deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33653
Published: 2022-06-27
Description: When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter block_shape element, it will cause a division by 0 exception.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369, CWE-369
References: https://gitee.com/mindspore/community/blob/master/security/security_advisory_list/mssa-2021-002_en.md; https://gitee.com/mindspore/community/blob/master/security/security_advisory_list/mssa-2021-002_en.md
CVE: CVE-2021-33654
Published: 2022-06-27
Description: When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369, CWE-369
References: https://gitee.com/mindspore/community/blob/master/security/security_advisory_list/mssa-2021-001_en.md; https://gitee.com/mindspore/community/blob/master/security/security_advisory_list/mssa-2021-001_en.md
CVE: CVE-2022-2088
Published: 2022-06-27
Description: An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-05
CVE: CVE-2022-2106
Published: 2022-06-27
Description: Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.
CVSS Score: 3.8 (LOW)
CWE: CWE-23, CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-05
CVE: CVE-2022-2140
Published: 2022-06-27
Description: Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-05
CVE: CVE-2021-40941
Published: 2022-06-27
Description: In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity in Ap4Array.h:172, as demonstrated by GPAC. This can cause a denial of service (DOS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/644; https://github.com/axiomatic-systems/Bento4/issues/644
CVE: CVE-2022-26477
Published: 2022-06-27
Description: The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a "low-priority but useful improvement". SystemDS is a distributed system and needs to serialize/deserialize data but in many code paths (e.g., on Spark broadcast/shuffle or writing to sequence files) the byte stream is anyway protected by additional CRC fingerprints. In this particular case though, the number of decoders is upper-bounded by twice the number of columns, which means an attacker would need to modify two entries in the byte stream in a consistent manner. By adding these checks robustness was strictly improved with almost zero overhead. These code changes are available in versions higher than 2.2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://lists.apache.org/thread/r4x2d2r6d4zykdrrx6s2l4qbxgzws0z3; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://lists.apache.org/thread/r4x2d2r6d4zykdrrx6s2l4qbxgzws0z3
CVE: CVE-2022-28166
Published: 2022-06-27
Description: In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ssl-static-key-ciphers) on ports 443 & 18082.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1977; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-28167
Published: 2022-06-27
Description: Brocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade Fabric OS switch password in plain text in asyncjobscheduler-manager.log
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1978; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-28168
Published: 2022-06-27
Description: In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an attacker able to access log files to easily decode the passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1979; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-28171
Published: 2022-06-27
Description: The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-77
References: http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html; http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/
CVE: CVE-2022-28172
Published: 2022-06-27
Description: The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html; https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/; http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html
CVE: CVE-2017-20098
Published: 2022-06-27
Description: A vulnerability was found in Admin Custom Login Plugin 2.4.5.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Feb/75; https://vuldb.com/?id.97368; http://seclists.org/fulldisclosure/2017/Feb/75
CVE: CVE-2017-20099
Published: 2022-06-27
Description: A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94, CWE-94
References: http://seclists.org/fulldisclosure/2017/Feb/74; https://vuldb.com/?id.97367; http://seclists.org/fulldisclosure/2017/Feb/74
CVE: CVE-2022-28622
Published: 2022-06-27
Description: A potential security vulnerability has been identified in HPE StoreOnce Software. The SSH server supports weak key exchange algorithms which could lead to remote unauthorized access. HPE has made the following software update to resolve the vulnerability in HPE StoreOnce Software 4.3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04311en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04311en_us
CVE: CVE-2022-2221
Published: 2022-06-27
Description: Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentials of other users. This issue affects: Devolutions Remote Desktop Manager versions prior to 2022.1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-522
References: https://devolutions.net/security/advisories/DEVO-2022-0004; https://devolutions.net/security/advisories/DEVO-2022-0004
CVE: CVE-2022-31034
Published: 2022-06-27
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows. In each case, using a relatively-predictable (time-based) seed in a non-cryptographically-secure pseudo-random number generator made the parameter less random than required by the relevant spec or by general best practices. In some cases, using too short a value made the entropy even less sufficient. The attacks on login flows which are meant to be mitigated by these parameters are difficult to accomplish but can have a high impact potentially granting an attacker admin access to Argo CD. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. There are no known workarounds for this vulnerability.
CVSS Score: 8.3 (HIGH)
CWE: CWE-330, CWE-331, CWE-335
References: https://github.com/argoproj/argo-cd/commit/17f7f4f462bdb233e1b9b36f67099f41052d8cb0; https://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v; https://github.com/argoproj/argo-cd/commit/17f7f4f462bdb233e1b9b36f67099f41052d8cb0
CVE: CVE-2022-31035
Published: 2022-06-27
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a `javascript:` link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin). The script would be capable of doing anything which is possible in the UI or via the API, such as creating, modifying, and deleting Kubernetes resources. A patch for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. There are no completely-safe workarounds besides upgrading.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://argo-cd.readthedocs.io/en/stable/user-guide/external-url/; https://github.com/argoproj/argo-cd/commit/8bc3ef690de29c68a36f[PII_REDACTED]46a44d4038; https://github.com/argoproj/argo-cd/security/advisories/GHSA-h4w9-6x78-8vrj
CVE: CVE-2022-31036
Published: 2022-06-27
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file. Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server. Patches for this vulnerability has been released in the following Argo CD versions: v2.4.1, v2.3.5, v2.2.10 and v2.1.16. If you are using a version >=v2.3.0 and do not have any Helm-type Applications you may disable the Helm config management tool as a workaround.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-61, CWE-59
References: https://github.com/argoproj/argo-cd/commit/04c[PII_REDACTED]08a31d03d44afea07b1c620d7cd; https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm; https://github.com/argoproj/argo-cd/commit/04c[PII_REDACTED]08a31d03d44afea07b1c620d7cd
CVE: CVE-2022-31039
Published: 2022-06-27
Description: Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in release version 2.12.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269, CWE-863
References: https://github.com/bigbluebutton/greenlight/pull/3508; https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498; https://github.com/bigbluebutton/greenlight/pull/3508
CVE: CVE-2022-31057
Published: 2022-06-27
Description: Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022; https://github.com/shopware/shopware/commit/3e025a0a3e123f[PII_REDACTED]b1ced6fb548f7b6f; https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj
CVE: CVE-2022-31064
Published: 2022-06-27
Description: BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/167682/BigBlueButton-2.3-2.4.7-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2022/Jun/52; https://github.com/bigbluebutton/bigbluebutton/pull/15067
CVE: CVE-2022-31065
Published: 2022-06-27
Description: BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker (whose username contains malicious JavaScript), the script gets executed. Additionally when the victim receives a notification that the attacker has left the session. This issue has been patched in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigbluebutton/bigbluebutton/pull/15087; https://github.com/bigbluebutton/bigbluebutton/pull/15090; https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8m2p-7qv3-qff7
CVE: CVE-2022-31076
Published: 2022-06-27
Description: KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message can crash CloudCore by triggering a nil-pointer dereference in the UDS Server. Since the UDS Server only communicates with the CSI Driver on the cloud side, the attack is limited to the local host network. As such, an attacker would already need to be an authenticated user of the Cloud. Additionally it will be affected only when users turn on the unixsocket switch in the config file cloudcore.yaml. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. Users unable to upgrade should sisable the unixsocket switch of CloudHub in the config file cloudcore.yaml.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-476
References: https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe[PII_REDACTED]; https://github.com/kubeedge/kubeedge/security/advisories/GHSA-8f4f-v9x5-cg6j; https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe[PII_REDACTED]
CVE: CVE-2021-40942
Published: 2022-06-27
Description: In GPAC MP4Box v1.1.0, there is a heap-buffer-overflow in the function filter_parse_dyn_args function in filter_core/filter.c:1454, as demonstrated by GPAC. This can cause a denial of service (DOS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/1908; https://github.com/gpac/gpac/issues/1908
CVE: CVE-2022-31077
Published: 2022-06-27
Description: KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-476
References: https://github.com/kubeedge/kubeedge/pull/3899; https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe[PII_REDACTED]; https://github.com/kubeedge/kubeedge/security/advisories/GHSA-x938-fvfw-7jh5
CVE: CVE-2022-31081
Published: 2022-06-27
Description: HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected.
CVSS Score: 7.3 (HIGH)
CWE: CWE-444
References: http://metacpan.org/release/HTTP-Daemon/; https://cwe.mitre.org/data/definitions/444.html; https://datatracker.ietf.org/doc/html/rfc7230#section-9.5
CVE: CVE-2022-31082
Published: 2022-06-27
Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/glpi-project/glpi-inventory-plugin/commit/0b805ca6fb2a0f9bde4af29fca4f703fdfbd8f66; https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-q6m7-h6rj-5wmw; https://github.com/glpi-project/glpi-inventory-plugin/commit/0b805ca6fb2a0f9bde4af29fca4f703fdfbd8f66
CVE: CVE-2022-31084
Published: 2022-06-27
Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4; https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-r387-grjx-qgvw; https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/
CVE: CVE-2022-31085
Published: 2022-06-27
Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-311, CWE-522
References: https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4; https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-6m3q-5c84-6h6j; https://www.debian.org/security/2022/dsa-5177
CVE: CVE-2022-31086
Published: 2022-06-27
Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-434
References: https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4; https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q9pc-x84w-982x; https://www.debian.org/security/2022/dsa-5177
CVE: CVE-2022-31087
Published: 2022-06-27
Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP scripts in (/var/lib/ldap-account-manager/)tmp directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-74, CWE-863
References: https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4; https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q8g5-45m4-q95p; https://www.debian.org/security/2022/dsa-5177
CVE: CVE-2022-31088
Published: 2022-06-27
Description: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4; https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-wxf8-9x99-6gp4; https://www.debian.org/security/2022/dsa-5177