deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-38537
Published: 2024-07-02
Description: Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard. Therefore it was possible for users of legacy, pre-2017 browsers who navigate to a page serving `fides.js` to download and execute malicious scripts from the `polyfill.io` domain when the domain was compromised and serving malware. No exploitation of `fides.js` via `polyfill.io` has been identified as of time of publication.

The vulnerability has been patched in Fides version `2.39.1`. Users are advised to upgrade to this version or later to secure their systems against this threat. On Thursday, June 27, 2024, Cloudflare and Namecheap intervened at a domain level to ensure `polyfill.io` and its subdomains could not resolve to the compromised service, rendering this vulnerability unexploitable. Prior to the domain level intervention, there were no server-side workarounds and the confidentiality, integrity, and availability impacts of this vulnerability were high. Clients could ensure they were not affected by using a modern browser that supported the fetch standard.
CVSS Score: 0.0 (NONE)
CWE: CWE-829
References: https://fetch.spec.whatwg.org; https://github.com/ethyca/fides/commit/868c4d[PII_REDACTED]92bd61db34f5a4458ed12005; https://github.com/ethyca/fides/pull/5026
CVE: CVE-2024-39315
Published: 2024-07-02
Description: Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of a cross-site scripting vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the `/.pomerium` endpoint. Upstream applications that authenticate only the ID token may be vulnerable to user impersonation using a token obtained in this manner. Note that an OAuth2 access token or ID token by itself is not sufficient to hijack a user's Pomerium session. Upstream applications should not be vulnerable to user impersonation via these tokens provided the application verifies the Pomerium JWT for each request, the connection between Pomerium and the application is secured by mTLS, or the connection between Pomerium and the application is otherwise secured at the network layer. The issue is patched in Pomerium v0.26.1. No known workarounds are available.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-201
References: https://github.com/pomerium/pomerium/commit/4c7c4320afb2ced70ba19b46de1ac4383f3daa48; https://github.com/pomerium/pomerium/security/advisories/GHSA-rrqr-7w59-637v; https://github.com/pomerium/pomerium/commit/4c7c4320afb2ced70ba19b46de1ac4383f3daa48
CVE: CVE-2024-6452
Published: 2024-07-02
Description: A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file AdminGoodscontroller.java. The manipulation of the argument goodsId/goodsSn/name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270235.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/linlinjava/litemall/issues/548; https://vuldb.com/?ctiid.270235; https://vuldb.com/?id.270235
CVE: CVE-2024-39322
Published: 2024-07-02
Description: aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/aimeos/ai-admin-jsonadm/commit/02a063fbd616d4e0a5aaf89f1642a856aa5ac5a5; https://github.com/aimeos/ai-admin-jsonadm/commit/16d013d0e28cecd19781f434d83fabebcc78cdc2; https://github.com/aimeos/ai-admin-jsonadm/commit/4c966e02bd52589c3c9382777cfe170eddf17b00
CVE: CVE-2024-39324
Published: 2024-07-02
Description: aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.

CVSS Score: 3.8 (LOW)
CWE: CWE-863, CWE-1220, CWE-863
References: https://github.com/aimeos/ai-admin-graphql/commit/4eabc2b973509ffa5924e7f88c8f87ee96e93b38; https://github.com/aimeos/ai-admin-graphql/commit/687059d7eb2e1d55a09ed72dad3814f35edad038; https://github.com/aimeos/ai-admin-graphql/commit/a839a5adf16fee4221d444b7d2f5140d8cabf0ac
CVE: CVE-2024-39325
Published: 2024-07-02
Description: aimeos/ai-controller-frontend is the  Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-841
References: https://github.com/aimeos/ai-controller-frontend/commit/16b8837d2466e3665b3c826ce87934b01a847268; https://github.com/aimeos/ai-controller-frontend/commit/24a57001e56759d1582d2a0080fc1ca3ba328630; https://github.com/aimeos/ai-controller-frontend/commit/28549808e0f6432a34cd3fb95556deeb86ca276d
CVE: CVE-2024-39326
Published: 2024-07-02
Description: SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint 
`/admin/projects/{projectname}/skills/{skillname}/video` (and probably others) is open to a cross-site request forgery (CSRF) vulnerability. Due to the endpoint being CSRFable e.g POST request, supports a content type that can be exploited (multipart file upload), makes a state change and has no CSRF mitigations in place (samesite flag, CSRF token). It is possible to perform a CSRF attack against a logged in admin account, allowing an attacker that can target a logged in admin of Skills Service to modify the videos, captions, and text of the skill. Version 2.12.6 contains a patch for this issue.

CVSS Score: 4.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/NationalSecurityAgency/skills-service/blob/24dd22f43306fc616e4580fb8bb88f66b5d9b41d/service/src/main/java/skills/controller/AdminController.groovy#L574; https://github.com/NationalSecurityAgency/skills-service/commit/68d4235ddcb16e4f33fc7f19d14ff917817a366c; https://github.com/NationalSecurityAgency/skills-service/security/advisories/GHSA-9624-qwxr-jr4j
CVE: CVE-2024-24791
Published: 2024-07-02
Description: The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
CVSS Score: 7.5 (HIGH)
References: https://go.dev/cl/591255; https://go.dev/issue/67555; https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ
CVE: CVE-2024-6453
Published: 2024-07-02
Description: A vulnerability was found in itsourcecode Farm Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /quarantine.php?id=3. The manipulation of the argument pigno/breed/reason leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270241 was assigned to this vulnerability. NOTE: Original submission mentioned parameter pigno only but the VulDB data analysis team determined two additional parameters to be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/7u7777/cve/issues/3; https://vuldb.com/?ctiid.270241; https://vuldb.com/?id.270241
CVE: CVE-2024-4708
Published: 2024-07-02
Description: mySCADA myPRO 

uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-02; https://www.myscada.org/mypro/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-02
CVE: CVE-2024-32673
Published: 2024-07-03
Description: Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue.

This issue affects Walrus: before 72c7230f32a0b791355bbdfc[PII_REDACTED]4b0956.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-129
References: https://github.com/Samsung/walrus/pull/241; https://github.com/Samsung/walrus/pull/241
CVE: CVE-2024-39920
Published: 2024-07-03
Description: The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1255
References: https://github.com/IAIK/SnailLoad; https://news.ycombinator.com/item?id=40809629; https://twitter.com/tugraz/status/[PII_REDACTED]22299412
CVE: CVE-2024-4543
Published: 2024-07-03
Description: The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or incorrect nonce validation when adding or editing shortcodes. This makes it possible for unauthenticated attackers to modify shortcodes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3110951?contextall=1; https://www.wordfence.com/threat-intel/vulnerabilities/id/127b20c4-cd7c-4d04-b32f-bcc26beb2c35?source=cve; https://plugins.trac.wordpress.org/changeset/3110951?contextall=1
CVE: CVE-2024-2040
Published: 2024-07-03
Description: The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1b97bbf0-c7d1-4e6c-bb80-f9bf45fbfe1e/; https://wpscan.com/vulnerability/1b97bbf0-c7d1-4e6c-bb80-f9bf45fbfe1e/
CVE: CVE-2024-2231
Published: 2024-07-03
Description: The  allows any authenticated user to join a private group due to a missing authorization check on a function
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://wpscan.com/vulnerability/119d2d93-3b71-4ce9-b385-4e6f57b162cb/; https://wpscan.com/vulnerability/119d2d93-3b71-4ce9-b385-4e6f57b162cb/
CVE: CVE-2024-2233
Published: 2024-07-03
Description: The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/51d0311a-673b-4538-9427-a48e8c89e38b/; https://wpscan.com/vulnerability/51d0311a-673b-4538-9427-a48e8c89e38b/
CVE: CVE-2024-2234
Published: 2024-07-03
Description: The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/37018a3f-895f-48f7-b033-c051e2462830/; https://wpscan.com/vulnerability/37018a3f-895f-48f7-b033-c051e2462830/
CVE: CVE-2024-2235
Published: 2024-07-03
Description: The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/62c8a564-225e-4202-9bb0-03029fa4fd42/; https://wpscan.com/vulnerability/62c8a564-225e-4202-9bb0-03029fa4fd42/
CVE: CVE-2024-2375
Published: 2024-07-03
Description: The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3d144e1c-a1f4-4c5a-93e2-4296a96d4ba2/; https://wpscan.com/vulnerability/3d144e1c-a1f4-4c5a-93e2-4296a96d4ba2/
CVE: CVE-2024-2376
Published: 2024-07-03
Description: The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/bdd2e323-d589-4050-bc27-5edd2507a818/; https://wpscan.com/vulnerability/bdd2e323-d589-4050-bc27-5edd2507a818/
CVE: CVE-2024-37082
Published: 2024-07-03
Description: When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP requests that bypass mTLS authentication to Cloud Foundry applications. 

You are affected if you have route-services enabled in routing-release and have configured the haproxy-boshrelease property “ha_proxy.forwarded_client_cert” to “forward_only_if_route_service”.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-290
References: https://www.cloudfoundry.org/blog/cve-2024-37082-mtls-bypass/; https://www.cloudfoundry.org/blog/cve-2024-37082-mtls-bypass/
CVE: CVE-2024-38453
Published: 2024-07-03
Description: The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key. NOTE: the current version is 11 as of mid-2024.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-922
References: https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FKAoOUAX; https://deneyed.com/blog/avalara/; https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FKAoOUAX
CVE: CVE-2024-4482
Published: 2024-07-03
Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Countdown' widget in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied 'text_days' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/the-plus-addons-for-elementor-page-builder/tags/5.5.1/modules/widgets/tp_countdown.php#L1945; https://wordpress.org/plugins/the-plus-addons-for-elementor-page-builder/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/25e42bf8-794e-46a5-b7db-f1f8802bba00?source=cve
CVE: CVE-2024-6263
Published: 2024-07-03
Description: The WP Lightbox 2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 3.0.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-lightbox-2/trunk/wp-lightbox-2.js; https://plugins.trac.wordpress.org/changeset?new=3108386%40wp-lightbox-2&old=3046989%40wp-lightbox-2; https://www.wordfence.com/threat-intel/vulnerabilities/id/fe275351-a547-440d-9e8c-c464ed333aa9?source=cve
CVE: CVE-2024-6340
Published: 2024-07-03
Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.10.36 and fully patched in version 4.10.37.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/assets/frontend/js/premium-countdown-timer.js#L113; https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/assets/frontend/js/premium-countdown-timer.js#L31; https://plugins.trac.wordpress.org/changeset/3115459/
CVE: CVE-2024-36257
Published: 2024-07-03
Description: Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-39353
Published: 2024-07-03
Description: Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker with access to the audit logs to read message contents.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-39361
Published: 2024-07-03
Description: Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an attacker to specify both a remoteId and the post ID, resulting in creating a post with a user-defined post ID. This can cause some broken functionality in the channel or thread with user-defined posts
CVSS Score: 3.1 (LOW)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-39807
Published: 2024-07-03
Description: Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel IDs of archived or restored channels.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-39830
Published: 2024-07-03
Description: Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison for remote cluster tokens which allows an attacker to retrieve the remote cluster token via a timing attack during remote cluster token comparison.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-203
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-6428
Published: 2024-07-03
Description: Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9.5.x <= 9.5.5 fail to prevent specifying a RemoteId when creating a new user which allows an attacker to specify both a remoteId and the user ID, resulting in creating a user with a user-defined user ID. This can cause some broken functionality in User Management such administrative actions against the user not working.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-6469
Published: 2024-07-03
Description: A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=feature_firewall&op=firewall_list of the component Template Handler. The manipulation of the argument IP address with the input {{`id`} leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270277 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.7 (LOW)
CWE: CWE-74
References: https://vuldb.com/?ctiid.270277; https://vuldb.com/?id.270277; https://vuldb.com/?submit.363730
CVE: CVE-2024-6426
Published: 2024-07-03
Description: Information exposure vulnerability in MESbook 20221021.03 version, the exploitation of which could allow a local attacker, with user privileges, to access different resources by changing the API value of the application.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook
CVE: CVE-2024-6427
Published: 2024-07-03
Description: Uncontrolled Resource Consumption vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can use the "message" parameter to inject a payload with dangerous JavaScript code, causing the application to loop requests on itself, which could lead to resource consumption and disable the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook; https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook
CVE: CVE-2024-5672
Published: 2024-07-03
Description: A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://seclists.org/fulldisclosure/2024/Jul/6; https://cert.vde.com/en/advisories/VDE-2024-030; https://cert.vde.com/en/advisories/VDE-2024-032
CVE: CVE-2024-6470
Published: 2024-07-03
Description: A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=feature_inboxgroup&op=list of the component Template Handler. The manipulation of the argument Receiver Number with the input {{`id`}} leads to injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-270278 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.7 (LOW)
CWE: CWE-74
References: https://vuldb.com/?ctiid.270278; https://vuldb.com/?id.270278; https://vuldb.com/?submit.363733