deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1489
Published: 2021-04-29
Description: A vulnerability in filesystem usage management for Cisco Firepower Device Manager (FDM) Software could allow an authenticated, remote attacker to exhaust filesystem resources, resulting in a denial of service (DoS) condition on an affected device. This vulnerability is due to the insufficient management of available filesystem resources. An attacker could exploit this vulnerability by uploading files to the device and exhausting available filesystem resources. A successful exploit could allow the attacker to cause database errors and cause the device to become unresponsive to web-based management. Manual intervention is required to free filesystem resources and return the device to an operational state.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fdm-dos-nFES8xTN; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fdm-dos-nFES8xTN
CVE: CVE-2021-1493
Published: 2021-04-29
Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks for specific data that is provided to the web services interface of an affected system. An attacker could exploit this vulnerability by sending a malicious HTTP request. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system, which could disclose data fragments or cause the device to reload, resulting in a denial of service (DoS) condition.
CVSS Score: 8.5 (HIGH)
CWE: CWE-120
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-memc-dos-fncTyYKG; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-memc-dos-fncTyYKG
CVE: CVE-2021-1495
Published: 2021-04-29
Description: Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-755
References: https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-fp-bp-KfDdcQhc; https://www.debian.org/security/2023/dsa-5354
CVE: CVE-2021-1501
Published: 2021-04-29
Description: A vulnerability in the SIP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a crash and reload of an affected device, resulting in a denial of service (DoS) condition.The vulnerability is due to a crash that occurs during a hash lookup for a SIP pinhole connection. An attacker could exploit this vulnerability by sending crafted SIP traffic through an affected device. A successful exploit could allow the attacker to cause a crash and reload of the affected device.
CVSS Score: 8.6 (HIGH)
CWE: CWE-613
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-sipdos-GGwmMerC; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-sipdos-GGwmMerC
CVE: CVE-2021-1504
Published: 2021-04-29
Description: Multiple vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to lack of proper input validation of the HTTPS request. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-vpn-dos-fpBcpEcD; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-vpn-dos-fpBcpEcD
CVE: CVE-2021-21388
Published: 2021-04-29
Description: systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.
CVSS Score: 8.9 (HIGH)
CWE: CWE-20, CWE-78, CWE-78
References: https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524; https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46; https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f
CVE: CVE-2020-22807
Published: 2021-04-29
Description: An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cloud.tencent.com/developer/article/1612208; https://cloud.tencent.com/developer/article/1612208
CVE: CVE-2020-22808
Published: 2021-04-29
Description: An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fecshop/yii2_fecshop/commit/8fac[PII_REDACTED]cfe3d81c4121d523813e28e31a; https://github.com/fecshop/yii2_fecshop/issues/87; https://github.com/fecshop/yii2_fecshop/commit/8fac[PII_REDACTED]cfe3d81c4121d523813e28e31a
CVE: CVE-2021-1080
Published: 2021-04-29
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which certain input data is not validated, which may lead to information disclosure, tampering of data, or denial of service. This affects vGPU version 12.x (prior to 12.2), version 11.x (prior to 11.4) and version 8.x (prior 8.7).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5172; https://nvidia.custhelp.com/app/answers/detail/a_id/5172
CVE: CVE-2021-1081
Published: 2021-04-29
Description: NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU manager (vGPU plugin), in which an input length is not validated, which may lead to information disclosure, tampering of data, or denial of service. This affects vGPU version 12.x (prior to 12.2), version 11.x (prior to 11.4) and version 8.x (prior 8.7).
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5172; https://nvidia.custhelp.com/app/answers/detail/a_id/5172
CVE: CVE-2021-1082
Published: 2021-04-29
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), in which an input length is not validated, which may lead to information disclosure, tampering of data, or denial of service. vGPU version 12.x (prior to 12.2), version 11.x (prior to 11.4) and version 8.x (prior to 8.7)
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5172; https://nvidia.custhelp.com/app/answers/detail/a_id/5172
CVE: CVE-2021-1083
Published: 2021-04-29
Description: NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length is not validated, which may lead to information disclosure, tampering of data, or denial of service. This affects vGPU version 12.x (prior to 12.2) and version 11.x (prior to 11.4).
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5172; https://nvidia.custhelp.com/app/answers/detail/a_id/5172
CVE: CVE-2021-1084
Published: 2021-04-29
Description: NVIDIA vGPU driver contains a vulnerability in the guest kernel mode driver and Virtual GPU Manager (vGPU plugin), in which an input length is not validated, which may lead to information disclosure, tampering of data or denial of service. This affects vGPU version 12.x (prior to 12.2) and version 11.x (prior to 11.4).
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5172; https://nvidia.custhelp.com/app/answers/detail/a_id/5172
CVE: CVE-2021-1085
Published: 2021-04-29
Description: NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to write to a shared memory location and manipulate the data after the data has been validated, which may lead to denial of service and escalation of privileges and information disclosure but attacker doesn't have control over what information is obtained. This affects vGPU version 12.x (prior to 12.2), version 11.x (prior to 11.4) and version 8.x (prior to 8.7).
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5172; https://nvidia.custhelp.com/app/answers/detail/a_id/5172
CVE: CVE-2021-1086
Published: 2021-04-29
Description: NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resources, which may lead to integrity and confidentiality loss or information disclosure. This affects vGPU version 12.x (prior to 12.2), version 11.x (prior to 11.4) and version 8.x (prior to 8.7).
CVSS Score: 7.1 (HIGH)
CWE: CWE-863
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5172; https://nvidia.custhelp.com/app/answers/detail/a_id/5172
CVE: CVE-2021-1087
Published: 2021-04-29
Description: NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin), which could allow an attacker to retrieve information that could lead to a Address Space Layout Randomization (ASLR) bypass. This affects vGPU version 12.x (prior to 12.2), version 11.x (prior to 11.4) and version 8.x (prior to 8.7).
CVSS Score: 5.5 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5172; https://nvidia.custhelp.com/app/answers/detail/a_id/5172
CVE: CVE-2020-15225
Published: 2021-04-29
Description: django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681, CWE-681
References: https://github.com/carltongibson/django-filter/commit/340cf7a23a2b3dcd7183f6a0d6c383e85b130d2b; https://github.com/carltongibson/django-filter/releases/tag/2.4.0; https://github.com/carltongibson/django-filter/security/advisories/GHSA-x7gm-rfgv-w973
CVE: CVE-2021-29468
Published: 2021-04-29
Description: Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a repository using Git on Cygwin. The problem will be patched in the Cygwin Git v2.31.1-2 release. At time of writing, the vulnerability is present in the upstream Git source code; any Cygwin user who compiles Git for themselves from upstream sources should manually apply a patch to mitigate the vulnerability. As mitigation users should not clone or pull from repositories from untrusted sources. CVE-2019-1354 was an equivalent vulnerability in Git for Visual Studio.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://cygwin.com/pipermail/cygwin-announce/2021-April/010018.html; https://github.com/me-and/Cygwin-Git/blob/main/check-backslash-safety.patch; https://github.com/me-and/Cygwin-Git/security/advisories/GHSA-rmp3-wq55-f557
CVE: CVE-2021-29484
Published: 2021-04-29
Description: Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.3.2. Immediate action should be taken to secure your site. The issue has been fixed in 4.3.3, all 4.x sites should upgrade as soon as possible. As the endpoint is unused, the patch simply removes it. As a workaround blocking access to /ghost/preview can also mitigate the issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.sonarsource.com/ghost-admin-takeover; https://forum.ghost.org/t/critical-security-update-available-for-ghost-4-x/22290; https://github.com/TryGhost/Ghost/security/advisories/GHSA-9fgx-q25h-jxrg
CVE: CVE-2020-18035
Published: 2021-04-29
Description: Cross Site Scripting (XSS) in Jeesns v1.4.2 allows remote attackers to execute arbitrary code by injecting commands into the "CKEditorFuncNum" parameter in the component "CkeditorUploadController.java".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zchuanzhao/jeesns/issues/8; https://github.com/zchuanzhao/jeesns/issues/8
CVE: CVE-2020-18070
Published: 2021-04-30
Description: Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php".
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/idreamsoft/iCMS/issues/46; https://github.com/idreamsoft/iCMS/issues/46
CVE: CVE-2021-31919
Published: 2021-04-30
Description: An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.
CVSS Score: 7.5 (HIGH)
CWE: CWE-909
References: https://rustsec.org/advisories/RUSTSEC-2021-0054.html; https://rustsec.org/advisories/RUSTSEC-2021-0054.html
CVE: CVE-2021-31870
Published: 2021-04-30
Description: An issue was discovered in klibc before 2.0.9. Multiplication in the calloc() function may result in an integer overflow and a subsequent heap buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2021/04/30/1; https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=292650f04c2b5348b4efbad61fb014ed09b4f3f2; https://kernel.org/pub/linux/libs/klibc/2.0/
CVE: CVE-2021-31871
Published: 2021-04-30
Description: An issue was discovered in klibc before 2.0.9. An integer overflow in the cpio command may result in a NULL pointer dereference on 64-bit systems.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2021/04/30/1; https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=2e48a12ab1e30d43498c2d53e878a11a1b5102d5; https://kernel.org/pub/linux/libs/klibc/2.0/
CVE: CVE-2021-31872
Published: 2021-04-30
Description: An issue was discovered in klibc before 2.0.9. Multiple possible integer overflows in the cpio command on 32-bit systems may result in a buffer overflow or other security impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2021/04/30/1; https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=9b1c91577aef7f2e72c3aa11a27749160bd278ff; https://kernel.org/pub/linux/libs/klibc/2.0/
CVE: CVE-2021-31873
Published: 2021-04-30
Description: An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2021/04/30/1; https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=a31ae8c508fc8d1bca4f57e9f9f88127572d5202; https://github.com/huolinjue/klibc/commit/a31ae8c508fc8d1bca4f57e9f9f88127572d5202
CVE: CVE-2021-20326
Published: 2021-04-30
Description: A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4.4.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-732
References: https://jira.mongodb.org/browse/SERVER-53929; https://jira.mongodb.org/browse/SERVER-53929
CVE: CVE-2021-26807
Published: 2021-04-30
Description: GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll and libwinpthread-1.dll from PATH, which allows an attacker to potentially run code locally through unsigned DLL loading.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://illuminati.services/2021/04/29/cve-2021-26807-gog-galaxy-v2-0-35-dll-load-order-hijacking/; https://www.gog.com; https://illuminati.services/2021/04/29/cve-2021-26807-gog-galaxy-v2-0-35-dll-load-order-hijacking/
CVE: CVE-2020-1721
Published: 2021-04-30
Description: A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=1777579; https://bugzilla.redhat.com/show_bug.cgi?id=1777579
CVE: CVE-2020-24918
Published: 2021-04-30
Description: A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticated attacker to send a crafted RTSP request, with a long digest authentication header, to execute arbitrary code in parse_authentication_header() in libamprotocol-rtsp.so.1 in rtsp_svc (or cause a crash). This allows remote takeover of a Furbo Dog Camera, for example. NOTE: The vendor states that the RTSP library is used for DEMO only, using it in product is a customer's behavior. Ambarella has emphasized that RTSP is DEMO only library, should NOT be used in product in our document. Because Ambarella's SDK is proprietary, we didn't publish our SDK source code in public network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/Ambarella-Inc/amba-cve-info/tree/main/cve-2020-24918; https://somersetrecon.squarespace.com/blog/2021/hacking-the-furbo-part-1; https://www.ambarella.com
CVE: CVE-2021-20266
Published: 2021-04-30
Description: A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1927741; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMGXO3W6DHPO62GJ4VVF5DEUX5DRUR5K/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHRPNBCRPDJHHQE3MBPSZK4H7X2IM7AC/
CVE: CVE-2021-28959
Published: 2021-04-30
Description: Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.manageengine.com; https://www.manageengine.com/products/eventlog/features-new.html#release; https://www.manageengine.com
CVE: CVE-2021-31231
Published: 2021-04-30
Description: The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
CVSS Score: 5.5 (MEDIUM)
References: https://community.grafana.com/c/security-announcements; https://grafana.com/docs/metrics-enterprise/; https://grafana.com/docs/metrics-enterprise/latest/downloads/#v113----april-27-2021
CVE: CVE-2021-31232
Published: 2021-04-30
Description: The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
CVSS Score: 5.5 (MEDIUM)
References: https://community.grafana.com/c/security-announcements; https://github.com/cortexproject/cortex; https://github.com/cortexproject/cortex/pull/4129/files
CVE: CVE-2020-27519
Published: 2021-04-30
Description: Pritunl Client v1.2.2550.20 contains a local privilege escalation vulnerability in the pritunl-service component. The attack vector is: malicious openvpn config. A local attacker could leverage the log and log-append along with log injection to create or append to privileged script files and execute code as root/SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/pritunl/pritunl-client-electron/commit/87ceeae9b8ee415541d7d71de10675e699a76e5e; https://github.com/pritunl/pritunl-client-electron/commit/87ceeae9b8ee415541d7d71de10675e699a76e5e#diff-5c6a264bee3576f2a147b8db70332e9a16dd43d073782cf6d32a372abb22b899; https://github.com/pritunl/pritunl-client-electron/commit/c0aeb159351e5e99d752c27b87133eca299bdfce
CVE: CVE-2020-15153
Published: 2021-04-30
Description: Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for details and a workaround. This is fixed in version 4.2.2 and the development branch.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://github.com/ampache/ampache/commit/e92cb6154c32c513b9c07e5fdbf5ac7de81ef5ed; https://github.com/ampache/ampache/releases/tag/4.2.2; https://github.com/ampache/ampache/security/advisories/GHSA-phr3-mpx5-7826
CVE: CVE-2020-4039
Published: 2021-04-30
Description: SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation. Any admin config and file readable by the app can be retrieved by the attacker. Furthermore, some files can also be moved or deleted.
CVSS Score: 8.6 (HIGH)
CWE: CWE-23, CWE-22
References: https://github.com/fossasia/susi_server/security/advisories/GHSA-wcm4-2jp5-q269; https://github.com/fossasia/susi_server/security/advisories/GHSA-wcm4-2jp5-q269