deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-9673
Published: 2019-06-05
Description: Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-19
References: https://freenetproject.org; https://freenetproject.org/freenet-build-1484-released.html; https://github.com/mgrube/CVE-2019-9673
CVE: CVE-2019-9730
Published: 2019-06-05
Description: Incorrect access control in the CxUtilSvc component of the Synaptics Sound Device drivers prior to version 2.29 allows a local attacker to increase access privileges to the Windows Registry via an unpublished API.
CVSS Score: 8.8 (HIGH)
References: https://support.lenovo.com/us/en/product_security/LEN-25822; https://twitter.com/Jackson_T; https://www.synaptics.com/company/blog/
CVE: CVE-2019-11982
Published: 2019-06-05
Description: A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03917en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03917en_us
CVE: CVE-2019-11983
Published: 2019-06-05
Description: A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than version v1.39.
CVSS Score: 7.0 (HIGH)
CWE: CWE-119
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03917en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03917en_us
CVE: CVE-2019-12553
Published: 2019-06-05
Description: In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ereisr00/bagofbugz/blob/master/010Editor/strcat_heap_overflow.bt; https://www.sweetscape.com/010editor/release_notes.html; https://github.com/ereisr00/bagofbugz/blob/master/010Editor/strcat_heap_overflow.bt
CVE: CVE-2019-12554
Published: 2019-06-05
Description: In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/ereisr00/bagofbugz/blob/master/010Editor/WSubStr.bt; https://www.sweetscape.com/010editor/release_notes.html; https://github.com/ereisr00/bagofbugz/blob/master/010Editor/WSubStr.bt
CVE: CVE-2019-12555
Published: 2019-06-05
Description: In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/ereisr00/bagofbugz/blob/master/010Editor/SubStr.bt; https://www.sweetscape.com/010editor/release_notes.html; https://github.com/ereisr00/bagofbugz/blob/master/010Editor/SubStr.bt
CVE: CVE-2019-1842
Published: 2019-06-05
Description: A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in to an affected device using two distinct usernames. The vulnerability is due to a logic error that may occur when certain sequences of actions are processed during an SSH login event on the affected device. An attacker could exploit this vulnerability by initiating an SSH session to the device with a specific sequence that presents the two usernames. A successful exploit could result in logging data misrepresentation, user enumeration, or, in certain circumstances, a command authorization bypass. See the Details section for more information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-285, CWE-287
References: http://www.securityfocus.com/bid/108687; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-iosxr-ssh; http://www.securityfocus.com/bid/108687
CVE: CVE-2019-1845
Published: 2019-06-05
Description: A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&amp;P) Service, Cisco TelePresence Video Communication Server (VCS), and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a service outage for users attempting to authenticate, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient controls for specific memory operations. An attacker could exploit this vulnerability by sending a malformed Extensible Messaging and Presence Protocol (XMPP) authentication request to an affected system. A successful exploit could allow the attacker to cause an unexpected restart of the authentication service, preventing users from successfully authenticating. Exploitation of this vulnerability does not impact users who were authenticated prior to an attack.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108615; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-cucm-imp-dos; http://www.securityfocus.com/bid/108615
CVE: CVE-2019-1861
Published: 2019-06-05
Description: A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of files uploaded to the affected application. An attacker could exploit this vulnerability by authenticating to the affected system using administrator privileges and uploading an arbitrary file. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-434
References: http://www.securityfocus.com/bid/108622; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ind-rce; http://www.securityfocus.com/bid/108622
CVE: CVE-2019-1868
Published: 2019-06-05
Description: A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to access sensitive system information. The vulnerability is due to improper access control to files within the web-based management interface. An attacker could exploit this vulnerability by sending a malicious request to an affected device. A successful exploit could allow the attacker to access sensitive system information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://www.securityfocus.com/bid/108625; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-webexmeetings-id; http://www.securityfocus.com/bid/108625
CVE: CVE-2019-1870
Published: 2019-06-05
Description: A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web interface or allow the attacker to access sensitive browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/108645; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ece-xss; http://www.securityfocus.com/bid/108645
CVE: CVE-2019-1872
Published: 2019-06-05
Description: A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper restrictions on network services in the affected software. An attacker could exploit this vulnerability by sending malicious requests to the affected system. A successful exploit could allow the attacker to send arbitrary network requests sourced from the affected system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://www.securityfocus.com/bid/108677; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-vcs; http://www.securityfocus.com/bid/108677
CVE: CVE-2019-1880
Published: 2019-06-05
Description: A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An attacker could exploit this vulnerability by executing the BIOS upgrade utility with a specific set of options. A successful exploit could allow the attacker to bypass the firmware signature-verification process and install compromised BIOS firmware on an affected device.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-345, CWE-345
References: http://www.securityfocus.com/bid/108680; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ucs-biossig-bypass; http://www.securityfocus.com/bid/108680
CVE: CVE-2019-1881
Published: 2019-06-05
Description: A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to use a web browser and the privileges of the user to perform arbitrary actions on an affected device. For more information about CSRF attacks and potential mitigations, see Understanding Cross-Site Request Forgery Threat Vectors.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/108678; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ind-csrf; http://www.securityfocus.com/bid/108678
CVE: CVE-2019-1882
Published: 2019-06-05
Description: A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The vulnerability is due to improper validation of content submitted to the affected application. An attacker could exploit this vulnerability by sending requests containing malicious values to the affected system. A successful exploit could allow the attacker to conduct XSS attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/108629; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ind-xss; http://www.securityfocus.com/bid/108629
CVE: CVE-2019-9548
Published: 2019-06-05
Description: Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control.
CVSS Score: 10.0 (CRITICAL)
References: https://support.citrix.com/article/CTX247738; https://support.citrix.com/v1/search?searchQuery=%22%22&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+Bulletin; https://support.citrix.com/article/CTX247738
CVE: CVE-2019-9642
Published: 2019-06-05
Description: An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created by the guest account, with execution via a proxy.php?hash=../../../../../var/lib/pydio/data/personal/guest/PoC.php request. This is related to plugins/action.share/src/Store/ShareStore.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-434
References: https://github.com/pydio/pydio-core/commits/develop/core/src/proxy.php; https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-823-security-release; https://github.com/pydio/pydio-core/commits/develop/core/src/proxy.php
CVE: CVE-2019-11226
Published: 2019-06-05
Description: CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2019/May/36; https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226
CVE: CVE-2019-11987
Published: 2019-06-05
Description: A security vulnerability in HPE Smart Update Manager (SUM) prior to v8.4 could allow local unauthorized elevation of privilege.
CVSS Score: 7.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03923en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03923en_us
CVE: CVE-2019-11988
Published: 2019-06-05
Description: A Remote Unauthorized Access vulnerability was identified in HPE Smart Update Manager (SUM) earlier than version 8.3.5.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03922en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03922en_us
CVE: CVE-2019-12196
Published: 2019-06-05
Description: A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/108672; https://www.manageengine.com/products/netflow/readme.html#124029; http://www.securityfocus.com/bid/108672
CVE: CVE-2019-12276
Published: 2019-06-05
Description: A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153373/GrandNode-4.40-Path-Traversal-File-Download.html; https://github.com/grandnode/grandnode; https://grandnode.com
CVE: CVE-2019-5394
Published: 2019-06-05
Description: The HPE Nonstop Maintenance Entity family of products are vulnerable to local disclosure of information, such as system layout and configuration.
CVSS Score: 5.1 (MEDIUM)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03925en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03925en_us
CVE: CVE-2019-9187
Published: 2019-06-05
Description: ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://ikiwiki.info/news/; https://ikiwiki.info/news/version_3.20190228/; https://lists.debian.org/debian-lts-announce/2019/03/msg00018.html
CVE: CVE-2019-9189
Published: 2019-06-05
Description: Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155273/Prima-Access-Control-2.3.35-Script-Upload-Remote-Code-Execution.html; https://applied-risk.com/index.php/download_file/view/199/165; https://applied-risk.com/labs/advisories
CVE: CVE-2019-12494
Published: 2019-06-05
Description: In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters to foreign shoot clusters. This occurs because traffic from shoot to seed via the VPN endpoint is not blocked.
CVSS Score: 8.5 (HIGH)
References: https://github.com/gardener/gardener/pull/874; https://github.com/gardener/vpn/issues/40; https://groups.google.com/forum/#%21topic/gardener/pH6dNIEhv-A
CVE: CVE-2019-6800
Published: 2019-06-05
Description: In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subsequently executed with root permissions. An attacker with a privileged network position is trivially able to inject arbitrary commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://write-up.github.io/CVE-2019-6800/; https://www.spamtitan.com/category/spamtitan-news/; https://write-up.github.io/CVE-2019-6800/
CVE: CVE-2019-7671
Published: 2019-06-05
Description: Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155274/Prima-Access-Control-2.3.35-Cross-Site-Scripting.html; https://applied-risk.com/index.php/download_file/view/199/165; https://applied-risk.com/labs/advisories
CVE: CVE-2019-7672
Published: 2019-06-05
Description: Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authenticated attacker to escalate privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://applied-risk.com/index.php/download_file/view/199/165; https://applied-risk.com/labs/advisories; https://applied-risk.com/resources/ar-2019-007
CVE: CVE-2019-8385
Published: 2019-06-05
Description: An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a \.. to port 6677. Additionally, this could allow for privilege escalation by dumping the affected machine's SAM and SYSTEM database files, as well as remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.html; https://www.thomsonreuters.com/en/products-services.html; http://packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.html
CVE: CVE-2019-9156
Published: 2019-06-05
Description: Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: http://seclists.org/fulldisclosure/2019/May/6; https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html; http://seclists.org/fulldisclosure/2019/May/6
CVE: CVE-2019-9157
Published: 2019-06-05
Description: Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2019/May/6; https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html; http://seclists.org/fulldisclosure/2019/May/6
CVE: CVE-2019-9158
Published: 2019-06-05
Description: Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-294
References: http://seclists.org/fulldisclosure/2019/May/6; https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html; http://seclists.org/fulldisclosure/2019/May/6
CVE: CVE-2018-10171
Published: 2019-06-05
Description: Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its `com.mackeeper.AdwareAnalyzer.AdwareAnalyzerPrivilegedHelper` component. The AdwareAnalzyerPrivilegedHelper tool implements an XPC service that allows an unprivileged application to connect and execute shell scripts as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://versprite.com/advisories/mackeeper/; https://versprite.com/advisories/mackeeper/
CVE: CVE-2018-2028
Published: 2019-06-06
Description: IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain highly sensitive information. IBM X-Force ID: 155554.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/155554; https://www.ibm.com/support/docview.wss?uid=ibm10880145; https://exchange.xforce.ibmcloud.com/vulnerabilities/155554
CVE: CVE-2019-4048
Published: 2019-06-06
Description: IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force ID: 156311.
CVSS Score: 2.1 (LOW)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/156311; https://www.ibm.com/support/docview.wss?uid=ibm10880147; https://exchange.xforce.ibmcloud.com/vulnerabilities/156311
CVE: CVE-2019-4056
Published: 2019-06-06
Description: IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. IBM X-Force ID: 156565.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/156565; https://www.ibm.com/support/docview.wss?uid=ibm10880149; https://exchange.xforce.ibmcloud.com/vulnerabilities/156565
CVE: CVE-2019-4185
Published: 2019-06-06
Description: IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component. IBM X-Force ID: 158975.
CVSS Score: 8.3 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158975; https://www.ibm.com/support/docview.wss?uid=ibm10882626; https://exchange.xforce.ibmcloud.com/vulnerabilities/158975
CVE: CVE-2019-4201
Published: 2019-06-06
Description: IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 159122.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159122; https://www.ibm.com/support/docview.wss?uid=ibm10885592; https://exchange.xforce.ibmcloud.com/vulnerabilities/159122
CVE: CVE-2019-4220
Published: 2019-06-06
Description: IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 159229.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159229; https://www.ibm.com/support/docview.wss?uid=ibm10881197; https://exchange.xforce.ibmcloud.com/vulnerabilities/159229