deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-36833
Published: 2023-07-14
Description: A Use After Free vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS Evolved on PTX10001-36MR, and PTX10004, PTX10008, PTX10016 with LC1201/1202 allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).

The process 'aftman-bt' will crash after multiple flaps on a multicast-only fast reroute (MoFRR) enabled interface. This will cause the respective FPC to stop forwarding traffic and it needs to be rebooted to restore the service.

An indication that the system experienced this issue is the following log message:

  <date> <hostname> evo-aftmand-bt[<pid>]: [Error] jexpr_fdb: sanity check failed, ... , app_name L3 Mcast Routes




This issue affects Juniper Networks Junos OS Evolved on PTX10001-36MR, PTX10004, PTX10008, PTX10016 with LC1201/1202:
21.2 version 21.2R1-EVO and later versions;
21.3 version 21.3R1-EVO and later versions;
21.4 versions prior to 21.4R3-S3-EVO;
22.1 version 22.1R1-EVO and later versions;
22.2 versions prior to 22.2R3-S2-EVO;
22.3 versions prior to 22.3R3-EVO;
22.4 versions prior to 22.4R1-S2-EVO, 22.4R2-EVO.




CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://supportportal.juniper.net/JSA71640; https://supportportal.juniper.net/JSA71640
CVE: CVE-2023-36838
Published: 2023-07-14
Description: An Out-of-bounds Read vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a local, authenticated attacker with low privileges, to cause a Denial of Service (DoS).

If a low privileged user executes a specific CLI command, flowd which is responsible for traffic forwarding in SRX crashes and generates a core dump. This will cause temporary traffic interruption until the flowd process is restarted automatically. Continued execution of this command will lead to a sustained DoS.

This issue affects Juniper Networks Junos OS on SRX Series:
All versions prior to 20.2R3-S7;
20.3 version 20.3R1 and later versions;
20.4 versions prior to 20.4R3-S6;
21.1 versions prior to 21.1R3-S5;
21.2 versions prior to 21.2R3-S4;
21.3 versions prior to 21.3R3-S4;
21.4 versions prior to 21.4R3-S3;
22.1 versions prior to 22.1R3-S1;
22.2 versions prior to 22.2R3;
22.3 versions prior to 22.3R2;
22.4 versions prior to 22.4R1-S1, 22.4R2.

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://supportportal.juniper.net/JSA71645; https://supportportal.juniper.net/JSA71645
CVE: CVE-2023-24896
Published: 2023-07-14
Description: Dynamics 365 Finance Spoofing Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896
CVE: CVE-2023-32759
Published: 2023-07-14
Description: An issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an authenticated attacker to obtain sensitive information via a crafted URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://www.archerirm.community/t5/product-advisories/archer-announces-availability-of-archer-release-6-13/ta-p/697821; https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/702362; https://www.archerirm.community/t5/product-advisories/archer-announces-availability-of-archer-release-6-13/ta-p/697821
CVE: CVE-2023-32760
Published: 2023-07-14
Description: An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via API calls related to data feeds and data publication.
CVSS Score: 7.7 (HIGH)
CWE: CWE-668
References: https://www.archerirm.community/t5/product-advisories/archer-announces-availability-of-archer-release-6-13/ta-p/697821; https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/702362; https://www.archerirm.community/t5/product-advisories/archer-announces-availability-of-archer-release-6-13/ta-p/697821
CVE: CVE-2023-32761
Published: 2023-07-14
Description: Cross Site Request Forgery (CSRF) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to execute arbitrary code via a crafted request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://www.archerirm.community/t5/product-advisories/archer-announces-availability-of-archer-release-6-13/ta-p/697821; https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/702362; https://www.archerirm.community/t5/product-advisories/archer-announces-availability-of-archer-release-6-13/ta-p/697821
CVE: CVE-2023-36834
Published: 2023-07-14
Description: An Incomplete Internal State Distinction vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series allows an adjacent attacker to cause a Denial of Service (DoS).

If an SRX is configured in L2 transparent mode the receipt of a specific genuine packet can cause a single Packet Processing Engines (PPE) component of the PFE to run into a loop, which in turn will render the PPE unavailable. Each packet will cause one PPE to get into a loop, leading to a gradual performance degradation until all PPEs are unavailable and all traffic processing stops. To recover the affected FPC need to be restarted.

This issue affects Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series:
20.1 version 20.1R1 and later versions;
20.2 versions prior to 20.2R3-S7;
20.3 version 20.3R1 and later versions;
20.4 versions prior to 20.4R3-S7;
21.1 versions prior to 21.1R3-S5;
21.2 versions prior to 21.2R3-S3;
21.3 versions prior to 21.3R3-S3;
21.4 versions prior to 21.4R3-S1;
22.1 versions prior to 22.1R3;
22.2 versions prior to 22.2R2;
22.3 versions prior to 22.3R1-S1, 22.3R2.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-372
References: https://supportportal.juniper.net/JSA71641; https://supportportal.juniper.net/JSA71641
CVE: CVE-2023-36835
Published: 2023-07-14
Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX10000 Series allows a network based attacker to cause a Denial of Service (DoS).

If a specific valid IP packet is received and that packet needs to be routed over a VXLAN tunnel, this will result in a PFE wedge condition due to which traffic gets impacted. As this is not a crash and restart scenario, this condition will persist until the system is rebooted to recover.

This issue affects Juniper Networks Junos OS on QFX10000:
20.3 version 20.3R1 and later versions;
20.4 versions prior to 20.4R3-S5;
21.1 versions prior to 21.1R3-S5;
21.2 versions prior to 21.2R3-S5;
21.3 versions prior to 21.3R3-S4;
21.4 versions prior to 21.4R3-S1;
22.1 versions prior to 22.1R3;
22.2 versions prior to 22.2R2;
22.3 versions prior to 22.3R1-S2, 22.3R2.

CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://supportportal.juniper.net/JSA71642; https://supportportal.juniper.net/JSA71642
CVE: CVE-2023-36836
Published: 2023-07-14
Description: A Use of an Uninitialized Resource vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial of Service (DoS).

On all Junos OS and Junos OS Evolved platforms, in a Multicast only Fast Reroute (MoFRR) scenario, the rpd process can crash when a a specific low privileged CLI command is executed. The rpd crash will impact all routing protocols until the process has automatically been restarted. As the operational state which makes this issue exploitable is outside the attackers control, this issue is considered difficult to exploit. Continued execution of this command will lead to a sustained DoS.

This issue affects:
Juniper Networks Junos OS
19.4 version 19.4R3-S5 and later versions prior to 19.4R3-S9;
20.1 version 20.1R2 and later versions;
20.2 versions prior to 20.2R3-S7;
20.3 versions prior to 20.3R3-S5;
20.4 versions prior to 20.4R3-S6;
21.1 versions prior to 21.1R3-S4;
21.2 versions prior to 21.2R3-S2;
21.3 versions prior to 21.3R3-S1;
21.4 versions prior to 21.4R3;
22.1 versions prior to 22.1R1-S2, 22.1R2;
22.2 versions prior to 22.2R2.

Juniper Networks Junos OS Evolved
All versions prior to 20.4R3-S6-EVO;
21.1-EVO version 21.1R1-EVO and later versions;
21.2-EVO version 21.2R1-EVO and later versions;
21.3-EVO versions prior to 21.3R3-S1-EVO;
21.4-EVO versions prior to 21.4R3-EVO;
22.1-EVO versions prior to 22.1R1-S2-EVO, 22.1R2-EVO;
22.2-EVO versions prior to 22.2R2-EVO.

CVSS Score: 4.7 (MEDIUM)
CWE: CWE-908
References: https://supportportal.juniper.net/JSA71643; https://supportportal.juniper.net/JSA71643
CVE: CVE-2023-36840
Published: 2023-07-14
Description: A Reachable Assertion vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a locally-based, low-privileged attacker to cause a Denial of Service (DoS).

On all Junos OS and Junos OS Evolved, when a specific L2VPN command is run, RPD will crash and restart. Continued execution of this specific command will create a sustained Denial of Service (DoS) condition.

This issue affects:
Juniper Networks Junos OS
All versions prior to 19.3R3-S10;
20.1 versions prior to 20.1R3-S4;
20.2 versions prior to 20.2R3-S6;
20.3 versions prior to 20.3R3-S6;
20.4 versions prior to 20.4R3-S5;
21.1 versions prior to 21.1R3-S4;
21.2 versions prior to 21.2R3-S3;
21.3 versions prior to 21.3R3-S2;
21.4 versions prior to 21.4R3;
22.1 versions prior to 22.1R3;
22.2 versions prior to 22.2R2;
22.3 versions prior to 22.3R2;

Juniper Networks Junos OS Evolved
All versions prior to 20.4R3-S7-EVO;
21.1 versions prior to 21.1R3-S3-EVO;
21.2 versions prior to 21.2R3-S5-EVO;
21.3 versions prior to 21.3R3-S4-EVO;
21.4 versions prior to 21.4R3-EVO;
22.1 versions prior to 22.1R3-EVO;
22.2 versions prior to 22.2R2-EVO;
22.3 versions prior to 22.3R2-EVO;

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://supportportal.juniper.net/JSA71647; https://supportportal.juniper.net/JSA71647
CVE: CVE-2023-36848
Published: 2023-07-14
Description: An Improper Handling of Undefined Values vulnerability in the periodic packet management daemon (PPMD) of Juniper Networks Junos OS on MX Series(except MPC10, MPC11 and LC9600) allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS).

When a malformed CFM packet is received, it leads to an FPC crash. Continued receipt of these packets causes a sustained denial of service. This vulnerability occurs only when CFM has been configured on the interface.

This issue affects Juniper Networks Junos OS:
versions prior to 19.1R3-S10 on MX Series;
19.2 versions prior to 19.2R3-S7 on MX Series;
19.3 versions prior to 19.3R3-S8 on MX Series;
19.4 versions prior to 19.4R3-S12 on MX Series;
20.1 version 20.1R1 and later versions on MX Series;
20.2 versions prior to 20.2R3-S8 on MX Series;
20.3 version 20.3R1 and later versions on MX Series;
20.4 versions prior to 20.4R3-S7  on MX Series;
21.1 versions prior to 21.1R3-S5 on MX Series;
21.2 versions prior to 21.2R3-S5 on MX Series;
21.3 versions prior to 21.3R3-S4 on MX Series;
21.4 versions prior to 21.4R3-S4 on MX Series;
22.1 versions prior to 22.1R3-S3 on MX Series;
22.2 versions prior to 22.2R3-S1 on MX Series;
22.3 versions prior to 22.3R3 on MX Series;
22.4 versions prior to 22.4R1-S2, 22.4R2 on MX Series.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-232
References: https://supportportal.juniper.net/JSA71659; https://supportportal.juniper.net/JSA71659
CVE: CVE-2023-36849
Published: 2023-07-14
Description: An Improper Check or Handling of Exceptional Conditions vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS).

When a malformed LLDP packet is received, l2cpd will crash and restart. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP. Also, if any services depend on LLDP state (like PoE or VoIP device recognition), then these will also be affected. Continued receipt of such packets will lead to a sustained Denial of Service.

This issue affects:
Juniper Networks Junos OS
21.4 versions prior to 21.4R3-S3;
22.1 versions prior to 22.1R3-S3;
22.2 versions prior to 22.2R2-S1, 22.2R3;
22.3 versions prior to 22.3R2.

Juniper Networks Junos OS Evolved
21.4-EVO versions prior to 21.4R3-S2-EVO;
22.1-EVO versions prior to 22.1R3-S3-EVO;
22.2-EVO versions prior to 22.2R2-S1-EVO, 22.2R3-EVO;
22.3-EVO versions prior to 22.3R2-EVO.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-703
References: https://supportportal.juniper.net/JSA71660; https://supportportal.juniper.net/JSA71660
CVE: CVE-2023-36883
Published: 2023-07-14
Description: Microsoft Edge for iOS Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36883; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36883
CVE: CVE-2023-36887
Published: 2023-07-14
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36887; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36887; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1747
CVE: CVE-2023-36888
Published: 2023-07-14
Description: Microsoft Edge for Android (Chromium-based) Tampering Vulnerability
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36888; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36888
CVE: CVE-2023-37223
Published: 2023-07-14
Description: Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated attacker to execute arbitrary code via a crafted malicious script.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://archerirm.com; https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/702362; https://archerirm.com
CVE: CVE-2023-37224
Published: 2023-07-14
Description: An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-532
References: https://archerirm.com; https://www.archerirm.community/t5/security-advisories/archer-update-for-multiple-vulnerabilities/ta-p/702362; https://archerirm.com
CVE: CVE-2023-38252
Published: 2023-07-14
Description: An out-of-bounds read flaw was found in w3m, in the Strnew_size function in Str.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/security/cve/CVE-2023-38252; https://bugzilla.redhat.com/show_bug.cgi?id=2222775; https://github.com/tats/w3m/issues/270
CVE: CVE-2023-38253
Published: 2023-07-14
Description: An out-of-bounds read flaw was found in w3m, in the growbuf_to_Str function in indep.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/security/cve/CVE-2023-38253; https://bugzilla.redhat.com/show_bug.cgi?id=2222779; https://github.com/tats/w3m/issues/271
CVE: CVE-2023-36850
Published: 2023-07-14
Description: An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Connectivity Fault Management(CFM) module of Juniper Networks Junos OS on MX Series(except MPC10, MPC11 and LC9600) allows an adjacent attacker on the local broadcast domain to cause a Denial of Service(DoS).

Upon receiving a malformed CFM packet, the MPC crashes. Continued receipt of these packets causes a sustained denial of service. This issue can only be triggered when CFM hasn't been configured.

This issue affects:
Juniper Networks Junos OS
All versions prior to 19.1R3-S10 on MX Series;
19.2 versions prior to 19.2R3-S7 on MX Series;
19.3 versions prior to 19.3R3-S8 on MX Series;
19.4 versions prior to 19.4R3-S12 on MX Series;
20.1 version 20.1R1 and later versions on MX Series;
20.2 versions prior to 20.2R3-S7 on MX Series;
20.3 version 20.3R1 and later versions on MX Series;
20.4 versions prior to 20.4R3-S7 on MX Series;
21.1 versions prior to 21.1R3-S5 on MX Series;
21.2 versions prior to 21.2R3-S4 on MX Series;
21.3 versions prior to 21.3R3-S4 on MX Series;
21.4 versions prior to 21.4R3-S3 on MX Series;
22.1 versions prior to 22.1R3-S2 on MX Series;
22.2 versions prior to 22.2R3 on MX Series;
22.3 versions prior to 22.3R2, 22.3R3 on MX Series;
22.4 versions prior to 22.4R2 on MX Series.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1285
References: https://supportportal.juniper.net/JSA71661; https://supportportal.juniper.net/JSA71661
CVE: CVE-2023-37474
Published: 2023-07-14
Description: Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/173822/Copyparty-1.8.2-Directory-Traversal.html; https://github.com/9001/copyparty/commit/043e3c7dd683113e2b1c15cacb9c8e68f76513ff; https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg
CVE: CVE-2023-38325
Published: 2023-07-14
Description: The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://github.com/pyca/cryptography/compare/41.0.1...41.0.2; https://github.com/pyca/cryptography/issues/9207; https://github.com/pyca/cryptography/pull/9208
CVE: CVE-2023-3633
Published: 2023-07-14
Description: An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://www.bitdefender.com/support/security-advisories/out-of-bounds-memory-corruption-issue-in-ceva-engine-va-11010; https://www.bitdefender.com/support/security-advisories/out-of-bounds-memory-corruption-issue-in-ceva-engine-va-11010
CVE: CVE-2023-37462
Published: 2023-07-14
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-74, CWE-95
References: https://github.com/xwiki/xwiki-platform/commit/d9c88ddc4c0c78fa534bd33237e95dea66003d29; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4vp-69r8-gvjg; https://jira.xwiki.org/browse/XWIKI-20457
CVE: CVE-2023-37464
Published: 2023-07-14
Description: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec  says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).
CVSS Score: 8.6 (HIGH)
CWE: CWE-327
References: https://datatracker.ietf.org/doc/html/rfc7518#section-4.7; https://github.com/OpenIDC/cjose/commit/7325e9a5e71e2fc0e350487ecac7d84acdf0ed5e; https://github.com/OpenIDC/cjose/releases/tag/v0.6.2.2
CVE: CVE-2023-37472
Published: 2023-07-14
Description: Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior sanitization. An attacker can create specially crafted HQL queries that will break subsequent SQL queries generated by the Hibernate engine. The endpoint `_/knowage/restful-services/2.0/documents/listDocument_` calls the `_countBIObjects_` method of the `_BIObjectDAOHibImpl_` object with the user supplied `_label_` parameter without prior sanitization. This can lead to SQL injection in the backing database. Other injections have been identified in the application as well. An authenticated attacker with low privileges could leverage this vulnerability in order to retrieve sensitive information from the database, such as account credentials or business information. This issue has been addressed in version 8.1.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89
References: https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-2j3f-f696-7rgj; https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-2j3f-f696-7rgj
CVE: CVE-2023-37473
Published: 2023-07-14
Description: zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.
CVSS Score: 8.5 (HIGH)
CWE: CWE-74
References: https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c; https://github.com/zenstruck/collection/releases/tag/v0.2.1; https://github.com/zenstruck/collection/security/advisories/GHSA-7xr2-8ff7-6fjq