deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-52607
Published: 2024-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/mm: Fix null-pointer dereference in pgtable_cache_add

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure. Ensure the allocation was successful
by checking the pointer validity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/145febd85c3bcc5c74d87ef9a598fc7d9122d532; https://git.kernel.org/stable/c/21e45a7b08d7cd98d6a53c5fc5111879f2d96611; https://git.kernel.org/stable/c/aa28eecb43cac6e20ef14dfc50b8892c1fbcda5b
CVE: CVE-2024-26623
Published: 2024-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

pds_core: Prevent race issues involving the adminq

There are multiple paths that can result in using the pdsc's
adminq.

[1] pdsc_adminq_isr and the resulting work from queue_work(),
    i.e. pdsc_work_thread()->pdsc_process_adminq()

[2] pdsc_adminq_post()

When the device goes through reset via PCIe reset and/or
a fw_down/fw_up cycle due to bad PCIe state or bad device
state the adminq is destroyed and recreated.

A NULL pointer dereference can happen if [1] or [2] happens
after the adminq is already destroyed.

In order to fix this, add some further state checks and
implement reference counting for adminq uses. Reference
counting was used because multiple threads can attempt to
access the adminq at the same time via [1] or [2]. Additionally,
multiple clients (i.e. pds-vfio-pci) can be using [2]
at the same time.

The adminq_refcnt is initialized to 1 when the adminq has been
allocated and is ready to use. Users/clients of the adminq
(i.e. [1] and [2]) will increment the refcnt when they are using
the adminq. When the driver goes into a fw_down cycle it will
set the PDSC_S_FW_DEAD bit and then wait for the adminq_refcnt
to hit 1. Setting the PDSC_S_FW_DEAD before waiting will prevent
any further adminq_refcnt increments. Waiting for the
adminq_refcnt to hit 1 allows for any current users of the adminq
to finish before the driver frees the adminq. Once the
adminq_refcnt hits 1 the driver clears the refcnt to signify that
the adminq is deleted and cannot be used. On the fw_up cycle the
driver will once again initialize the adminq_refcnt to 1 allowing
the adminq to be used again.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/22cd6046eb2148b[PII_REDACTED]834dd45c672a1b; https://git.kernel.org/stable/c/5939feb63ea1f011027576c64b68b681cbad31ca; https://git.kernel.org/stable/c/7e82a8745b951b1e794cc780d46f3fbee5e93447
CVE: CVE-2024-26624
Published: 2024-03-06
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-26627
Published: 2024-03-06
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler

Inside scsi_eh_wakeup(), scsi_host_busy() is called & checked with host
lock every time for deciding if error handler kthread needs to be waken up.

This can be too heavy in case of recovery, such as:

 - N hardware queues

 - queue depth is M for each hardware queue

 - each scsi_host_busy() iterates over (N * M) tag/requests

If recovery is triggered in case that all requests are in-flight, each
scsi_eh_wakeup() is strictly serialized, when scsi_eh_wakeup() is called
for the last in-flight request, scsi_host_busy() has been run for (N * M -
1) times, and request has been iterated for (N*M - 1) * (N * M) times.

If both N and M are big enough, hard lockup can be triggered on acquiring
host lock, and it is observed on mpi3mr(128 hw queues, queue depth 8169).

Fix the issue by calling scsi_host_busy() outside the host lock. We don't
need the host lock for getting busy count because host the lock never
covers that.

[mkp: Drop unnecessary 'busy' variables pointed out by Bart]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/07e3ca0f17f579491b5f54e9ed05173d6c1d6fcb; https://git.kernel.org/stable/c/4373534a9850627a[PII_REDACTED]898eb1283a2db0; https://git.kernel.org/stable/c/65ead8468c21c2676d4d06f50b46beffdea69df1
CVE: CVE-2024-26628
Published: 2024-03-06
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-2211
Published: 2024-03-06
Description: Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-gophish-admin-panel; https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-gophish-admin-panel
CVE: CVE-2024-1224
Published: 2024-03-06
Description: This vulnerability exists in USB Pratirodh due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. A local attacker with administrative privileges could exploit this vulnerability to obtain the password of USB Pratirodh on the targeted system.

Successful exploitation of this vulnerability could allow the attacker to take control of the application and modify the access control of registered users or devices on the targeted system.

CVSS Score: 7.1 (HIGH)
CWE: CWE-326
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0080; https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0080
CVE: CVE-2024-25102
Published: 2024-03-06
Description: This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. An attacker with local administrative privileges could exploit this to obtain the password of AppSamvid on the targeted system.

Successful exploitation of this vulnerability could allow the attacker to take complete control of the application on the targeted system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-326
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0081; https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0081
CVE: CVE-2024-25103
Published: 2024-03-06
Description: This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could exploit this by placing malicious DLLs on the targeted system.

Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on the targeted system.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-426
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0081; https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0081
CVE: CVE-2024-26580
Published: 2024-03-06
Description: Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can 

use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/9673
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.openwall.com/lists/oss-security/2024/03/06/1; https://lists.apache.org/thread/xvomf66l58x4dmoyzojflvx52gkzcdmk; http://www.openwall.com/lists/oss-security/2024/03/06/1
CVE: CVE-2024-2005
Published: 2024-03-06
Description: 
In Blue Planet®  products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected.

Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal.


CVSS Score: 9.0 (CRITICAL)
CWE: CWE-269
References: https://www.ciena.com/product-security; https://www.ciena.com/product-security
CVE: CVE-2023-50740
Published: 2024-03-06
Description: In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. 
We recommend users upgrade the version of Linkis to version 1.5.0
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: http://www.openwall.com/lists/oss-security/2024/03/06/2; https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo; http://www.openwall.com/lists/oss-security/2024/03/06/2
CVE: CVE-2024-20292
Published: 2024-03-06
Description: A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. 
 This vulnerability is due to improper storage of an unencrypted registry key in certain logs. An attacker could exploit this vulnerability by accessing the logs on an affected system. A successful exploit could allow the attacker to view sensitive information in clear text.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-312
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-infodisc-rLCEqm6T; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-infodisc-rLCEqm6T
CVE: CVE-2024-20301
Published: 2024-03-06
Description: A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary authentication and access an affected Windows device. 
 This vulnerability is due to a failure to invalidate locally created trusted sessions after a reboot of the affected device. An attacker with primary user credentials could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the affected device without valid permissions.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-287, CWE-613
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-win-bypass-pn42KKBm; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-win-bypass-pn42KKBm
CVE: CVE-2024-20335
Published: 2024-03-06
Description: A vulnerability in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, remote attacker to perform command injection attacks against an affected device. In order to exploit this vulnerability, the attacker must have valid administrative credentials for the device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-multi-85G83CRB; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-multi-85G83CRB
CVE: CVE-2024-20336
Published: 2024-03-06
Description: A vulnerability in the web-based user interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, remote attacker to perform buffer overflow attacks against an affected device. In order to exploit this vulnerability, the attacker must have valid administrative credentials for the device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-multi-85G83CRB; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-multi-85G83CRB
CVE: CVE-2024-20337
Published: 2024-03-06
Description: A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. 
 This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link while establishing a VPN session. A successful exploit could allow the attacker to execute arbitrary script code in the browser or access sensitive, browser-based information, including a valid SAML token. The attacker could then use the token to establish a remote access VPN session with the privileges of the affected user. Individual hosts and services behind the VPN headend would still need additional credentials for successful access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-93
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7
CVE: CVE-2024-20338
Published: 2024-03-06
Description: A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to elevate privileges on an affected device.
 This vulnerability is due to the use of an uncontrolled search path element. An attacker could exploit this vulnerability by copying a malicious library file to a specific directory in the filesystem and persuading an administrator to restart a specific process. A successful exploit could allow the attacker to execute arbitrary code on an affected device with root privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-privesc-sYxQO6ds; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-privesc-sYxQO6ds
CVE: CVE-2024-20345
Published: 2024-03-06
Description: A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct directory traversal attacks on an affected device. 
 This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to access sensitive data on an affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-26
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-traversal-m7N8mZpF; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-traversal-m7N8mZpF
CVE: CVE-2024-20346
Published: 2024-03-06
Description: A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated, remote attacker to perform a reflected cross-site scripting (XSS) attack against a user of the interface of an affected device.
 This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-xss-3JwqSMNT; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-xss-3JwqSMNT
CVE: CVE-2024-28149
Published: 2024-03-06
Description: Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3301; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28150
Published: 2024-03-06
Description: Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3302; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28151
Published: 2024-03-06
Description: Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3303; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28152
Published: 2024-03-06
Description: In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-281
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3300; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28153
Published: 2024-03-06
Description: Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3344; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28154
Published: 2024-03-06
Description: Jenkins MQ Notifier Plugin 1.4.0 and earlier logs potentially sensitive build parameters as part of debug information in build logs by default.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3180; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28155
Published: 2024-03-06
Description: Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about available scan config names, engine group names, and client names.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3144; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28156
Published: 2024-03-06
Description: Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3280; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28157
Published: 2024-03-06
Description: Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3249; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28158
Published: 2024-03-06
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers to trigger a build.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3325; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28159
Published: 2024-03-06
Description: A missing permission check in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers with Item/Read permission to trigger a build.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3325; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28160
Published: 2024-03-06
Description: Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3248; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28161
Published: 2024-03-06
Description: In Jenkins Delphix Plugin 3.0.1, a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections is disabled by default.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3215; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28162
Published: 2024-03-06
Description: In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections fails to take effect until Jenkins is restarted when switching from disabled validation to enabled validation.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2024/03/06/3; https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3330; http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE: CVE-2024-28173
Published: 2024-03-06
Description: In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-201
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-28174
Published: 2024-03-06
Description: In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/