Published: 2021-08-20
Description: Adobe Bridge version 11.0.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/bridge/apsb21-53.html; https://helpx.adobe.com/security/products/bridge/apsb21-53.html
CVE: CVE-2021-35997
Published: 2021-08-20
Description: Adobe Premiere Pro version 15.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/premiere_pro/apsb21-56.html; https://helpx.adobe.com/security/products/premiere_pro/apsb21-56.html
CVE: CVE-2021-35999
Published: 2021-08-20
Description: Adobe Prelude version 10.0 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/prelude/apsb21-58.html; https://helpx.adobe.com/security/products/prelude/apsb21-58.html
CVE: CVE-2021-36000
Published: 2021-08-20
Description: Adobe Character Animator version 4.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/in/security/products/character_animator/apsb21-59.html; https://helpx.adobe.com/in/security/products/character_animator/apsb21-59.html
CVE: CVE-2021-36001
Published: 2021-08-20
Description: Adobe Character Animator version 4.2 (and earlier) is affected by an out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/in/security/products/character_animator/apsb21-59.html; https://helpx.adobe.com/in/security/products/character_animator/apsb21-59.html
CVE: CVE-2021-36005
Published: 2021-08-20
Description: Adobe Photoshop versions 21.2.9 (and earlier) and 22.4.2 (and earlier) is affected by a stack overflow vulnerability due to insecure handling of a crafted PSD file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted PSD file in Photoshop.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://helpx.adobe.com/security/products/photoshop/apsb21-63.html; https://helpx.adobe.com/security/products/photoshop/apsb21-63.html
CVE: CVE-2021-36006
Published: 2021-08-20
Description: Adobe Photoshop versions 21.2.9 (and earlier) and 22.4.2 (and earlier) are affected by an Improper input validation vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-20, CWE-665
References: https://helpx.adobe.com/security/products/photoshop/apsb21-63.html; https://helpx.adobe.com/security/products/photoshop/apsb21-63.html
CVE: CVE-2021-36007
Published: 2021-08-20
Description: Adobe Prelude version 10.0 (and earlier) are affected by an uninitialized variable vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-20, CWE-908
References: https://helpx.adobe.com/security/products/prelude/apsb21-58.html; https://helpx.adobe.com/security/products/prelude/apsb21-58.html
CVE: CVE-2021-36008
Published: 2021-08-20
Description: Adobe Illustrator version 25.2.3 (and earlier) is affected by an Use-after-free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/illustrator/apsb21-42.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1146/; https://helpx.adobe.com/security/products/illustrator/apsb21-42.html
CVE: CVE-2021-36009
Published: 2021-08-20
Description: Adobe Illustrator version 25.2.3 (and earlier) is affected by an memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb21-42.html; https://www.zerodayinitiative.com/advisories/ZDI-21-1147/; https://helpx.adobe.com/security/products/illustrator/apsb21-42.html
CVE: CVE-2021-36010
Published: 2021-08-20
Description: Adobe Illustrator version 25.2.3 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb21-42.html; https://helpx.adobe.com/security/products/illustrator/apsb21-42.html
CVE: CVE-2021-36011
Published: 2021-08-20
Description: Adobe Illustrator version 25.2.3 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool for JavaScript scripts. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 8.3 (HIGH)
CWE: CWE-78
References: https://helpx.adobe.com/security/products/illustrator/apsb21-42.html; https://helpx.adobe.com/security/products/illustrator/apsb21-42.html
CVE: CVE-2021-36014
Published: 2021-08-20
Description: Adobe Media Encoder version 15.2 (and earlier) is affected by an uninitialized pointer vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-20, CWE-824
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html
CVE: CVE-2021-36015
Published: 2021-08-20
Description: Adobe Media Encoder version 15.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788, CWE-787
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html
CVE: CVE-2021-36016
Published: 2021-08-20
Description: Adobe Media Encoder version 15.2 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html; https://www.zerodayinitiative.com/advisories/ZDI-21-907/; https://helpx.adobe.com/security/products/media-encoder/apsb21-43.html
CVE: CVE-2020-24130
Published: 2021-08-20
Description: A cross site request forgery (CSRF) vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and administrator credentials, and add or delete administrator accounts.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://github.com/ponzu-cms/ponzu/issues/352; https://github.com/ponzu-cms/ponzu/issues/352
CVE: CVE-2021-21826
Published: 2021-08-20
Description: A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. Within `DecodeTreeBlock` which is called during the decompression of an XMI file, a UINT32 is loaded from the file and used as trusted input as the length of a buffer. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1291; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1291
CVE: CVE-2021-21827
Published: 2021-08-20
Description: A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. Within `DecodeTreeBlock` which is called during the decompression of an XMI file, a UINT32 is loaded from the file and used as trusted input as the length of a buffer. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1291; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1291
CVE: CVE-2021-21828
Published: 2021-08-20
Description: A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. In the default case of DecodeTreeBlock a label is created via CurPath::AddLabel in order to track the label for later reference. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1291; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1291
CVE: CVE-2021-38171
Published: 2021-08-21
Description: adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a necessary step because the second argument to init_get_bits can be crafted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-252
References: https://github.com/FFmpeg/FFmpeg/commit/9ffa49496d1aae4cbbb387aac28a9e061a6ab0a6; https://lists.debian.org/debian-lts-announce/2021/11/msg00012.html; https://patchwork.ffmpeg.org/project/ffmpeg/patch/AS8P193MB12542A86E22F8207EC971930B6F19%40AS8P193MB1254.EURP193.PROD.OUTLOOK.COM/
CVE: CVE-2021-39358
Published: 2021-08-22
Description: In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/; https://gitlab.gnome.org/GNOME/libgfbgraph/-/issues/17; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GRCVZUNPTNFQQQCEZVP7RYY6OKHPDBC5/
CVE: CVE-2021-39359
Published: 2021-08-22
Description: In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/; https://github.com/GNOME/libgda/commit/bd7b9568bcd9f6d3e6680bb04323a670c842a62d; https://gitlab.gnome.org/GNOME/libgda/-/issues/249
CVE: CVE-2021-39360
Published: 2021-08-22
Description: In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/; https://gitlab.gnome.org/GNOME/libzapojit/-/issues/4; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDXCHOCVP3VSAKDBQSLER2DQHFIOUHAT/
CVE: CVE-2021-39361
Published: 2021-08-22
Description: In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/; https://gitlab.gnome.org/GNOME/evolution-rss/-/issues/11; https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/
CVE: CVE-2021-39362
Published: 2021-08-22
Description: An XSS issue was discovered in ReCaptcha Solver 5.7. A response from Anti-Captcha.com, RuCaptcha.com, 2captcha.com, DEATHbyCAPTCHA.com, ImageTyperz.com, or BestCaptchaSolver.com in setCaptchaCode() is inserted into the DOM as HTML, resulting in full control over the user's browser by these servers.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://thesamarkand.tumblr.com/post/[PII_REDACTED]14009088/xss-vulnerability-in-recaptcha-solver-by-dozz; https://thesamarkand.tumblr.com/post/[PII_REDACTED]14009088/xss-vulnerability-in-recaptcha-solver-by-dozz
CVE: CVE-2021-39365
Published: 2021-08-22
Description: In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification/; https://gitlab.gnome.org/GNOME/grilo/-/issues/146; https://lists.debian.org/debian-lts-announce/2021/09/msg00010.html