deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-23033
Published: 2022-01-25
Description: arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404
References: http://www.openwall.com/lists/oss-security/2022/01/25/2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMR6UBGJW6JKND7IILGQ2CU35EQPF3E3/; https://security.gentoo.org/glsa/202208-23
CVE: CVE-2022-23034
Published: 2022-01-25
Description: A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping, unmapping of such a mapping can be requested in two steps. The reference count for such a mapping would then mistakenly be decremented twice. Underflow of the counters gets detected, resulting in the triggering of a hypervisor bug check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: http://www.openwall.com/lists/oss-security/2022/01/25/3; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMR6UBGJW6JKND7IILGQ2CU35EQPF3E3/; https://security.gentoo.org/glsa/202208-23
CVE: CVE-2022-23035
Published: 2022-01-25
Description: Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time this cleanup gets invoked, the cleanup attempt may be scheduled to be retried. When multiple interrupts are involved, this scheduling of a retry may get erroneously skipped. At the same time pointers may get cleared (resulting in a de-reference of NULL) and freed (resulting in a use-after-free), while other code would continue to assume them to be valid.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-459
References: http://www.openwall.com/lists/oss-security/2022/01/25/4; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMR6UBGJW6JKND7IILGQ2CU35EQPF3E3/; https://security.gentoo.org/glsa/202208-23
CVE: CVE-2021-3850
Published: 2022-01-25
Description: Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-305, CWE-287
References: https://github.com/adodb/adodb/commit/952de6c4273d9b1e91c2b838044f8c2111150c29; https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c; https://lists.debian.org/debian-lts-announce/2022/02/msg00006.html
CVE: CVE-2021-46033
Published: 2022-01-25
Description: In ForestBlog, as of 2021-12-28, File upload can bypass verification.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/saysky/ForestBlog/issues/69; https://github.com/saysky/ForestBlog/issues/69
CVE: CVE-2021-46089
Published: 2022-01-25
Description: In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jeecgboot/jeecg-boot/issues/3331; https://github.com/jeecgboot/jeecg-boot/issues/3331
CVE: CVE-2021-34865
Published: 2022-01-25
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-13313.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-697
References: https://kb.netgear.com/000063955/Security-Advisory-for-Authentication-Bypass-Vulnerability-on-Some-Routers-PSV-2021-0083?article=000063955; https://www.zerodayinitiative.com/advisories/ZDI-21-1051/; https://kb.netgear.com/000063955/Security-Advisory-for-Authentication-Bypass-Vulnerability-on-Some-Routers-PSV-2021-0083?article=000063955
CVE: CVE-2021-34866
Published: 2022-01-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.zerodayinitiative.com/advisories/ZDI-21-1148/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-34867
Published: 2022-01-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13672.
CVSS Score: 8.2 (HIGH)
CWE: CWE-789
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-1055/; https://kb.parallels.com/125013
CVE: CVE-2021-34868
Published: 2022-01-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13712.
CVSS Score: 8.8 (HIGH)
CWE: CWE-789
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-1056/; https://kb.parallels.com/125013
CVE: CVE-2021-34869
Published: 2022-01-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13797.
CVSS Score: 8.8 (HIGH)
CWE: CWE-789
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-1057/; https://kb.parallels.com/125013
CVE: CVE-2021-34870
Published: 2022-01-25
Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_1.0.38 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue results from a lack of authentication required for a privileged request. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-13325.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://kb.netgear.com/000063967/Security-Advisory-for-a-Security-Misconfiguration-Vulnerability-on-the-XR1000-PSV-2021-0101; https://www.zerodayinitiative.com/advisories/ZDI-21-1058/; https://kb.netgear.com/000063967/Security-Advisory-for-a-Security-Misconfiguration-Vulnerability-on-the-XR1000-PSV-2021-0101
CVE: CVE-2021-43863
Published: 2022-01-25
Description: The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/nextcloud/android/commit/627caba60e69e223b0fc89c4cb18eaa76a95db95; https://github.com/nextcloud/android/security/advisories/GHSA-vjp2-f63v-w479; https://hackerone.com/reports/1358597
CVE: CVE-2021-46034
Published: 2022-01-25
Description: A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/saysky/ForestBlog/issues/70; https://github.com/saysky/ForestBlog/issues/70
CVE: CVE-2021-46083
Published: 2022-01-25
Description: uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/chenniqing/uscat/issues/1; https://github.com/chenniqing/uscat/issues/1
CVE: CVE-2021-46084
Published: 2022-01-25
Description: uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/chenniqing/uscat/issues/2; https://github.com/chenniqing/uscat/issues/2
CVE: CVE-2021-46085
Published: 2022-01-25
Description: OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/zhangyd-c/OneBlog/issues/29; https://github.com/zhangyd-c/OneBlog/issues/29
CVE: CVE-2021-46086
Published: 2022-01-25
Description: xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnerability in the functional method of submitting examination papers. An attacker can use burpuite to modify parameters in the packet to destroy real data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://github.com/mindskip/xzs-mysql/issues/327; https://github.com/mindskip/xzs-mysql/issues/327
CVE: CVE-2021-46087
Published: 2022-01-25
Description: In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/jflyfox/jfinal_cms/issues/19; https://github.com/jflyfox/jfinal_cms/issues/19
CVE: CVE-2021-39031
Published: 2022-01-25
Description: IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM X-Force ID: 213875.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213875; https://www.ibm.com/support/pages/node/6550488; https://exchange.xforce.ibmcloud.com/vulnerabilities/213875
CVE: CVE-2022-0351
Published: 2022-01-25
Description: Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-786, CWE-119
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; http://seclists.org/fulldisclosure/2022/Oct/43
CVE: CVE-2021-38129
Published: 2022-01-25
Description: Escalation of privileges vulnerability in Micro Focus in Micro Focus Operations Agent, affecting versions 12.x up to and including 12.21. The vulnerability could be exploited by a non-privileged local user to access system monitoring data collected by Operations Agent.
CVSS Score: 3.3 (LOW)
References: https://portal.microfocus.com/s/article/KM000003539?language=en_US; https://portal.microfocus.com/s/article/KM000003539?language=en_US
CVE: CVE-2021-40158
Published: 2022-01-25
Description: A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond allocated boundaries when parsing the JT file. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002; https://www.zerodayinitiative.com/advisories/ZDI-22-281/; https://www.zerodayinitiative.com/advisories/ZDI-22-283/
CVE: CVE-2021-40159
Published: 2022-01-25
Description: An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities may lead to code execution through maliciously crafted JT files in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002; https://www.zerodayinitiative.com/advisories/ZDI-22-282/; https://www.zerodayinitiative.com/advisories/ZDI-22-289/
CVE: CVE-2021-40167
Published: 2022-01-25
Description: A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2021-40337
Published: 2022-01-25
Description: Cross-site Scripting (XSS) vulnerability in Hitachi Energy LinkOne allows an attacker that manages to exploit the vulnerability can take advantage to exploit multiple web attacks and stole sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-41598
Published: 2022-01-25
Description: A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub App on the instance and have a user authorize the application through the web authentication flow. All permissions being granted would properly be shown during the first authorization, but if the user later updated the set of repositories the app was installed on after the GitHub App had configured additional user-level permissions, those additional permissions would not be displayed, leading to more permissions being granted than the user potentially intended. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.2.5, 3.1.13, 3.0.21. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-451
References: https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.21; https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.13; https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.5
CVE: CVE-2021-43298
Published: 2022-01-25
Description: The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting. This means that an unauthenticated network attacker can brute-force the HTTP basic password, byte-by-byte, by recording the webserver's response time until the unauthorized (401) response.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-208, CWE-307
References: https://github.com/embedthis/goahead/issues/304; https://github.com/embedthis/goahead/issues/304
CVE: CVE-2021-45729
Published: 2022-01-25
Description: The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create, edit, and delete maps.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-269
References: https://patchstack.com/database/vulnerability/gmap-embed/wordpress-wp-google-map-plugin-1-8-0-privilege-escalation-vulnerability; https://wordpress.org/plugins/gmap-embed/#developers; https://patchstack.com/database/vulnerability/gmap-embed/wordpress-wp-google-map-plugin-1-8-0-privilege-escalation-vulnerability
CVE: CVE-2021-4133
Published: 2022-01-25
Description: A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=2033602; https://github.com/keycloak/keycloak/issues/9247; https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487
CVE: CVE-2021-4145
Published: 2022-01-25
Description: A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2034602; https://gitlab.com/qemu-project/qemu/-/commit/66fed30c9cd11854fc878a4eceb507e915d7c9cd; https://security.gentoo.org/glsa/202208-27
CVE: CVE-2022-0270
Published: 2022-01-25
Description: Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/Mirantis/security/blob/main/advisories/0004.md; https://github.com/Mirantis/security/blob/main/advisories/0004.md
CVE: CVE-2022-0332
Published: 2022-01-25
Description: A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://bugzilla.redhat.com/show_bug.cgi?id=2043661; https://moodle.org/mod/forum/discuss.php?d=431099; https://bugzilla.redhat.com/show_bug.cgi?id=2043661
CVE: CVE-2022-0333
Published: 2022-01-25
Description: A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
CVSS Score: 3.8 (LOW)
CWE: CWE-863, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=2043663; https://moodle.org/mod/forum/discuss.php?d=431100; https://bugzilla.redhat.com/show_bug.cgi?id=2043663
CVE: CVE-2022-0334
Published: 2022-01-25
Description: A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-668
References: https://bugzilla.redhat.com/show_bug.cgi?id=2043664; https://moodle.org/mod/forum/discuss.php?d=431102; https://bugzilla.redhat.com/show_bug.cgi?id=2043664
CVE: CVE-2022-0335
Published: 2022-01-25
Description: A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=2043666; https://moodle.org/mod/forum/discuss.php?d=431103; https://bugzilla.redhat.com/show_bug.cgi?id=2043666
CVE: CVE-2022-22789
Published: 2022-01-25
Description: Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existing password in the file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-312
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-23008
Published: 2022-01-25
Description: On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed on managed NGINX data plane instances. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94, CWE-79
References: https://support.f5.com/csp/article/K57735782; https://support.f5.com/csp/article/K57735782
CVE: CVE-2022-23009
Published: 2022-01-25
Description: On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices managed by the same BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863, CWE-863
References: https://support.f5.com/csp/article/K47592780; https://support.f5.com/csp/article/K47592780
CVE: CVE-2022-23010
Published: 2022-01-25
Description: On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile and an HTTP profile are configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-404
References: https://support.f5.com/csp/article/K34360320; https://support.f5.com/csp/article/K34360320