deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3674
Published: 2020-09-09
Description: Information can leak into userspace due to improper transfer of data from kernel to userspace in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in Nicobar, QCS405, Saipan, SC8180X, SDX55, SM8150, SM8250, SXR2130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2020-bulletin
CVE: CVE-2020-3679
Published: 2020-09-09
Description: u'During execution after Address Space Layout Randomization is turned on for QTEE, part of code is still mapped at known address including code segments' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Bitra, Kamorta, Nicobar, QCS404, QCS610, Rennell, SA6155P, SA8155P, Saipan, SC7180, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 5.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/september-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2020-bulletin
CVE: CVE-2020-5627
Published: 2020-09-09
Description: Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://jvn.jp/en/jp/JVN77402327/index.html; https://www.tenable.com/cve/CVE-2020-5627; https://jvn.jp/en/jp/JVN77402327/index.html
CVE: CVE-2020-7319
Published: 2020-09-09
Description: Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local users to access files which the user otherwise would not have access to via manipulating symbolic links to redirect McAfee file operations to an unintended file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10327; https://kc.mcafee.com/corporate/index?page=content&id=SB10327
CVE: CVE-2020-7320
Published: 2020-09-09
Description: Protection Mechanism Failure vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local administrator to temporarily reduce the detection capability allowing otherwise detected malware to run via stopping certain Microsoft services.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-693
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10327; https://kc.mcafee.com/corporate/index?page=content&id=SB10327
CVE: CVE-2020-7322
Published: 2020-09-09
Description: Information Disclosure Vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local users to gain access to sensitive information via incorrectly logging of sensitive information in debug logs.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10327; https://kc.mcafee.com/corporate/index?page=content&id=SB10327
CVE: CVE-2020-7323
Published: 2020-09-09
Description: Authentication Protection Bypass vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows physical local users to bypass the Windows lock screen via triggering certain detection events while the computer screen is locked and the McTray.exe is running with elevated privileges. This issue is timing dependent and requires physical access to the machine.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10327; https://kc.mcafee.com/corporate/index?page=content&id=SB10327
CVE: CVE-2020-7324
Published: 2020-09-09
Description: Improper Access Control vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to bypass security mechanisms and deny access to the SYSTEM folder via incorrectly applied permissions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10328; https://kc.mcafee.com/corporate/index?page=content&id=SB10328
CVE: CVE-2020-7325
Published: 2020-09-09
Description: Privilege Escalation vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to access files which the user otherwise would not have access to via manipulating symbolic links to redirect McAfee file operations to an unintended file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10328; https://kc.mcafee.com/corporate/index?page=content&id=SB10328
CVE: CVE-2020-14342
Published: 2020-09-09
Description: It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-77, CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00109.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14342; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUMRICFXJVCBBOSKZSKT3HFVQM6VPJU3/
CVE: CVE-2020-6283
Published: 2020-09-09
Description: SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting (XSS) vulnerability. With a successful attack, the attacker can steal authentication information of the user, such as data relating to his or her current session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2865229; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://launchpad.support.sap.com/#/notes/2865229
CVE: CVE-2020-6288
Published: 2020-09-09
Description: SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload any file (including script files) without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker can modify some formulas and display erroneous content. The server is not affected only the current user browser session, that can easily be closed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://launchpad.support.sap.com/#/notes/2930128; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://launchpad.support.sap.com/#/notes/2930128
CVE: CVE-2020-6302
Published: 2020-09-09
Description: SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session Fixation and complete compromise of the confidentiality, integrity and availability of the application.
CVSS Score: 8.1 (HIGH)
CWE: CWE-384
References: https://launchpad.support.sap.com/#/notes/2934451; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://launchpad.support.sap.com/#/notes/2934451
CVE: CVE-2020-6312
Published: 2020-09-09
Description: SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), versions - 4.1, 4.2, allows an attacker with a non-administrative user account that can edit certain web page properties, can modify how a browser processes particular page elements, leading to stored Cross Site Scripting. In certain situations, when a user accesses an affected web page element, the attacker will be able to access or modify metadata for which they are not authorized.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2930128; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://launchpad.support.sap.com/#/notes/2930128
CVE: CVE-2020-6313
Published: 2020-09-09
Description: SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with special roles to store malicious content, that when accessed by a victim, can perform malicious actions by executing JavaScript, leading to Stored Cross-Site Scripting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-116
References: https://launchpad.support.sap.com/#/notes/2953112; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://launchpad.support.sap.com/#/notes/2953112
CVE: CVE-2020-6314
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1141/
CVE: CVE-2020-6318
Published: 2020-09-09
Description: A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (> release 7.40).Because of this, an attacker can exploit these products via Code Injection, and potentially enabling to take complete control of the products, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the products to terminate.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html; http://seclists.org/fulldisclosure/2022/May/42; https://launchpad.support.sap.com/#/notes/2958563
CVE: CVE-2020-6320
Published: 2020-09-09
Description: SAP Marketing (Servlet), version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted. Limited knowledge of payload is required for an attacker to exploit the vulnerability and perform tasks related to contact and interaction data which impacts Confidentiality and Integrity of data in the application.
CVSS Score: 8.1 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2961991; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://launchpad.support.sap.com/#/notes/2961991
CVE: CVE-2020-6321
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-824
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1140/
CVE: CVE-2020-6322
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1139/
CVE: CVE-2020-6326
Published: 2020-09-09
Description: SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2953112; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://launchpad.support.sap.com/#/notes/2953112
CVE: CVE-2020-6327
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-190
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1138/
CVE: CVE-2020-6328
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1137/
CVE: CVE-2020-6329
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1136/
CVE: CVE-2020-6330
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1135/
CVE: CVE-2020-6331
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1142/
CVE: CVE-2020-6332
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1143/
CVE: CVE-2020-6333
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1144/
CVE: CVE-2020-6334
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SKP file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-416
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1145/
CVE: CVE-2020-6335
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1146/
CVE: CVE-2020-6336
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1159/
CVE: CVE-2020-6337
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HDR file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1155/
CVE: CVE-2020-6338
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RH file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1157/
CVE: CVE-2020-6339
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1156/
CVE: CVE-2020-6340
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1154/
CVE: CVE-2020-6341
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated EPS file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1153/
CVE: CVE-2020-6342
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1152/
CVE: CVE-2020-6343
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated EPS file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1151/
CVE: CVE-2020-6344
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1150/
CVE: CVE-2020-6345
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TGA file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1160/
CVE: CVE-2020-6346
Published: 2020-09-09
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://launchpad.support.sap.com/#/notes/2960815; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://www.zerodayinitiative.com/advisories/ZDI-20-1163/