deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-24640
Published: 2021-01-15
Description: There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system.
CVSS Score: 9.8 (CRITICAL)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txt
CVE: CVE-2020-24641
Published: 2021-01-15
Description: In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited can result in disclosure of sensitive information. This can be used to perform an authentication bypass and ultimately gain administrative access on the web administrative interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-918
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-001.txt
CVE: CVE-2021-21243
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-74, CWE-502
References: https://github.com/theonedev/onedev/commit/9637fc8fa461c5777282a0021c3deb1e7a48f137; https://github.com/theonedev/onedev/security/advisories/GHSA-9mmq-fm8c-q4fv; https://github.com/theonedev/onedev/commit/9637fc8fa461c5777282a0021c3deb1e7a48f137
CVE: CVE-2021-21244
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-74, CWE-94
References: https://github.com/theonedev/onedev/commit/4f5dc6fb9e50f2c41c4929b0d8c5824b2cca3d65; https://github.com/theonedev/onedev/security/advisories/GHSA-vm26-xg39-cfj4; https://github.com/theonedev/onedev/commit/4f5dc6fb9e50f2c41c4929b0d8c5824b2cca3d65
CVE: CVE-2021-21242
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or authorization checks. This issue may lead to pre-auth remote code execution. This issue was fixed in 4.0.3 by removing AttachmentUploadServlet and not using deserialization
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-74, CWE-502
References: https://github.com/theonedev/onedev/commit/f864053176c08f59ef2d97fea192ceca46a4d9be; https://github.com/theonedev/onedev/security/advisories/GHSA-5q3q-f373-2jv8; https://github.com/theonedev/onedev/commit/f864053176c08f59ef2d97fea192ceca46a4d9be
CVE: CVE-2021-21245
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://github.com/theonedev/onedev/commit/0c060153fb97c0288a1917efdb17cc426934dacb; https://github.com/theonedev/onedev/security/advisories/GHSA-62m2-38q5-96w9; https://github.com/theonedev/onedev/commit/0c060153fb97c0288a1917efdb17cc426934dacb
CVE: CVE-2021-21246
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are no security checks enforced so it is possible to retrieve arbitrary user details including their Access Tokens! These access tokens can be used to access the API or clone code in the build spec via the HTTP(S) protocol. It has permissions to all projects accessible by the user account. This issue may lead to `Sensitive data leak` and leak the Access Token which can be used to impersonate the administrator or any other users. This issue was addressed in 4.0.3 by removing user info from restful api.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://github.com/theonedev/onedev/commit/a4491e5f79dc6cc96eac20972eedc8905ddf6089; https://github.com/theonedev/onedev/security/advisories/GHSA-66v7-gg85-f4gx; https://github.com/theonedev/onedev/commit/a4491e5f79dc6cc96eac20972eedc8905ddf6089
CVE: CVE-2021-21247
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior`) in all pages other than the login page. This listener decodes and deserializes the `data` query parameter. We can access this listener by submitting a POST request to any page. This issue may lead to `post-auth RCE` This endpoint is subject to authentication and, therefore, requires a valid user to carry on the attack. This issue was addressed in 4.0.3 by encrypting serialization payload with secrets only known to server.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-74, CWE-502
References: https://github.com/theonedev/onedev/security/advisories/GHSA-6pxf-75cf-vwjp; https://github.com/theonedev/onedev/security/advisories/GHSA-6pxf-75cf-vwjp
CVE: CVE-2021-21248
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-74, CWE-94
References: https://github.com/theonedev/onedev/commit/39d95ab8122c5d9ed18e69dc024870cae08d2d60; https://github.com/theonedev/onedev/security/advisories/GHSA-gwp4-5498-hv5f; https://github.com/theonedev/onedev/commit/39d95ab8122c5d9ed18e69dc024870cae08d2d60
CVE: CVE-2021-21249
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider, resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-74, CWE-502
References: https://github.com/theonedev/onedev/commit/d6fc4212b1ac1e9bbe3ce444e95f9af1e3ab8b66; https://github.com/theonedev/onedev/security/advisories/GHSA-7xhq-m2q9-6hpm; https://github.com/theonedev/onedev/commit/d6fc4212b1ac1e9bbe3ce444e95f9af1e3ab8b66
CVE: CVE-2021-21250
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString); which processes the XML document without preventing the expansion of external entities. These entities can be configured to read arbitrary files from the file system and dump their contents in the final XML document to be migrated. If the files are dumped in properties included in the YAML file, it will be possible for an attacker to read them. If not, it is possible for an attacker to exfiltrate the contents of these files Out Of Band. This issue was addressed in 4.0.3 by ignoring ENTITY instructions in xml file.
CVSS Score: 7.7 (HIGH)
CWE: CWE-538
References: https://github.com/theonedev/onedev/commit/9196fd795e87dab069b4260a3590a0ea886e770f; https://github.com/theonedev/onedev/security/advisories/GHSA-9pph-8gfc-6w2r; https://github.com/theonedev/onedev/commit/9196fd795e87dab069b4260a3590a0ea886e770f
CVE: CVE-2021-21251
Published: 2021-01-15
Description: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file write. The KubernetesResource REST endpoint untars user controlled data from the request body using TarUtils. TarUtils is a custom library method leveraging Apache Commons Compress. During the untar process, there are no checks in place to prevent an untarred file from traversing the file system and overriding an existing file. For a successful exploitation, the attacker requires a valid __JobToken__ which may not be possible to get without using any of the other reported vulnerabilities. But this should be considered a vulnerability in `io.onedev.commons.utils.TarUtils` since it lives in a different artifact and can affect other projects using it. This issue was addressed in 4.0.3 by validating paths in tar archive to only allow them to be in specified folder when extracted.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://github.com/theonedev/onedev/security/advisories/GHSA-2w6j-wc8c-9mq2; https://github.com/theonedev/onedev/security/advisories/GHSA-2w6j-wc8c-9mq2
CVE: CVE-2020-25533
Published: 2021-01-15
Description: An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct a situation where the same PID is used for running two different programs at different times, by leveraging a race condition during crafted use of posix_spawn.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://wojciechregula.blog/post/learn-xpc-exploitation-part-2-say-no-to-the-pid/; https://wojciechregula.blog/post/learn-xpc-exploitation-part-2-say-no-to-the-pid/
CVE: CVE-2021-3162
Published: 2021-01-15
Description: Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://docs.docker.com/docker-for-mac/release-notes/#docker-desktop-community-2500; https://twitter.com/_r3ggi; https://docs.docker.com/docker-for-mac/release-notes/#docker-desktop-community-2500
CVE: CVE-2021-3113
Published: 2021-01-17
Description: Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and can then use that cookie immediately for admin access,
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://www.exploit-db.com/exploits/49435; https://www.netsia.com/#netsiaseba; https://www.pentest.com.tr/exploits/Netsia-SEBA-0-16-1-Authentication-Bypass-Add-Root-User-Metasploit.html
CVE: CVE-2020-15864
Published: 2021-01-17
Description: An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://burninatorsec.blogspot.com/2020/10/cve-2020-xxxxx-xss-in-quali-cloudshell.html; https://www.quali.com/products/cloudshell-pro/; https://burninatorsec.blogspot.com/2020/10/cve-2020-xxxxx-xss-in-quali-cloudshell.html
CVE: CVE-2020-29446
Published: 2021-01-18
Description: Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://jira.atlassian.com/browse/CRUC-8496; https://jira.atlassian.com/browse/FE-7326; https://jira.atlassian.com/browse/CRUC-8496
CVE: CVE-2021-3166
Published: 2021-01-18
Description: An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3_805 devices. An attacker can upload arbitrary file content as a firmware update when the filename Settings_DSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update, resulting in a persistent outage of those services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/kaisersource/kaisersource.github.io/blob/main/_posts/2021-01-17-dsl-n14u.md; https://kaisersource.github.io/dsl-n14u; https://github.com/kaisersource/kaisersource.github.io/blob/main/_posts/2021-01-17-dsl-n14u.md
CVE: CVE-2021-25294
Published: 2021-01-18
Description: OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests, leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an __destruct magic method in guzzlehttp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/snoopysecurity/snoopysecurity.github.io/blob/master/web-application-security/2021/01/16/09_opencats_php_object_injection.html; https://snoopysecurity.github.io/web-application-security/2021/01/16/09_opencats_php_object_injection.html; https://www.opencats.org/news/
CVE: CVE-2021-25295
Published: 2021-01-18
Description: OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/snoopysecurity/snoopysecurity.github.io/blob/master/web-application-security/2021/01/16/09_opencats_php_object_injection.html; https://snoopysecurity.github.io/web-application-security/2021/01/16/09_opencats_php_object_injection.html; https://www.opencats.org/news/
CVE: CVE-2021-25173
Published: 2021-01-18
Description: An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denial of service (crash, exit, or restart).
CVSS Score: 7.8 (HIGH)
CWE: CWE-770
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.opendesign.com/security-advisories
CVE: CVE-2021-25174
Published: 2021-01-18
Description: An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.opendesign.com/security-advisories
CVE: CVE-2021-25175
Published: 2021-01-18
Description: An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Conversion issue exists when rendering malformed .DXF and .DWG files. This can allow attackers to cause a crash, potentially enabling a denial of service attack (Crash, Exit, or Restart).
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.opendesign.com/security-advisories
CVE: CVE-2021-25176
Published: 2021-01-18
Description: An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A NULL pointer dereference exists when rendering malformed .DXF and .DWG files. This can allow attackers to cause a crash, potentially enabling a denial of service attack (Crash, Exit, or Restart).
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.opendesign.com/security-advisories
CVE: CVE-2021-25177
Published: 2021-01-18
Description: An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Confusion issue exists when rendering malformed .DXF and .DWG files. This can allow attackers to cause a crash, potentially enabling a denial of service attack (Crash, Exit, or Restart).
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.opendesign.com/security-advisories
CVE: CVE-2021-25178
Published: 2021-01-18
Description: An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A stack-based buffer overflow vulnerability exists when the recover operation is run with malformed .DXF and .DWG files. This can allow attackers to cause a crash potentially enabling a denial of service attack (Crash, Exit, or Restart) or possible code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.opendesign.com/security-advisories
CVE: CVE-2020-28473
Published: 2021-01-18
Description: The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-444
References: https://github.com/bottlepy/bottle; https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html; https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
CVE: CVE-2020-28476
Published: 2021-01-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-23336. Reason: This candidate is a reservation duplicate of CVE-2021-23336. Notes: All CVE users should reference CVE-2021-23336 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-7343
Published: 2021-01-18
Description: Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10343; https://kc.mcafee.com/corporate/index?page=content&id=SB10343
CVE: CVE-2020-36192
Published: 2021-01-18
Description: An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php page, as well as on the list.php page (a pop-up on the Affected Issues id hyperlink). Additionally, if the attacker has "Update threshold" in the plugin's configuration (set to the "updater" access level by default), then they can link any Issue to a Changeset by entering the Issue's Id, even if they do not have access to it.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/mantisbt-plugins/source-integration/issues/344; https://github.com/mantisbt-plugins/source-integration/issues/344
CVE: CVE-2020-36193
Published: 2021-01-18
Description: Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-59, CWE-59
References: https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916; https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html; https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html
CVE: CVE-2020-29450
Published: 2021-01-19
Description: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the avatar upload feature. The affected versions are before version 7.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://jira.atlassian.com/browse/CONFSERVER-60854; https://jira.atlassian.com/browse/CONFSERVER-60854
CVE: CVE-2021-20619
Published: 2021-01-19
Description: Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/weseek/growi; https://jvn.jp/en/jp/JVN57544707/index.html; https://weseek.co.jp/security/2021/01/18/vulnerability/growi-prevent-xss4/
CVE: CVE-2021-3177
Published: 2021-01-19
Description: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://bugs.python.org/issue42938; https://github.com/python/cpython/pull/24239; https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE: CVE-2021-3178
Published: 2021-01-19
Description: fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this attack; see also the exports(5) no_subtree_check default behavior
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=51b2ee7d006a736a9126e8111d1f24e4fd0afaa6; https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5SGB7TNDVQEOJ7NVTGX56UWHDNQM5TRC/
CVE: CVE-2021-22850
Published: 2021-01-19
Description: HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732, CWE-306
References: https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef; https://www.twcert.org.tw/tw/cp-132-4326-3d9d2-1.html; https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef