deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-20335
Published: 2022-08-12
Description: In Wifi Slice, there is a possible way to adjust Wi-Fi settings even when the permission has been disabled due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-178014725
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20336
Published: 2022-08-12
Description: In Settings, there is a possible installed application disclosure due to a missing permission check. This could lead to local information disclosure of applications allow-listed to use the network during VPN lockdown mode with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-177239688
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20338
Published: 2022-08-12
Description: In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to a local escalation of privilege, preventing processes from validating URIs correctly, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-171966843
CVSS Score: 3.3 (LOW)
CWE: CWE-20, CWE-20
References: https://source.android.com/security/bulletin/2023-05-01; https://source.android.com/security/bulletin/2023-05-01
CVE: CVE-2022-20339
Published: 2022-08-12
Description: In Android, there is a possible access of network neighbor table information due to an insecure SEpolicy configuration. This could lead to local information disclosure of network topography with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-171572148
CVSS Score: 3.3 (LOW)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20340
Published: 2022-08-12
Description: In SELinux policy, there is a possible way of inferring which websites are being opened in the browser due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-166269532
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20341
Published: 2022-08-12
Description: In ConnectivityService, there is a possible bypass of network permissions due to a missing permission check. This could lead to local information disclosure of tethering interfaces with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-162952629
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20342
Published: 2022-08-12
Description: In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-143534321
CVSS Score: 3.3 (LOW)
CWE: CWE-1188
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20362
Published: 2022-08-12
Description: In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230756082
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-28626
Published: 2022-08-12
Description: A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 6.7 (MEDIUM)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28627
Published: 2022-08-12
Description: A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 8.4 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28628
Published: 2022-08-12
Description: A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 8.4 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28629
Published: 2022-08-12
Description: A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A low privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 7.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28630
Published: 2022-08-12
Description: A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality and integrity, and a partial loss of availability. User interaction is required to exploit this vulnerability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 7.3 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28631
Published: 2022-08-12
Description: A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could exploit this vulnerability in an adjacent network to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within that process. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 8.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28632
Published: 2022-08-12
Description: A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could exploit this vulnerability in an adjacent network to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within that process. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 8.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28633
Published: 2022-08-12
Description: A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file system resulting in a complete loss of confidentiality and a partial loss of integrity and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 7.3 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28634
Published: 2022-08-12
Description: A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 6.7 (MEDIUM)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28635
Published: 2022-08-12
Description: A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within that process. A successful attack depends on conditions beyond the attackers control. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 7.4 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-28636
Published: 2022-08-12
Description: A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to potentially execute arbitrary code in an isolated process resulting in a complete loss of confidentiality, integrity, and availability within that process. In addition, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process resulting in a complete loss of availability within that process. A successful attack depends on conditions beyond the attackers control. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
CVSS Score: 7.4 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us
CVE: CVE-2022-35555
Published: 2022-08-12
Description: A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to construct cmdinput parameters for arbitrary command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/ilovekeer/IOT/blob/main/Tenda/W6/Injection/exeCommand/README.md; https://github.com/ilovekeer/IOT/blob/main/Tenda/W6/Injection/exeCommand/README.md
CVE: CVE-2022-35557
Published: 2022-08-12
Description: A stack overflow vulnerability exists in /goform/wifiSSIDget in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/wifiSSIDget; https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/wifiSSIDget
CVE: CVE-2022-35558
Published: 2022-08-12
Description: A stack overflow vulnerability exists in /goform/WifiMacFilterGet in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/WifiMacFilterGet; https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/WifiMacFilterGet
CVE: CVE-2022-35559
Published: 2022-08-12
Description: A stack overflow vulnerability exists in /goform/setAutoPing in Tenda W6 V1.0.0.9(4122), which allows an attacker to construct ping1 parameters and ping2 parameters for a stack overflow attack. An attacker can use this vulnerability to execute arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/formSetAutoPing; https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/formSetAutoPing
CVE: CVE-2022-35560
Published: 2022-08-12
Description: A stack overflow vulnerability exists in /goform/wifiSSIDset in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/wifiSSIDset; https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/wifiSSIDset
CVE: CVE-2022-35561
Published: 2022-08-12
Description: A stack overflow vulnerability exists in /goform/WifiMacFilterSet in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/WifiMacFilterSet; https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/WifiMacFilterSet
CVE: CVE-2022-37041
Published: 2022-08-12
Description: An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of hosts that ZCS is allowed to proxy to (the zimbraProxyAllowedDomains setting).
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories; https://wiki.zimbra.com/wiki/Security_Center
CVE: CVE-2022-37042
Published: 2022-08-12
Description: Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html; https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2022-37043
Published: 2022-08-12
Description: An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to be intended. The CSRF token is omitted from the request, but the request still succeeds.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories; https://wiki.zimbra.com/wiki/Security_Center
CVE: CVE-2022-37044
Published: 2022-08-12
Description: In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories; https://wiki.zimbra.com/wiki/Security_Center
CVE: CVE-2022-37423
Published: 2022-08-12
Description: Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-78f9-745f-278p; https://neo4j.com/docs/aura/platform/apoc/; https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-78f9-745f-278p
CVE: CVE-2022-35585
Published: 2022-08-12
Description: A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Parameter
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://huntr.dev/bounties/5-other-forkcms/; https://huntr.dev/bounties/5-other-forkcms/
CVE: CVE-2022-35587
Published: 2022-08-12
Description: A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://huntr.dev/bounties/6-other-forkcms/; https://huntr.dev/bounties/6-other-forkcms/
CVE: CVE-2022-35589
Published: 2022-08-12
Description: A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://huntr.dev/bounties/7-other-forkcms/; https://huntr.dev/bounties/7-other-forkcms/
CVE: CVE-2022-35590
Published: 2022-08-12
Description: A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://huntr.dev/bounties/4-other-forkcms/; https://huntr.dev/bounties/4-other-forkcms/
CVE: CVE-2022-35932
Published: 2022-08-12
Description: Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is upgraded to 12.2.7, 13.0.7 or 14.0.3. There are currently no known workarounds available apart from not having password protected conversations.
CVSS Score: 3.5 (LOW)
CWE: CWE-359, CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq; https://github.com/nextcloud/spreed/commit/04300bbed0e87ff3420b5d752bbc48e2c15f35e9; https://github.com/nextcloud/spreed/commit/10341b9fe59a44ae0d139c072abd6b5026f33771
CVE: CVE-2021-42750
Published: 2022-08-12
Description: A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/thingsboard/thingsboard; https://packetstormsecurity.com/files/167999/Thingsboard-3.3.1-Cross-Site-Scripting.html; https://github.com/thingsboard/thingsboard
CVE: CVE-2021-42751
Published: 2022-08-12
Description: A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/thingsboard/thingsboard; https://packetstormsecurity.com/files/167999/Thingsboard-3.3.1-Cross-Site-Scripting.html; https://github.com/thingsboard/thingsboard
CVE: CVE-2022-35980
Published: 2022-08-12
Description: OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security (DLS), field level security (FLS), and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied. This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0, contains the fix for this issue. There is no recommended work around.
CVSS Score: 7.5 (HIGH)
CWE: CWE-612
References: https://github.com/opensearch-project/security/commit/7eaaafec2939d7db23a02ffca9cc68e0343de246; https://github.com/opensearch-project/security/pull/1999; https://github.com/opensearch-project/security/security/advisories/GHSA-f4qr-f4xx-hjxw
CVE: CVE-2021-29112
Published: 2022-08-12
Description: An out-of-bounds read vulnerability exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.esri.com/arcgis-blog/products/arcgis-desktop/administration/arcreader-general-data-frame-security-update/; https://www.esri.com/arcgis-blog/products/arcgis-desktop/administration/arcreader-general-data-frame-security-update/