deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-10706
Published: 2024-12-20
Description: The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/01193420-9a4c-4961-93b6-aa2e37e36be1/
CVE: CVE-2024-11108
Published: 2024-12-20
Description: The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7790af9d-621b-474c-b28c-c774e2a292bb/
CVE: CVE-2024-5955
Published: 2024-12-20
Description: Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft requests causing arbitrary content to be injected into the response when accessing the epolicy Orchestrator.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://thrive.trellix.com/s/article/000014118
CVE: CVE-2024-8968
Published: 2024-12-20
Description: The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cab4d23e-e857-4b2f-b1ca-fbafd37524e0/
CVE: CVE-2024-11297
Published: 2024-12-20
Description: The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-203
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212690%40page-and-post-restriction&new=3212690%40page-and-post-restriction&sfp_email=&sfph_mail=; https://wordpress.org/plugins/page-and-post-restriction/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d12ab8c-d5d0-4e02-986e-e894fae073e5?source=cve
CVE: CVE-2024-11331
Published: 2024-12-20
Description: The استخراج محصولات ووکامرس برای آیسی plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/isee-products-extractor/tags/2.1.2/admin/pages/products_list.php#L105; https://plugins.trac.wordpress.org/browser/isee-products-extractor/tags/2.1.2/admin/pages/products_list.php#L92; https://plugins.trac.wordpress.org/browser/isee-products-extractor/tags/2.1.2/admin/pages/products_list.php#L99
CVE: CVE-2024-11411
Published: 2024-12-20
Description: The Spotlightr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode in all versions up to, and including, 0.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/spotlightr/trunk/spotlightr.php; https://plugins.trac.wordpress.org/changeset/3231975/; https://wordpress.org/plugins/spotlightr/
CVE: CVE-2024-11774
Published: 2024-12-20
Description: The Outdooractive Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list2go' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3209740/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d152271f-af5c-4faf-9945-483b69b716f2?source=cve
CVE: CVE-2024-11775
Published: 2024-12-20
Description: The Particle Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'particleground' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/particle-background/trunk/particleground.php#L59; https://wordpress.org/plugins/particle-background/; https://www.wordfence.com/threat-intel/vulnerabilities/id/42cf84d1-37f5-41c1-838d-67244f17c55d?source=cve
CVE: CVE-2024-11783
Published: 2024-12-20
Description: The Financial Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'finance_calculator' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/finance-calculator-with-application-form/tags/2.2.1/finance-calculator-with-aplication-form.php#L604; https://www.wordfence.com/threat-intel/vulnerabilities/id/c9[PII_REDACTED]-4488-8147-05ba1453182c?source=cve
CVE: CVE-2024-11784
Published: 2024-12-20
Description: The Sell Tickets Online – TicketSource Ticket Shop for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticketshop' shortcode in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ticketsource-events/trunk/includes/ticketsource-events-build.php#L37; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3210652%40ticketsource-events&new=3210652%40ticketsource-events&sfp_email=&sfph_mail=; https://wordpress.org/plugins/ticketsource-events/
CVE: CVE-2024-11806
Published: 2024-12-20
Description: The PKT1 Centro de envios plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'success' and 'error' parameters in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/pkt1-centro-de-envios/trunk/views/admin/settings_page.php#L8; https://plugins.trac.wordpress.org/changeset/3216714/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c924b317-97ec-43b8-9bf3-ed7618743de7?source=cve
CVE: CVE-2024-11812
Published: 2024-12-20
Description: The Wtyczka SeoPilot dla WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.091. This is due to missing or incorrect nonce validation on the SeoPilot_Admin_Options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wtyczka-seopilot-dla-wp/trunk/seopilot.php#L88; https://www.wordfence.com/threat-intel/vulnerabilities/id/5efb2fbe-d839-4fb1-80bb-91adf0d39a2b?source=cve
CVE: CVE-2024-11878
Published: 2024-12-20
Description: The Category Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'category-post-slider' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/category-post-slider/tags/1.4/category-post-slider.php#L189; https://www.wordfence.com/threat-intel/vulnerabilities/id/e312e3eb-0da9-4ecf-aec6-86bfe08417f5?source=cve
CVE: CVE-2024-11893
Published: 2024-12-20
Description: The Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spoki_button' shortcode in all versions up to, and including, 2.15.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/spoki/trunk/spoki.php#L1256; https://plugins.trac.wordpress.org/changeset/3218903/; https://wordpress.org/plugins/spoki/
CVE: CVE-2024-12506
Published: 2024-12-20
Description: The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/nacc-wordpress-plugin/tags/4.1.0/nacc-wordpress-plugin.php#L135; https://plugins.trac.wordpress.org/browser/nacc-wordpress-plugin/tags/4.1.0/nacc-wordpress-plugin.php#L68; https://plugins.trac.wordpress.org/browser/nacc-wordpress-plugin/tags/4.1.0/nacc-wordpress-plugin.php#L85
CVE: CVE-2024-12509
Published: 2024-12-20
Description: The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embed_twine' shortcode in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/embed-twine/; https://www.wordfence.com/threat-intel/vulnerabilities/id/647f0b46-ac12-445b-9d41-66eba3eb2b1a?source=cve
CVE: CVE-2024-12571
Published: 2024-12-20
Description: The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.9 via the 'sl_engine' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/store-locator/trunk/sl-functions.php#L1919; https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea89a6e-e089-4e8d-afd8-2a217f6910a6?source=cve
CVE: CVE-2024-9503
Published: 2024-12-20
Description: The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wploti_add_whitelisted_roles_option',  'wploti_remove_whitelisted_roles_option', 'wploti_add_whitelisted_users_option', 'wploti_remove_whitelisted_users_option', and 'wploti_uploaded_animation_save_option' functions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify certain plugin settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/maintenance-coming-soon-redirect-animation/trunk/wploti_maintenance_redirect.php; https://plugins.trac.wordpress.org/changeset/3253024/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1e716cf9-198c-4a32-883d-3f90dd399aee?source=cve
CVE: CVE-2024-9619
Published: 2024-12-20
Description: The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-shapes/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/8207ae15-b6ae-4b58-8877-1f87c12dbe7c?source=cve
CVE: CVE-2024-7726
Published: 2024-12-20
Description: There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that is exposed on the drive’s circuit board. Due to the wide cutout of the enclosures, the JTAG port can be accessed without having to open the disk enclosure. Utilizing the JTAG debug port, an attacker with (temporary) physical access can get full access to the firmware and memory on the 2 main CPU cores within the drive including the execution of arbitrary code, the modification of firmware execution flow and data or bypassing the firmware signature verification during boot-up.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://github.com/google/security-research/security/advisories/GHSA-3hh8-94j4-62rh
CVE: CVE-2024-12014
Published: 2024-12-20
Description: Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.
CWE: CWE-20
References: https://edgewatch.com/vulnerability-advisories/path-traversal-and-idor-vulnerabilities-in-esignaviewer-allow-unauthorized-file-access/
CVE: CVE-2024-28767
Published: 2024-12-20
Description: IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://www.ibm.com/support/pages/node/7179558
CVE: CVE-2024-40695
Published: 2024-12-20
Description: IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 

12.0.0 through 12.0.4



could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://www.ibm.com/support/pages/node/7179496
CVE: CVE-2024-51466
Published: 2024-12-20
Description: IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 

12.0.0 through 12.0.4

is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-917
References: https://www.ibm.com/support/pages/node/7179496
CVE: CVE-2024-56348
Published: 2024-12-20
Description: In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-56349
Published: 2024-12-20
Description: In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-56350
Published: 2024-12-20
Description: In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-56351
Published: 2024-12-20
Description: In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-56352
Published: 2024-12-20
Description: In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-56353
Published: 2024-12-20
Description: In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-212
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-56354
Published: 2024-12-20
Description: In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-56355
Published: 2024-12-20
Description: In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-56356
Published: 2024-12-20
Description: In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-611
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-10385
Published: 2024-12-20
Description: Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code.
If an admin views the ticket, the script might perform actions with their privileges, including command execution. 
This issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.
CWE: CWE-79
References: https://cert.pl/en/posts/2024/12/CVE-2024-10385; https://www.directadmin.com/evolution.php
CVE: CVE-2024-12840
Published: 2024-12-20
Description: Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed. The problem described was inteded behavior and therefore not a bug.
CVE: CVE-2024-55186
Published: 2024-12-20
Description: An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://gist.github.com/SmitShah1518/00de9ecc46c1a8e2b189185c9d92afb0; https://github.com/oqtane/oqtane.framework/pull/4876/files; https://gist.github.com/SmitShah1518/00de9ecc46c1a8e2b189185c9d92afb0
CVE: CVE-2024-55470
Published: 2024-12-20
Description: Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the issue, as the application relies on client-side information for authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://gist.github.com/Kaushikjoshi/2d8ad350ba5e72030fcee2536498cfe4; https://github.com/oqtane/oqtane.framework/pull/4878/files
CVE: CVE-2024-55471
Published: 2024-12-20
Description: Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/oqtane/oqtane.framework/pull/4880/files; https://medium.com/@Rudra_2158/cve-2024-55471-breaking-down-the-idor-vulnerability-in-oqtane-framework-c0f4b02f12fc
CVE: CVE-2024-56337
Published: 2024-12-20
Description: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


The mitigation for CVE-2024-50379 was incomplete.

Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation 
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:
- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)
- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false)
- running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)

Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-367
References: https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp; https://www.cve.org/CVERecord?id=CVE-2024-50379; https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
CVE: CVE-2024-12677
Published: 2024-12-20
Description: Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&q=dtm&sort_expr=cdate&sort_dir=DESC; https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-03