deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1375
Published: 2022-05-02
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-1376
Published: 2022-05-02
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_privgrpHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-1377
Published: 2022-05-02
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-1378
Published: 2022-05-02
Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE: CVE-2022-1475
Published: 2022-05-02
Description: An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a specially crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=2076764; https://security.gentoo.org/glsa/202312-14; https://trac.ffmpeg.org/ticket/9651
CVE: CVE-2022-1515
Published: 2022-05-02
Description: A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially result in DoS.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=2079986; https://github.com/tbeu/matio/issues/186; https://bugzilla.redhat.com/show_bug.cgi?id=2079986
CVE: CVE-2022-26325
Published: 2022-05-02
Description: Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2
CVSS Score: 2.9 (LOW)
CWE: CWE-79, CWE-79
References: https://www.microfocus.com/documentation/access-manager/5.0/accessmanager502-release-notes/accessmanager502-release-notes.html#t4f2msu33v8h; https://www.microfocus.com/documentation/access-manager/5.0/accessmanager502-release-notes/accessmanager502-release-notes.html#t4f2msu33v8h
CVE: CVE-2022-26326
Published: 2022-05-02
Description: Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.microfocus.com/documentation/access-manager/5.0/accessmanager502-release-notes/accessmanager502-release-notes.html#t4f2msu33v8h; https://www.microfocus.com/documentation/access-manager/5.0/accessmanager502-release-notes/accessmanager502-release-notes.html#t4f2msu33v8h
CVE: CVE-2022-28613
Published: 2022-05-02
Description: A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the receiving RTU500 CMU to reboot. The vulnerability is caused by the validation error in the length information carried in MBAP header in the HCI Modbus TCP function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284, CWE-1284
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000103&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000103&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-36844
Published: 2022-05-02
Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin <= 1.2.12 on WordPress.
CVSS Score: 3.4 (LOW)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-subscribe/wordpress-wp-subscribe-plugin-1-2-12-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/wp-subscribe/#developers; https://patchstack.com/database/vulnerability/wp-subscribe/wordpress-wp-subscribe-plugin-1-2-12-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-41810
Published: 2022-05-02
Description: Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://empower.m-files.com/security-advisories/CVE-2021-41810; https://product.m-files.com/security-advisories/cve-2021-41810/; https://www.m-files.com/about/trust-center/security-advisories/cve-2021-41810/
CVE: CVE-2022-29444
Published: 2022-05-02
Description: Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-264
References: https://patchstack.com/database/vulnerability/breeze/wordpress-breeze-plugin-2-0-2-plugin-settings-change-leading-to-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/breeze/#developers; https://patchstack.com/database/vulnerability/breeze/wordpress-breeze-plugin-2-0-2-plugin-settings-change-leading-to-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-23722
Published: 2022-05-02
Description: When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-288, CWE-287
References: https://docs.pingidentity.com/bundle/pingfederate-110/page/spk[PII_REDACTED]08.html; https://www.pingidentity.com/en/resources/downloads/pingfederate.html; https://docs.pingidentity.com/bundle/pingfederate-110/page/spk[PII_REDACTED]08.html
CVE: CVE-2022-23723
Published: 2022-05-02
Description: An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.
CVSS Score: 7.7 (HIGH)
CWE: CWE-288, CWE-287
References: https://docs.pingidentity.com/bundle/pingfederate-pingone-mfa-ik/page/wpt[PII_REDACTED]02.html; https://www.pingidentity.com/en/resources/downloads/pingfederate.html; https://docs.pingidentity.com/bundle/pingfederate-pingone-mfa-ik/page/wpt[PII_REDACTED]02.html
CVE: CVE-2022-24897
Published: 2022-05-02
Description: APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. The problem has been patched in versions 12.6.7, 12.10.3, and 13.0. There is no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/xwiki/xwiki-commons/commit/215951cfb0f808d0bf5b1097c9e7d1e503449ab8; https://github.com/xwiki/xwiki-commons/pull/127; https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-cvx5-m8vg-vxgc
CVE: CVE-2020-23617
Published: 2022-05-02
Description: A cross site scripting (XSS) vulnerability in the error page of Totolink N200RE and N100RE Routers 2.0 allows attackers to execute arbitrary web scripts or HTML via SCRIPT element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://totolink.net/; https://gist.github.com/fuzzKitty/8ca[PII_REDACTED]e94e5c0aedf346c18b1; http://totolink.net/
CVE: CVE-2020-23618
Published: 2022-05-02
Description: A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the error page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.xtendtech.com/voicelogger/index.htm; https://gist.github.com/fuzzKitty/3f62b37b8fc44ee996d3f07442f9a3a2; http://www.xtendtech.com/voicelogger/index.htm
CVE: CVE-2020-23620
Published: 2022-05-02
Description: The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://gist.github.com/fuzzKitty/95106430aa09760ebdcfa6304777f31f; https://github.com/joaomatosf/jexboss; https://orlansoft.com/
CVE: CVE-2020-23621
Published: 2022-05-02
Description: The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://gist.github.com/fuzzKitty/dd1c6fac4f36e70ea[PII_REDACTED]6aaea; https://github.com/joaomatosf/jexboss; https://www.squire-technologies.co.uk/
CVE: CVE-2021-42528
Published: 2022-05-02
Description: XMP Toolkit 2021.07 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html; https://lists.debian.org/debian-lts-announce/2023/09/msg00032.html; https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html
CVE: CVE-2021-42529
Published: 2022-05-02
Description: XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html; https://lists.debian.org/debian-lts-announce/2023/09/msg00032.html; https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html
CVE: CVE-2021-42530
Published: 2022-05-02
Description: XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html; https://lists.debian.org/debian-lts-announce/2023/09/msg00032.html; https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html
CVE: CVE-2021-42531
Published: 2022-05-02
Description: XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html; https://lists.debian.org/debian-lts-announce/2023/09/msg00032.html; https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html
CVE: CVE-2021-42532
Published: 2022-05-02
Description: XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html; https://lists.debian.org/debian-lts-announce/2023/09/msg00032.html; https://helpx.adobe.com/security/products/xmpcore/apsb21-108.html
CVE: CVE-2021-4138
Published: 2022-05-02
Description: Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.
CVSS Score: 5.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1652612; https://github.com/mozilla/geckodriver/releases/tag/v0.30.0; https://bugzilla.mozilla.org/show_bug.cgi?id=1652612
CVE: CVE-2022-24974
Published: 2022-05-02
Description: Links may not be rewritten according to policy in some specially formatted emails.
CVSS Score: 5.3 (MEDIUM)
References: https://www.menlosecurity.com/published-security-vulnerabilities/; https://www.menlosecurity.com/published-security-vulnerabilities/
CVE: CVE-2022-28118
Published: 2022-05-03
Description: SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.
CVSS Score: 9.8 (CRITICAL)
References: http://siteserver.com; https://github.com/Richard-Tang/SSCMS-PluginShell/blob/main/Detail.md; https://github.com/siteserver/cms
CVE: CVE-2022-29824
Published: 2022-05-03
Description: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: http://packetstormsecurity.com/files/167345/libxml2-xmlBufAdd-Heap-Buffer-Overflow.html; http://packetstormsecurity.com/files/169825/libxml2-xmlParseNameComplex-Integer-Overflow.html; https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab
CVE: CVE-2022-20627
Published: 2022-05-03
Description: Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-qXz4uAkM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-qXz4uAkM
CVE: CVE-2022-20628
Published: 2022-05-03
Description: Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-qXz4uAkM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-qXz4uAkM
CVE: CVE-2022-20629
Published: 2022-05-03
Description: Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-qXz4uAkM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-qXz4uAkM
CVE: CVE-2022-20715
Published: 2022-05-03
Description: A vulnerability in the remote access SSL VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation of errors that are logged as a result of client connections that are made using remote access VPN. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to cause the affected device to restart, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-399, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-dos-tL4uA4AA; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-dos-tL4uA4AA
CVE: CVE-2022-20729
Published: 2022-05-03
Description: A vulnerability in CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands. A successful exploit could allow the attacker to inject XML into the command parser, which could result in unexpected processing of the command and unexpected command output.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-91, CWE-91
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-xmlinj-8GWjGzKe; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-xmlinj-8GWjGzKe
CVE: CVE-2022-20730
Published: 2022-05-03
Description: A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed. This vulnerability is due to incorrect feed update processing. An attacker could exploit this vulnerability by sending traffic through an affected device that should be blocked by the affected device. A successful exploit could allow the attacker to bypass device controls and successfully send traffic to devices that are expected to be protected by the affected device.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-241
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-sidns-bypass-3PzA5pO; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-sidns-bypass-3PzA5pO
CVE: CVE-2022-20737
Published: 2022-05-03
Description: A vulnerability in the handler for HTTP authentication for resources accessed through the Clientless SSL VPN portal of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device or to obtain portions of process memory from an affected device. This vulnerability is due to insufficient bounds checking when parsing specific HTTP authentication messages. An attacker could exploit this vulnerability by sending malicious traffic to an affected device acting as a VPN Gateway. To send this malicious traffic, an attacker would need to control a web server that can be accessed through the Clientless SSL VPN portal. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition, or to retrieve bytes from the device process memory that may contain sensitive information.
CVSS Score: 8.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-vpn-heap-zLX3FdX; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-vpn-heap-zLX3FdX
CVE: CVE-2022-20740
Published: 2022-05-03
Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-SfpEcvGT; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-SfpEcvGT
CVE: CVE-2022-20742
Published: 2022-05-03
Description: A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. This vulnerability is due to an improper implementation of Galois/Counter Mode (GCM) ciphers. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a sufficient number of encrypted messages across an affected IPsec IKEv2 VPN tunnel and then using cryptanalytic techniques to break the encryption. A successful exploit could allow the attacker to decrypt, read, modify, and re-encrypt data that is transmitted across an affected IPsec IKEv2 VPN tunnel.
CVSS Score: 7.4 (HIGH)
CWE: CWE-325
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ipsec-mitm-CKnLr4; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ipsec-mitm-CKnLr4