deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-35296
Published: 2021-03-03
Description: ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://github.com/Shrimant12/CVE-References/blob/main/CVE-2020-35296.md; https://github.com/zoujingli/ThinkAdmin; https://smshrimant.com/admin-panel-access-using-default-credentials/
CVE: CVE-2021-25252
Published: 2021-03-03
Description: Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://success.trendmicro.com/solution/000285675; https://success.trendmicro.com/solution/000285675
CVE: CVE-2021-26813
Published: 2021-03-03
Description: markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/trentm/python-markdown2/pull/387; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRP5RN35JZTSJ3JT4722F447ZDK7LZS5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J752422YELXLMLZJPVJVKD2KKHHQRVEH/
CVE: CVE-2021-27215
Published: 2021-03-03
Description: An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces (Admin, Userweb, Sidechannel) can use different methods to perform the authentication of a user. A specific authentication method during login does not check the provided data (when a certain manipulation occurs) and returns OK for any authentication request. This allows an attacker to login to the admin panel as a user of his choice, e.g., the root user (with highest privileges) or even a non-existing user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://kunde.genua.de/en/overview/genugate.html; https://sec-consult.com/vulnerability-lab/advisory/authentication-bypass-genua-genugate/; https://www.genua.de/en/it-security-solutions/high-resistance-firewall-genugate
CVE: CVE-2021-3419
Published: 2021-03-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-13554
Published: 2021-03-03
Description: An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run Key Privilege Escalation in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169
CVE: CVE-2020-14372
Published: 2021-03-03
Description: A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-184
References: https://access.redhat.com/security/vulnerabilities/RHSB-2021-003; https://bugzilla.redhat.com/show_bug.cgi?id=1873150; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/
CVE: CVE-2020-25632
Published: 2021-03-03
Description: A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1879577; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/; https://security.gentoo.org/glsa/202104-05
CVE: CVE-2020-25647
Published: 2021-03-03
Description: A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.6 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1886936; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/; https://security.gentoo.org/glsa/202104-05
CVE: CVE-2020-27749
Published: 2021-03-03
Description: A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage, without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution which could also circumvent Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1899966; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/; https://security.gentoo.org/glsa/202104-05
CVE: CVE-2020-27779
Published: 2021-03-03
Description: A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://bugzilla.redhat.com/show_bug.cgi?id=1900698; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/; https://security.gentoo.org/glsa/202104-05
CVE: CVE-2021-20076
Published: 2021-03-03
Description: Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to perform Remote Code Execution (RCE) on the Tenable.sc server via Hypertext Preprocessor unserialization.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.tenable.com/security/tns-2021-03; https://www.tenable.com/security/tns-2021-03
CVE: CVE-2021-20225
Published: 2021-03-03
Description: A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1924696; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/; https://security.gentoo.org/glsa/202104-05
CVE: CVE-2021-20233
Published: 2021-03-03
Description: A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1926263; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWZ36QK4IKU6MWDWNOOWKPH3WXZBHT2R/; https://security.gentoo.org/glsa/202104-05
CVE: CVE-2021-20441
Published: 2021-03-03
Description: IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 196617.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196617; https://www.ibm.com/support/pages/node/6421023; https://exchange.xforce.ibmcloud.com/vulnerabilities/196617
CVE: CVE-2021-20442
Published: 2021-03-03
Description: IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 196618.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196618; https://www.ibm.com/support/pages/node/6421025; https://exchange.xforce.ibmcloud.com/vulnerabilities/196618
CVE: CVE-2021-21979
Published: 2021-03-03
Description: In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APP_KEY is fixed under certain conditions. This value is crucial for the security of the application and must be randomly generated per Laravel installation. If your application's encryption key is in the hands of a malicious party, that party could craft cookie values using the encryption key and exploit vulnerabilities inherent to PHP object serialization / unserialization, such as calling arbitrary class methods within your application.
CVSS Score: 7.3 (HIGH)
CWE: CWE-798
References: https://github.com/bitnami/bitnami-docker-laravel/issues/139; https://github.com/bitnami/bitnami-docker-laravel/issues/139
CVE: CVE-2021-22638
Published: 2021-03-03
Description: Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02
CVE: CVE-2021-22662
Published: 2021-03-03
Description: A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02
CVE: CVE-2021-22666
Published: 2021-03-03
Description: Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing an attacker to craft a special project file that may permit arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02
CVE: CVE-2021-22670
Published: 2021-03-03
Description: An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02
CVE: CVE-2021-22683
Published: 2021-03-03
Description: Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-056-02
CVE: CVE-2021-27927
Published: 2021-03-03
Description: In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html; https://support.zabbix.com/browse/ZBX-18942; https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html
CVE: CVE-2020-13558
Published: 2021-03-03
Description: A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://security.gentoo.org/glsa/202104-03; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1172; https://security.gentoo.org/glsa/202104-03
CVE: CVE-2020-28591
Published: 2021-03-03
Description: An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A specially crafted AMF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBEK4H23AS6TKTGU2OTMHAZZYNECQVCB/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCSYYURJTUKJSEZIPDAXK4NHRXZMHIVA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJPM24DY36EH3HFJGAXDLGFT43VZWLJ7/
CVE: CVE-2020-28597
Published: 2021-03-03
Description: A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.
CVSS Score: 7.5 (HIGH)
CWE: CWE-337, CWE-335
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221
CVE: CVE-2020-29047
Published: 2021-03-03
Description: The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://appcheck-ng.com/cve-2020-29047/; https://wordpress.org/plugins/wp-hotel-booking/#developers; https://appcheck-ng.com/cve-2020-29047/
CVE: CVE-2020-8296
Published: 2021-03-03
Description: Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-257, CWE-521
References: https://github.com/nextcloud/server/issues/17439; https://github.com/nextcloud/server/pull/21037; https://hackerone.com/reports/867164
CVE: CVE-2021-21978
Published: 2021-03-03
Description: VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-862
References: http://packetstormsecurity.com/files/161879/VMware-View-Planner-4.6-Remote-Code-Execution.html; https://www.vmware.com/security/advisories/VMSA-2021-0003.html; http://packetstormsecurity.com/files/161879/VMware-View-Planner-4.6-Remote-Code-Execution.html
CVE: CVE-2021-22182
Published: 2021-03-03
Description: An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22182.json; https://gitlab.com/gitlab-org/gitlab/-/issues/280779; https://hackerone.com/reports/1030189
CVE: CVE-2021-22188
Published: 2021-03-03
Description: An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via branch logs.
CVSS Score: 5.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22188.json; https://gitlab.com/gitlab-org/gitlab/-/issues/227040; https://hackerone.com/reports/916340
CVE: CVE-2021-22681
Published: 2021-03-03
Description: Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-522
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03; https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22681
CVE: CVE-2021-22877
Published: 2021-03-03
Description: A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/nextcloud/server/issues/24600; https://github.com/nextcloud/server/pull/25224; https://hackerone.com/reports/1061591
CVE: CVE-2021-22878
Published: 2021-03-03
Description: Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nextcloud/server/pull/25234; https://hackerone.com/reports/896522; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6BO6P6MP2MOWA6PZRXX32PLWPXN5O4S/
CVE: CVE-2021-22883
Published: 2021-03-03
Description: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-772
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://hackerone.com/reports/1043360; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/
CVE: CVE-2021-22884
Published: 2021-03-03
Description: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
CVSS Score: 7.5 (HIGH)
CWE: CWE-350
References: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf; https://hackerone.com/reports/1069487; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/
CVE: CVE-2021-27839
Published: 2021-03-03
Description: A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-1236
References: https://github.com/bigprof-software/online-invoicing-system/releases/tag/4.4; https://www.jinsonvarghese.com/csv-injection-in-online-invoicing-system/; https://github.com/bigprof-software/online-invoicing-system/releases/tag/4.4
CVE: CVE-2021-21312
Published: 2021-03-03
Description: GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/document.form.php endpoint), indeed one of the form field: "Web Link" is not properly sanitized and a malicious user (who has document upload rights) can use it to deliver JavaScript payload. For example if you use the following payload: " accesskey="x" onclick="alert(1)" x=", the content will be saved within the database without any control. And then once you return to the summary documents page, by clicking on the "Web Link" of the newly created file it will create a new empty tab, but on the initial tab the pop-up "1" will appear.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/releases/tag/9.5.4; https://github.com/glpi-project/glpi/security/advisories/GHSA-c7f6-3mr7-3rq2; https://github.com/glpi-project/glpi/releases/tag/9.5.4