deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45028
Published: 2024-09-11
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: mmc_test: Fix NULL dereference on allocation failure

If the "test->highmem = alloc_pages()" allocation fails then calling
__free_pages(test->highmem) will result in a NULL dereference.  Also
change the error code to -ENOMEM instead of returning success.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2b507b03991f44dfb202fc2a82c9874d1b1f0c06; https://git.kernel.org/stable/c/3b4e76ceae5b5a46c968bd952f551ce173809f63; https://git.kernel.org/stable/c/9b9ba386d7bfdbc38445932c90fa9444c0524bea
CVE: CVE-2024-45029
Published: 2024-09-11
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: tegra: Do not mark ACPI devices as irq safe

On ACPI machines, the tegra i2c module encounters an issue due to a
mutex being called inside a spinlock. This leads to the following bug:

	BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
	...

	Call trace:
	__might_sleep
	__mutex_lock_common
	mutex_lock_nested
	acpi_subsys_runtime_resume
	rpm_resume
	tegra_i2c_xfer

The problem arises because during __pm_runtime_resume(), the spinlock
&dev->power.lock is acquired before rpm_resume() is called. Later,
rpm_resume() invokes acpi_subsys_runtime_resume(), which relies on
mutexes, triggering the error.

To address this issue, devices on ACPI are now marked as not IRQ-safe,
considering the dependency of acpi_subsys_runtime_resume() on mutexes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/14d069d92951a3e150c0a81f2ca3b93e54da913b; https://git.kernel.org/stable/c/2853e1376d8161b04c9ff18ba82b43f08a049905; https://git.kernel.org/stable/c/6861faf4232e4b78878f2de1ed3ee324ddae2287
CVE: CVE-2024-45030
Published: 2024-09-11
Description: In the Linux kernel, the following vulnerability has been resolved:

igb: cope with large MAX_SKB_FRAGS

Sabrina reports that the igb driver does not cope well with large
MAX_SKB_FRAG values: setting MAX_SKB_FRAG to 45 causes payload
corruption on TX.

An easy reproducer is to run ssh to connect to the machine.  With
MAX_SKB_FRAGS=17 it works, with MAX_SKB_FRAGS=45 it fails.  This has
been reported originally in
https://bugzilla.redhat.com/show_bug.cgi?id=2265320

The root cause of the issue is that the driver does not take into
account properly the (possibly large) shared info size when selecting
the ring layout, and will try to fit two packets inside the same 4K
page even when the 1st fraglist will trump over the 2nd head.

Address the issue by checking if 2K buffers are insufficient.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/8aba27c4a5020abdf[PII_REDACTED]8297f88338a8d; https://git.kernel.org/stable/c/8ea80ff5d8298356d28077bc30913ed37df65109; https://git.kernel.org/stable/c/b52bd8bcb9e8ff250c79b44f9af8b15cae8911ab
CVE: CVE-2024-46672
Published: 2024-09-11
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion

wpa_supplicant 2.11 sends since 1efdba5fdc2c ("Handle PMKSA flush in the
driver for SAE/OWE offload cases") SSID based PMKSA del commands.
brcmfmac is not prepared and tries to dereference the NULL bssid and
pmkid pointers in cfg80211_pmksa. PMKID_V3 operations support SSID based
updates so copy the SSID.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1f566eb912d192c83475a919331aea59619e1197; https://git.kernel.org/stable/c/2ad4e1ada8eebafa2d75a4b75eeeca882de6ada1; https://git.kernel.org/stable/c/4291f94f8c6b01505132c22ee27b59ed27c3584f
CVE: CVE-2024-5760
Published: 2024-09-11
Description: The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool. This is only applicable for products in the application released or manufactured before 2018.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_1[PII_REDACTED]9645-16/hpsbpi03970
CVE: CVE-2024-7312
Published: 2024-09-11
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://docs.payara.fish/enterprise/docs/5.67.0/Release%20Notes/Release%20Notes%205.67.0.html; https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.18.0.html
CVE: CVE-2024-20304
Published: 2024-09-11
Description: A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device.

This vulnerability exists because the Mtrace2 code does not properly handle packet memory. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to exhaust the incoming UDP packet memory. The affected device would not be able to process higher-level UDP-based protocols packets, possibly causing a denial of service (DoS) condition.
Note: This vulnerability can be exploited using IPv4 or IPv6.
CVSS Score: 8.6 (HIGH)
CWE: CWE-401, CWE-401
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFy
CVE: CVE-2024-20317
Published: 2024-09-11
Description: A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in a denial of service (DoS) condition.

This vulnerability is due to incorrect classification of certain types of Ethernet frames that are received on an interface. An attacker could exploit this vulnerability by sending specific types of Ethernet frames to or through the affected device. A successful exploit could allow the attacker to cause control plane protocol relationships to fail, resulting in a DoS condition. For more information, see the  section of this advisory.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-684
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-l2services-2mvHdNuC
CVE: CVE-2024-20343
Published: 2024-09-11
Description: A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device.

This vulnerability is due to incorrect validation of the arguments that are passed to a specific CLI command. An attacker could exploit this vulnerability by logging in to an affected device with low-privileged credentials and using the affected command. A successful exploit could allow the attacker access files in read-only mode on the Linux file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-shellutil-HCb278wD
CVE: CVE-2024-20381
Published: 2024-09-11
Description: A vulnerability in the JSON-RPC API feature in Cisco Crosswork Network Services Orchestrator (NSO) and ConfD that is used by the web-based management interfaces of Cisco Optical Site Manager and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device.&nbsp;

This vulnerability is due to improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-auth-bypass-QnTEesp
CVE: CVE-2024-20390
Published: 2024-09-11
Description: A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751.

This vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could exploit this vulnerability by sending a sustained, crafted stream of XML traffic to a targeted device. A successful exploit could allow the attacker to cause XML TCP port 38751 to become unreachable while the attack traffic persists.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-940
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-xml-tcpdos-ZEXvrU2S
CVE: CVE-2024-20398
Published: 2024-09-11
Description: A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on the underlying operating system of an affected device.

This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-CrG5vhCq
CVE: CVE-2024-20406
Published: 2024-09-11
Description: A vulnerability in the segment routing feature for the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending specific IS-IS packets to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the IS-IS process on all affected devices that are participating in the Flexible Algorithm to crash and restart, resulting in a DoS condition.
Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and must have formed an adjacency. This vulnerability affects segment routing for IS-IS over IPv4 and IPv6 control planes as well as devices that are configured as level 1, level 2, or multi-level routing IS-IS type.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-xehpbVNe
CVE: CVE-2024-20483
Published: 2024-09-11
Description: Multiple vulnerabilities in Cisco Routed PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, could allow an authenticated, remote attacker with Administrator-level privileges on the PON Manager or direct access to the PON Manager MongoDB instance to perform command injection attacks on the PON Controller container and execute arbitrary commands as root.

These vulnerabilities are due to insufficient validation of arguments that are passed to specific configuration commands. An attacker could exploit these vulnerabilities by including crafted input as the argument of an affected configuration command. A successful exploit could allow the attacker to execute arbitrary commands as root on the PON controller.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ponctlr-ci-OHcHmsFL
CVE: CVE-2024-20489
Published: 2024-09-11
Description: A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials.

This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running Cisco IOS XR Software. An attacker could exploit this vulnerability by accessing the configuration files on an affected system. A successful exploit could allow the attacker to view MongoDB credentials.
CVSS Score: 8.4 (HIGH)
CWE: CWE-256, CWE-522
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ponctlr-ci-OHcHmsFL
CVE: CVE-2024-44570
Published: 2024-09-11
Description: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a code injection vulnerability via the getParams function in phpinf.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://system-on-chip.com; https://www.relyum.com/web/support/vulnerability-report/
CVE: CVE-2024-44571
Published: 2024-09-11
Description: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain incorrect access control in the mService function at phpinf.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://system-on-chip.com; https://www.relyum.com/web/support/vulnerability-report/
CVE: CVE-2024-44572
Published: 2024-09-11
Description: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sys_mgmt function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://system-on-chip.com; https://www.relyum.com/web/support/vulnerability-report/
CVE: CVE-2024-44573
Published: 2024-09-11
Description: A stored cross-site scripting (XSS) vulnerability in the VLAN configuration of RELY-PCIe v22.2.1 to v23.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: http://system-on-chip.com; https://www.relyum.com/web/support/vulnerability-report/
CVE: CVE-2024-44574
Published: 2024-09-11
Description: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sys_conf function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://system-on-chip.com; https://www.relyum.com/web/support/vulnerability-report/
CVE: CVE-2024-44575
Published: 2024-09-11
Description: RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.
CVSS Score: 3.7 (LOW)
CWE: CWE-732
References: http://system-on-chip.com; https://www.relyum.com/web/support/vulnerability-report/
CVE: CVE-2024-44577
Published: 2024-09-11
Description: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the time_date function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://system-on-chip.com; https://www.relyum.com/web/support/vulnerability-report/
CVE: CVE-2024-8097
Published: 2024-09-11
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.20.0 before 5.67.0, from 5.2020.2 before 5.2022.5, from 4.1.2.191.0 before 4.1.2.191.50.
CWE: CWE-200
References: https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%206.2024.9.html; https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.18.0.html
CVE: CVE-2024-8686
Published: 2024-09-11
Description: A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://security.paloaltonetworks.com/CVE-2024-8686
CVE: CVE-2024-8687
Published: 2024-09-11
Description: An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.
CVSS Score: 7.1 (HIGH)
CWE: CWE-497
References: https://security.paloaltonetworks.com/CVE-2024-8687
CVE: CVE-2024-8688
Published: 2024-09-11
Description: An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators (including read-only administrators) with access to the CLI to to read arbitrary files on the firewall.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-155
References: https://security.paloaltonetworks.com/CVE-2024-8688
CVE: CVE-2024-8689
Published: 2024-09-11
Description: A problem with the ActiveMQ integration for both Cortex XSOAR and Cortex XSIAM can result in the cleartext exposure of the configured ActiveMQ credentials in log bundles.
CWE: CWE-312
References: https://security.paloaltonetworks.com/CVE-2024-8689
CVE: CVE-2024-8690
Published: 2024-09-11
Description: A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-440
References: https://security.paloaltonetworks.com/CVE-2024-8690
CVE: CVE-2024-8691
Published: 2024-09-11
Description: A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vulnerability are disconnected from GlobalProtect. Upon exploitation, PAN-OS logs indicate that the impersonated user authenticated to GlobalProtect, which hides the identity of the attacker.
CVSS Score: 7.1 (HIGH)
CWE: CWE-863, CWE-863
References: https://security.paloaltonetworks.com/CVE-2024-8691
CVE: CVE-2024-42760
Published: 2024-09-11
Description: SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain sensitive information via the /api/mob/instrucao/conta/destinatarios component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://csflabs.github.io/cve/2024/09/10/cve-2024-42760-sql-injection-in-ellevo-API.html; https://ellevo.com/
CVE: CVE-2024-44541
Published: 2024-09-11
Description: evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/evilnapsis/inventio-lite; https://github.com/pointedsec/CVE-2024-44541/
CVE: CVE-2024-8692
Published: 2024-09-11
Description: A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-640
References: https://vuldb.com/?ctiid.277165; https://vuldb.com/?id.277165; https://vuldb.com/?submit.401715
CVE: CVE-2024-8693
Published: 2024-09-11
Description: A vulnerability, which was classified as problematic, has been found in Kaon CG3000 1.01.43. Affected by this issue is some unknown functionality of the component dhcpcd Command Handler. The manipulation of the argument -h with the input <script>alert('XSS')</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/peritocibernetico/ClaroDHCPXSS/; https://vuldb.com/?ctiid.277166; https://vuldb.com/?id.277166
CVE: CVE-2024-8694
Published: 2024-09-11
Description: A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.8 (LOW)
CWE: CWE-22
References: https://gitee.com/heyewei/JFinalcms/issues/IAOKSQ; https://github.com/wave-to/SomeCms/blob/main/JFinalCMS.md; https://vuldb.com/?ctiid.277167
CVE: CVE-2024-7889
Published: 2024-09-11
Description: Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
CVSS Score: 7.3 (HIGH)
CWE: CWE-664
References: https://support.citrix.com/s/article/CTX691485-citrix-workspace-app-for-windows-security-bulletin-cve20247889-and-cve20247890?language=en_US
CVE: CVE-2024-7890
Published: 2024-09-11
Description: Local privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://support.citrix.com/s/article/CTX691485-citrix-workspace-app-for-windows-security-bulletin-cve20247889-and-cve20247890?language=en_US
CVE: CVE-2024-8705
Published: 2024-09-11
Description: A vulnerability was found in Shandong Star Measurement and Control Equipment Heating Network Wireless Monitoring System 5.6.2 and classified as critical. Affected by this issue is the function GetDataKindByType of the file /DataSrvs/UCCGSrv.asmx. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.277214; https://vuldb.com/?id.277214; https://vuldb.com/?submit.402236
CVE: CVE-2024-28981
Published: 2024-09-12
Description: Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when searching metadata injectable fields.
CVSS Score: 8.5 (HIGH)
CWE: CWE-522
References: https://support.pentaho.com/hc/en-us/articles/[PII_REDACTED]7261--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-1-0-0-including-9-3-x-and-8-3-x-impacted-CVE-2024-28981
CVE: CVE-2024-8706
Published: 2024-09-12
Description: A vulnerability was found in JFinalCMS up to 20240903. It has been classified as problematic. This affects the function update of the file /admin/template/update of the component com.cms.util.TemplateUtils. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://gitee.com/heyewei/JFinalcms/issues/IAOSJG; https://github.com/xingjiuW/cve/blob/main/wh.md; https://vuldb.com/?ctiid.277215
CVE: CVE-2024-8707
Published: 2024-09-12
Description: A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 3.0.6. It has been declared as problematic. This vulnerability affects the function downfile of the file application/admin/controller/Appadmin.php. The manipulation of the argument url leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.277216; https://vuldb.com/?id.277216; https://vuldb.com/?submit.402917