deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47080
Published: 2023-12-13
Description: Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-73.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-73.html
CVE: CVE-2023-47081
Published: 2023-12-13
Description: Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-73.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-73.html
CVE: CVE-2023-47320
Published: 2023-12-13
Description: Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects Silverpeas Core 6.3.1 and below.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: http://silverpeas.com; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47320; http://silverpeas.com
CVE: CVE-2023-47321
Published: 2023-12-13
Description: Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets.
CVSS Score: 4.9 (MEDIUM)
References: http://silverpeas.com; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47321; http://silverpeas.com
CVE: CVE-2023-47322
Published: 2023-12-13
Description: The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user in the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://silverpeas.com; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47322; http://silverpeas.com
CVE: CVE-2023-47323
Published: 2023-12-13
Description: The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators.
CVSS Score: 7.5 (HIGH)
References: http://silverpeas.com; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47323; http://silverpeas.com
CVE: CVE-2023-47324
Published: 2023-12-13
Description: Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://silverpeas.com; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47324; https://github.com/Silverpeas/Silverpeas-Core/pull/1298/commits
CVE: CVE-2023-47325
Published: 2023-12-13
Description: Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: http://silverpeas.com; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47325; http://silverpeas.com
CVE: CVE-2023-47326
Published: 2023-12-13
Description: Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://silverpeas.com; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47326; http://silverpeas.com
CVE: CVE-2023-47327
Published: 2023-12-13
Description: The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.
CVSS Score: 4.3 (MEDIUM)
References: http://silverpeas.com; https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2023-47327; http://silverpeas.com
CVE: CVE-2023-48625
Published: 2023-12-13
Description: Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html; https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html
CVE: CVE-2023-48626
Published: 2023-12-13
Description: Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html; https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html
CVE: CVE-2023-48627
Published: 2023-12-13
Description: Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html; https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html
CVE: CVE-2023-48628
Published: 2023-12-13
Description: Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html; https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html
CVE: CVE-2023-48629
Published: 2023-12-13
Description: Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html; https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html
CVE: CVE-2023-48630
Published: 2023-12-13
Description: Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html; https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html
CVE: CVE-2023-48632
Published: 2023-12-13
Description: Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb23-75.html; https://helpx.adobe.com/security/products/after_effects/apsb23-75.html
CVE: CVE-2023-48633
Published: 2023-12-13
Description: Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/after_effects/apsb23-75.html; https://helpx.adobe.com/security/products/after_effects/apsb23-75.html
CVE: CVE-2023-48634
Published: 2023-12-13
Description: Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/after_effects/apsb23-75.html; https://helpx.adobe.com/security/products/after_effects/apsb23-75.html
CVE: CVE-2023-48635
Published: 2023-12-13
Description: Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb23-75.html; https://helpx.adobe.com/security/products/after_effects/apsb23-75.html
CVE: CVE-2023-48636
Published: 2023-12-13
Description: Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html
CVE: CVE-2023-48637
Published: 2023-12-13
Description: Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html
CVE: CVE-2023-48638
Published: 2023-12-13
Description: Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html
CVE: CVE-2023-48639
Published: 2023-12-13
Description: Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html; https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html
CVE: CVE-2023-6756
Published: 2023-12-13
Description: A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /login of the component Captcha Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247884.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: http://124.71.147.32:8082/IceCMS2.html; https://vuldb.com/?ctiid.247884; https://vuldb.com/?id.247884
CVE: CVE-2023-6757
Published: 2023-12-13
Description: A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /adplanet/PlanetUser of the component API. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247885 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://124.71.147.32:8082/IceCMS3.html; https://vuldb.com/?ctiid.247885; https://vuldb.com/?id.247885
CVE: CVE-2023-6758
Published: 2023-12-13
Description: A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/PlanetCommentList of the component API. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247886 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://124.71.147.32:8082/IceCMS4.html; https://vuldb.com/?ctiid.247886; https://vuldb.com/?id.247886
CVE: CVE-2023-6759
Published: 2023-12-13
Description: A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/resource of the component Love Handler. The manipulation leads to improper enforcement of a single, unique action. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247887.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-837
References: http://39.106.130.187/Icecms.html; https://vuldb.com/?ctiid.247887; https://vuldb.com/?id.247887
CVE: CVE-2023-6760
Published: 2023-12-13
Description: A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leads to manage user sessions. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247888.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1018
References: http://39.106.130.187/yue/yue.html; https://vuldb.com/?ctiid.247888; https://vuldb.com/?id.247888
CVE: CVE-2023-6761
Published: 2023-12-13
Description: A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processing of the component User Data Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247889 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://39.106.130.187/chui/1.html; https://vuldb.com/?ctiid.247889; https://vuldb.com/?id.247889
CVE: CVE-2023-6762
Published: 2023-12-13
Description: A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/DelectArticleById/ of the component Article Handler. The manipulation leads to permission issues. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-247890 is the identifier assigned to this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-275
References: http://39.106.130.187/jwt/wen/1.html; https://vuldb.com/?ctiid.247890; https://vuldb.com/?id.247890
CVE: CVE-2023-49363
Published: 2023-12-13
Description: Rockoa <2.3.3 is vulnerable to SQL Injection. The problem exists in the indexAction method in reimpAction.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wednesdaygogo/Vulnerability-recurrence/blob/main/rockoa%20less%20than%202.3.3%20sql%20injection%20vulnerability.pdf; https://github.com/wednesdaygogo/Vulnerability-recurrence/blob/main/rockoa%20less%20than%202.3.3%20sql%20injection%20vulnerability.pdf
CVE: CVE-2023-50764
Published: 2023-12-13
Description: Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system.
CVSS Score: 8.1 (HIGH)
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3205; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50765
Published: 2023-12-13
Description: A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read the contents of a Groovy script by knowing its ID.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3206; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50766
Published: 2023-12-13
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3204; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50767
Published: 2023-12-13
Description: Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3204; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50768
Published: 2023-12-13
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3203; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50769
Published: 2023-12-13
Description: Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3203; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50770
Published: 2023-12-13
Description: Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3168; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50771
Published: 2023-12-13
Description: Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-2979; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50772
Published: 2023-12-13
Description: Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50773
Published: 2023-12-13
Description: Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3184; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50774
Published: 2023-12-13
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3183; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50775
Published: 2023-12-13
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3092; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50776
Published: 2023-12-13
Description: Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182; http://www.openwall.com/lists/oss-security/2023/12/13/4