deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-12497
Published: 2019-06-17
Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. In the customer or external frontend, personal information of agents (e.g., Name and mail address) can be disclosed in external notes.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2019-12549
Published: 2019-06-17
Description: WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cert.vde.com/en-us/advisories/vde-2019-013; https://ics-cert.us-cert.gov/advisories/ICSA-19-164-02; https://www.wago.com/us/
CVE: CVE-2019-12550
Published: 2019-06-17
Description: WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cert.vde.com/en-us/advisories/vde-2019-013; https://ics-cert.us-cert.gov/advisories/ICSA-19-164-02; https://www.wago.com/us/
CVE: CVE-2019-12789
Published: 2019-06-17
Description: An issue was discovered on Actiontec T2200H T2200H-31.128L.08 devices, as distributed by Telus. By attaching a UART adapter to the UART pins on the system board, an attacker can use a special key sequence (Ctrl-\) to obtain a shell with root privileges. After gaining root access, the attacker can mount the filesystem read-write and make permanent modifications to the device including bricking of the device, disabling vendor management of the device, preventing automatic upgrades, and permanently installing malicious code on the device.
CVSS Score: 6.8 (MEDIUM)
References: http://seclists.org/fulldisclosure/2019/Jun/10; https://www.actiontec.com/blog/; http://seclists.org/fulldisclosure/2019/Jun/10
CVE: CVE-2017-9381
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on the device using the web management interface. It seems that the device does not implement any cross-site request forgery protection mechanism which allows an attacker to trick a user who navigates to an attacker controlled page to install or delete an application on the device. Note: The cross-site request forgery is a systemic issue across all other functionalities of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-9384
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as relay.sh which allows the device to create relay ports and connect the device to Vera servers. This is primarily used as a method of communication between the device and Vera servers so the devices can be communicated with even when the user is not at home. One of the parameters retrieved by this specific script is "remote_host". This parameter is not sanitized by the script correctly and is passed in a call to "eval" to execute another script where remote_host is concatenated to be passed a parameter to the second script. This allows an attacker to escape from the executed command and then execute any commands of his/her choice.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2019-10997
Published: 2019-06-17
Description: An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Protocol Fuzzing on PC WORX Engineer by a man in the middle attacker stops the PLC service. The device must be rebooted, or the PLC service must be restarted manually via a Linux shell.
CVSS Score: 5.9 (MEDIUM)
References: https://dam-mdc.phoenixcontact.com/asset/[PII_REDACTED]4/fa7be4d04c301f18c6cc0e0872193a42/Security_Advisory_AXC_F_2152_FW.pdf; https://dam-mdc.phoenixcontact.com/asset/[PII_REDACTED]4/fa7be4d04c301f18c6cc0e0872193a42/Security_Advisory_AXC_F_2152_FW.pdf
CVE: CVE-2019-11407
Published: 2019-06-17
Description: app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which allows authenticated administrative attackers to obtain credentials and other sensitive information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200
References: https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html; https://github.com/fusionpbx/fusionpbx/commit/f38676b7b63bb1ec3a68d577fe23e6701f482aef; https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html
CVE: CVE-2019-11408
Published: 2019-06-17
Description: XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placing a phone call using a specially crafted caller ID number. This can further lead to remote code execution by chaining this vulnerability with a command injection vulnerability also present in FusionPBX.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.html; https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html; https://github.com/fusionpbx/fusionpbx/commit/391a23d070f3036d0c7760992f6970b0a76ee4d7
CVE: CVE-2019-12248
Published: 2019-06-17
Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. An attacker could send a malicious email to an OTRS system. If a logged-in agent user quotes it, the email could cause the browser to load external image resources.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2019-12476
Published: 2019-06-17
Description: An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-640
References: http://www.securityfocus.com/bid/108813; https://gist.github.com/0katz/54167ba30ea361f3776e269bb7b1afb3; https://github.com/0katz/CVE-2019-12476
CVE: CVE-2019-12801
Published: 2019-06-17
Description: out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153384/SeedDMS-out.GroupMgr.php-Cross-Site-Scripting.html; https://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG; http://packetstormsecurity.com/files/153384/SeedDMS-out.GroupMgr.php-Cross-Site-Scripting.html
CVE: CVE-2019-11409
Published: 2019-06-17
Description: app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.html; http://packetstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.html; https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html
CVE: CVE-2019-11410
Published: 2019-06-17
Description: app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute commands on the host.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html; https://github.com/fusionpbx/fusionpbx/commit/0f965c89288de449236ad6de4f97960814ce8c84; https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html
CVE: CVE-2019-7315
Published: 2019-06-17
Description: Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interface, as demonstrated by reading /etc/shadow. NOTE: this product is discontinued, and its final firmware version has this vulnerability (4.x versions exist only for other Genie Access products).
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://labs.nettitude.com/blog/cve-2019-7315-genie-access-wip3bvaf-ip-camera-directory-traversal/; https://labs.nettitude.com/blog/cve-2019-7315-genie-access-wip3bvaf-ip-camera-directory-traversal/
CVE: CVE-2019-7579
Published: 2019-06-17
Description: An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dynamic/js/setup.js.localized file on the router's webserver, allowing for an attacker to identify possible passwords that the system uses to set the default guest network password. An attacker can use this list of 30 words along with a random 2 digit number to brute force their access onto a router's guest network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.x0rsecurity.com/2019/06/09/my-second-cve-linksys-wrt-acs-cve-2019-7579-or-as-i-call-it-acceptance-no-one-considers-security-by-design/; https://robot-security.blogspot.com; http://www.x0rsecurity.com/2019/06/09/my-second-cve-linksys-wrt-acs-cve-2019-7579-or-as-i-call-it-acceptance-no-one-considers-security-by-design/
CVE: CVE-2019-8324
Published: 2019-06-17
Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; https://access.redhat.com/errata/RHSA-2019:1972; https://hackerone.com/reports/328571
CVE: CVE-2019-8325
Published: 2019-06-17
Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; https://hackerone.com/reports/317353; https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
CVE: CVE-2017-9382
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "file" as one of the service actions for a normal user to read a file that is stored under the /etc/cmh-lu folder. It retrieves the value from the "parameters" query string variable and then passes it to an internal function "FileUtils::ReadFileIntoBuffer" which is a library function that does not perform any sanitization on the value submitted and this allows an attacker to use directory traversal characters "../" and read files from other folders within the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-9383
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "wget" as one of the service actions for a normal user to connect the device to an external website. It retrieves the parameter "URL" from the query string and then passes it to an internal function that uses the curl module on the device to retrieve the contents of the website.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-9385
Published: 2019-06-17
Description: An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the /etc/cmh/cmh.conf file which can be extracted by an attacker using a directory traversal attack, and then log in to the device with the highest privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-9386
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "get_file.sh" which allows a user to retrieve any file stored in the "cmh-ext" folder on the device. However, the "filename" parameter is not validated correctly and this allows an attacker to directory traverse outside the /cmh-ext folder and read any file on the device. It is necessary to create the folder "cmh-ext" on the device which can be executed by an attacker first in an unauthenticated fashion and then execute a directory traversal attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-9387
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called relay.sh which is used for creating new SSH relays for the device so that the device connects to Vera servers. All the parameters passed in this specific script are logged to a log file called log.relay in the /tmp folder. The user can also read all the log files from the device using a script called log.sh. However, when the script loads the log files it displays them with content-type text/html and passes all the logs through the ansi2html binary which converts all the character text including HTML meta-characters correctly to be displayed in the browser. This allows an attacker to use the log files as a storing mechanism for the XSS payload and thus whenever a user navigates to that log.sh script, it enables the XSS payload and allows an attacker to execute his malicious payload on the user's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf
CVE: CVE-2017-9389
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device allows a user to install applications written in the Lua programming language. Also the interface allows any user to write his/her application in the Lua language. However, this functionality is not protected by authentication and this allows an attacker to run arbitrary Lua code on the device. The POST request is forwarded to LuaUPNP daemon on the device. This binary handles the received Lua code in the function "LU::JobHandler_LuaUPnP::RunLua(LU::JobHandler_LuaUPnP *__hidden this, LU::UPnPActionWrapper *)". The value in the "code" parameter is then passed to the function "LU::LuaInterface::RunCode(char const*)" which actually loads the Lua engine and runs the code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2017-9390
Published: 2019-06-17
Description: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called connect.sh which is supposed to return a specific cookie for the user when the user is authenticated to https://home.getvera.com. One of the parameters retrieved by this script is "RedirectURL". However, the application lacks strict input validation of this parameter and this allows an attacker to execute the client-side code on this application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html; https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-19146
Published: 2019-06-17
Description: Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/concrete5?view_policy=true; https://hackerone.com/reports/437863; https://www.concrete5.org/
CVE: CVE-2018-19444
Published: 2019-06-17
Description: A use after free in the TextBox field Validate action in IReader_ContentProvider can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19452, this has a different free location and requires different JavaScript code for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-19445
Published: 2019-06-17
Description: A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API app.launchURL is used. An attacker can leverage this to gain remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-19446
Published: 2019-06-17
Description: A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.createDataObject is used. An attacker can leverage this to gain remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-19447
Published: 2019-06-17
Description: A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing the URI string. An attacker can leverage this to gain remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-19448
Published: 2019-06-17
Description: In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, an uninitialized object in IReader_ContentProvider::GetDocEventHandler occurs when embedding the control into Office documents. By opening a specially crafted document, an attacker can trigger an out of bounds write condition, possibly leveraging this to gain remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-19449
Published: 2019-06-17
Description: A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.exportAsFDF is used. An attacker can leverage this to gain remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2018-19450
Published: 2019-06-17
Description: A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing a launch action. An attacker can leverage this to gain remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2019-7158
Published: 2019-06-17
Description: OX App Suite 7.10.0 and earlier has Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
References: https://www.open-xchange.com/; https://www.open-xchange.com/
CVE: CVE-2019-8321
Published: 2019-06-17
Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
CVSS Score: 7.5 (HIGH)
CWE: CWE-88
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; https://hackerone.com/reports/317330; https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
CVE: CVE-2019-8322
Published: 2019-06-17
Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; https://hackerone.com/reports/315087; https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
CVE: CVE-2019-8323
Published: 2019-06-17
Description: An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html; https://hackerone.com/reports/315081; https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html