deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28574
Published: 2020-11-18
Description: A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://success.trendmicro.com/solution/000281948; https://www.tenable.com/security/research/tra-2020-62; https://success.trendmicro.com/solution/000281948
CVE: CVE-2020-28578
Published: 2020-11-18
Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://success.trendmicro.com/solution/000281954; https://www.tenable.com/security/research/tra-2020-63; https://success.trendmicro.com/solution/000281954
CVE: CVE-2020-28579
Published: 2020-11-18
Description: A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://success.trendmicro.com/solution/000281954; https://www.tenable.com/security/research/tra-2020-63; https://success.trendmicro.com/solution/000281954
CVE: CVE-2020-28580
Published: 2020-11-18
Description: A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://success.trendmicro.com/solution/000281954; https://www.tenable.com/security/research/tra-2020-63; https://success.trendmicro.com/solution/000281954
CVE: CVE-2020-28581
Published: 2020-11-18
Description: A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://success.trendmicro.com/solution/000281954; https://www.tenable.com/security/research/tra-2020-63; https://success.trendmicro.com/solution/000281954
CVE: CVE-2020-3419
Published: 2020-11-18
Description: A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearing on the participant list. This vulnerability is due to improper handling of authentication tokens by a vulnerable Webex site. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Cisco Webex Meetings Server site. A successful exploit requires the attacker to have access to join a Webex meeting, including applicable meeting join links and passwords. The attacker could then exploit this vulnerability to join meetings, without appearing in the participant list, while having full access to audio, video, chat, and screen sharing capabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-913, CWE-913
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-auth-token-3vg57A5r; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-auth-token-3vg57A5r
CVE: CVE-2020-3441
Published: 2020-11-18
Description: A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to view sensitive information from the meeting room lobby. This vulnerability is due to insufficient protection of sensitive participant information. An attacker could exploit this vulnerability by browsing the Webex roster. A successful exploit could allow the attacker to gather information about other Webex participants, such as email address and IP address, while waiting in the lobby.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-infodisc-4tvQzn4; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-infodisc-4tvQzn4
CVE: CVE-2020-3470
Published: 2020-11-18
Description: Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerabilities are due to improper boundary checks for certain user-supplied input. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the API subsystem of an affected system. When this request is processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying operating system (OS).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-api-rce-UXwpeDHd; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-api-rce-UXwpeDHd
CVE: CVE-2020-3471
Published: 2020-11-18
Description: A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to maintain bidirectional audio despite being expelled from an active Webex session. The vulnerability is due to a synchronization issue between meeting and media services on a vulnerable Webex site. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Cisco Webex Meetings Server site. A successful exploit could allow the attacker to maintain the audio connection of a Webex session despite being expelled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-662
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-info-leak-PhpzB3sG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-info-leak-PhpzB3sG
CVE: CVE-2020-3482
Published: 2020-11-18
Description: A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker to bypass security controls and send network traffic to restricted destinations. The vulnerability is due to improper validation of specific connection information by the TURN server within the affected software. An attacker could exploit this issue by sending specially crafted network traffic to the affected software. A successful exploit could allow the attacker to send traffic through the affected software to destinations beyond the application, possibly allowing the attacker to gain unauthorized network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-Expressway-8J3yZ7hV; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-Expressway-8J3yZ7hV
CVE: CVE-2020-3531
Published: 2020-11-18
Description: A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to access the back-end database of an affected system. The vulnerability exists because the affected software does not properly authenticate REST API calls. An attacker could exploit this vulnerability by obtaining a cross-site request forgery (CSRF) token and then using the token with REST API requests. A successful exploit could allow the attacker to access the back-end database of the affected device and read, alter, or drop information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-BCK-GHkPNZ5F; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-BCK-GHkPNZ5F
CVE: CVE-2020-3586
Published: 2020-11-18
Description: A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underling operating system with privileges of the web-based management application, which is running as a restricted user. This could result in changes being made to pages served by the web-based management application impacting the integrity or availability of the web-based management application.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dna-cmd-injection-rrAYzOwc; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dna-cmd-injection-rrAYzOwc
CVE: CVE-2020-15301
Published: 2020-11-18
Description: SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-010; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-010
CVE: CVE-2020-25454
Published: 2020-11-18
Description: Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/160107/Grocy-Household-Management-Solution-2.7.1-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/160107/Grocy-Household-Management-Solution-2.7.1-Cross-Site-Scripting.html
CVE: CVE-2020-13799
Published: 2020-11-18
Description: Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage device interfaces, including all versions of eMMC, UFS, and NVMe. The RPMB protocol is specified by industry standards bodies and is implemented by storage devices from multiple vendors to assist host systems in securing trusted firmware. Several scenarios have been identified in which the RPMB state may be affected by an attacker without the knowledge of the trusted component that uses the RPMB feature.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-294
References: https://www.kb.cert.org/vuls/id/231329; https://www.kb.cert.org/vuls/id/231329; https://www.westerndigital.com/support/productsecurity/wdc-20008-replay-attack-vulnerabilities-rpmb-protocol-applications
CVE: CVE-2020-14208
Published: 2020-11-18
Description: SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-008; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-008
CVE: CVE-2020-15300
Published: 2020-11-18
Description: SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-009; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-009
CVE: CVE-2020-22723
Published: 2020-11-18
Description: A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to the delivery address.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://baijiahao.baidu.com/s?id=[PII_REDACTED]34824406&wfr=spider&for=pc; https://www.freebuf.com/articles/web/192318.html; https://baijiahao.baidu.com/s?id=[PII_REDACTED]34824406&wfr=spider&for=pc
CVE: CVE-2020-26215
Published: 2020-11-18
Description: Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/jupyter/notebook/commit/3cec4bbe21756de9f0c4bccf18cf61d840314d74; https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh; https://lists.debian.org/debian-lts-announce/2020/12/msg00004.html
CVE: CVE-2020-26226
Published: 2020-11-18
Description: In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-116
References: https://github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5a; https://github.com/semantic-release/semantic-release/security/advisories/GHSA-r2j6-p67h-q639; https://github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5a
CVE: CVE-2020-12593
Published: 2020-11-18
Description: Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data.
CVSS Score: 7.5 (HIGH)
References: https://support.broadcom.com/security-advisory/content/security-advisories/Symantec-Endpoint-Detection-Response-Security-Update/SYMSA16562; https://support.broadcom.com/security-advisory/content/security-advisories/Symantec-Endpoint-Detection-Response-Security-Update/SYMSA16562
CVE: CVE-2019-12412
Published: 2020-11-19
Description: A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://bugs.debian.org/939937; https://lists.apache.org/thread.html/rce5814279a615d4a17c870a3c5b77f57975874d382ffee0b73b7f9da%40%3Cmodperl.perl.apache.org%3E; https://bugs.debian.org/939937
CVE: CVE-2020-13355
Published: 2020-11-19
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13355.json; https://gitlab.com/gitlab-org/gitlab/-/issues/255886; https://hackerone.com/reports/990800
CVE: CVE-2020-13356
Published: 2020-11-19
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read files in certain specific paths on the server. Affected versions are: >=8.8.9, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
CVSS Score: 8.2 (HIGH)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13356.json; https://gitlab.com/gitlab-org/gitlab/-/issues/230878; https://hackerone.com/reports/927953
CVE: CVE-2020-13359
Published: 2020-11-19
Description: The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
CVSS Score: 7.6 (HIGH)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13359.json; https://gitlab.com/gitlab-org/gitlab/-/issues/250266; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13359.json
CVE: CVE-2020-13360
Published: 2020-11-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-5947
Published: 2020-11-19
Description: In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that can be reused in future connections with the same source and destination port and IP numbers. Only these platforms are affected: BIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-IP i2000 series (C117), BIG-IP i4000 series (C115), BIG-IP Virtual Edition (VE).
CVSS Score: 4.3 (MEDIUM)
References: https://support.f5.com/csp/article/K64571774; https://support.f5.com/csp/article/K64571774
CVE: CVE-2020-8277
Published: 2020-11-19
Description: A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://hackerone.com/reports/1033107; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7WH7W46OZSEUHWBHD7TCH3LRFY52V6Z/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEJBY3RJB3XWUOJFGZM5E3EMQ7MFM3UT/
CVE: CVE-2020-8278
Published: 2020-11-19
Description: Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://hackerone.com/reports/921717; https://nextcloud.com/security/advisory/?id=NC-SA-2020-042; https://hackerone.com/reports/921717
CVE: CVE-2020-8279
Published: 2020-11-19
Description: Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://hackerone.com/reports/915585; https://nextcloud.com/security/advisory/?id=NC-SA-2020-043; https://hackerone.com/reports/915585
CVE: CVE-2019-20933
Published: 2020-11-19
Description: InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0; https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6; https://github.com/influxdata/influxdb/issues/12927
CVE: CVE-2020-15710
Published: 2020-11-19
Description: Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/module-bluez5-device.c. Fixed in 1:8.0-0ubuntu3.14.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://launchpad.net/bugs/1884738; https://ubuntu.com/USN-4519-1; https://launchpad.net/bugs/1884738
CVE: CVE-2020-11829
Published: 2020-11-19
Description: Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.codebook V2.0.0_5493e40_200722.
CVSS Score: 9.8 (CRITICAL)
References: https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]836189696; https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]836189696
CVE: CVE-2020-11830
Published: 2020-11-19
Description: QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0.
CVSS Score: 9.8 (CRITICAL)
References: https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]836189696; https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]836189696
CVE: CVE-2020-11831
Published: 2020-11-19
Description: OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]836189696; https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE[PII_REDACTED]836189696
CVE: CVE-2020-28054
Published: 2020-11-19
Description: JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Collector component is not properly validating an authenticated session with the Viewer. If the Viewer has been modified (binary patched) and the Bypass Login functionality is being used, an attacker can request every Collector's functionality as if they were a properly logged-in user: administrating connected instances, reviewing logs, editing configurations, accessing the instances' consoles, accessing hardware configurations, etc.Exploiting this vulnerability won't grant an attacker access nor control on remote ISP servers as no credentials is sent with the request.
CVSS Score: 7.5 (HIGH)
References: https://tsmmanager.com; https://voidsec.com; https://voidsec.com/tivoli-madness/
CVE: CVE-2020-4701
Published: 2020-11-19
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187078; https://www.ibm.com/support/pages/node/6370025; https://exchange.xforce.ibmcloud.com/vulnerabilities/187078
CVE: CVE-2020-4718
Published: 2020-11-19
Description: IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187731.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187731; https://www.ibm.com/support/pages/node/6370099; https://exchange.xforce.ibmcloud.com/vulnerabilities/187731
CVE: CVE-2020-9049
Published: 2020-11-19
Description: A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285, CWE-287
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories