deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0017
Published: 2023-01-10
Description: An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations affecting users and data on the current system. This could allow the attacker to have full read access to user data, make modifications to user data, and make services within the system unavailable.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-284
References: https://launchpad.support.sap.com/#/notes/3268093; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3268093
CVE: CVE-2023-0018
Published: 2023-01-10
Description: Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. Once these reports are viewable, anyone who opens those reports would be susceptible to stored XSS attacks. As a result of the attack, information maintained in the victim's web browser can be read, modified, and sent to the attacker.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/3266006; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3266006
CVE: CVE-2023-0022
Published: 2023-01-10
Description: SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application causing a high impact on the confidentiality, integrity, and availability of the application.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://launchpad.support.sap.com/#/notes/3262810; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3262810
CVE: CVE-2023-0023
Published: 2023-01-10
Description: In SAP Bank Account Management (Manage Banks) application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the application.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-200
References: https://launchpad.support.sap.com/#/notes/3150704; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3150704
CVE: CVE-2023-22320
Published: 2023-01-10
Description: OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22). Furthermore, a crafted URL may be evaluated incorrectly.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/openam-jp/web-agents/issues/3; https://jvn.jp/en/vu/JVN91740661/; https://github.com/openam-jp/web-agents/issues/3
CVE: CVE-2017-20166
Published: 2023-01-10
Description: Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-754
References: https://github.com/advisories/GHSA-2xxx-fhc8-9qvq; https://github.com/elixir-ecto/ecto/commit/db55b0cba6525c24ebddc88ef9ae0c1c00620250; https://github.com/elixir-ecto/ecto/pull/2125
CVE: CVE-2021-46871
Published: 2023-01-10
Description: tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/advisories/GHSA-j3gg-r6gp-95q2; https://github.com/phoenixframework/phoenix_html/commit/62a0139fb716bcdce697f6221244bd81d321d620; https://github.com/advisories/GHSA-j3gg-r6gp-95q2
CVE: CVE-2023-22903
Published: 2023-01-10
Description: api/views/user.py in LibrePhotos before e19e539 has incorrect access control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/LibrePhotos/librephotos/commit/e19e539356df77f6f59e7d1eea22d452b268e120; https://raw.githubusercontent.com/go-compile/security-advisories/master/CVE-2023-22903.pdf; https://github.com/LibrePhotos/librephotos/commit/e19e539356df77f6f59e7d1eea22d452b268e120
CVE: CVE-2022-48251
Published: 2023-01-10
Description: The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offers the position "while power side channel attacks ... are possible, they are not directly caused by or related to the Arm architecture."
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://eprint.iacr.org/2022/230; https://eshard.com/posts/sca-attacks-on-armv8; https://eprint.iacr.org/2022/230
CVE: CVE-2023-22909
Published: 2023-01-10
Description: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. SpecialMobileHistory allows remote attackers to cause a denial of service because database queries are slow.
CVSS Score: 5.3 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A/; https://phabricator.wikimedia.org/T320987; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A/
CVE: CVE-2023-22911
Published: 2023-01-10
Description: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A/; https://phabricator.wikimedia.org/T149488; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A/
CVE: CVE-2022-4294
Published: 2023-01-10
Description: Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.

CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://support.norton.com/sp/static/external/tools/security-advisories.html; https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE: CVE-2022-4429
Published: 2023-01-10
Description: Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issue was fixed with Avira Security version 1.1.78

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-428, CWE-428
References: https://support.norton.com/sp/static/external/tools/security-advisories.html; https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE: CVE-2022-38773
Published: 2023-01-10
Description: Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during load-time. An attacker with physical access to the device could use this to replace the boot image of the device and execute arbitrary code.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1326
References: https://cert-portal.siemens.com/productcert/html/ssa-482757.html; https://cert-portal.siemens.com/productcert/pdf/ssa-482757.pdf; https://cert-portal.siemens.com/productcert/html/ssa-482757.html
CVE: CVE-2022-43513
Published: 2023-01-10
Description: A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected components allow to rename license files with user chosen input without authentication.
This could allow an unauthenticated remote attacker to rename and move files as SYSTEM user.
CVSS Score: 8.2 (HIGH)
CWE: CWE-73, CWE-610
References: https://cert-portal.siemens.com/productcert/html/ssa-476715.html; https://cert-portal.siemens.com/productcert/html/ssa-556635.html; https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf
CVE: CVE-2022-43514
Published: 2023-01-10
Description: A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl Server Basic V3 (All versions < V3.1.2). The affected component does not correctly validate the root path on folder related operations, allowing to modify files and folders outside the intended root directory.
This could allow an unauthenticated remote attacker to execute file operations of files outside of the specified root folder. Chained with CVE-2022-43513 this could allow Remote Code Execution.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/html/ssa-476715.html; https://cert-portal.siemens.com/productcert/html/ssa-556635.html; https://cert-portal.siemens.com/productcert/pdf/ssa-476715.pdf
CVE: CVE-2022-45092
Published: 2023-01-10
Description: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product, could potentially read and write arbitrary files from and to the device's file system. An attacker might leverage this to trigger remote code execution on the affected component.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
CVE: CVE-2022-45093
Published: 2023-01-10
Description: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product as well as with access to the SFTP server of the affected product (22/tcp), could potentially read and write arbitrary files from and to the device's file system. An attacker might leverage this to trigger remote code execution on the affected component.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
CVE: CVE-2022-45094
Published: 2023-01-10
Description: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product, could potentially inject commands into the dhcpd configuration of the affected product. An attacker might leverage this to trigger remote code execution on the affected component.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
CVE: CVE-2022-46823
Published: 2023-01-10
Description: A vulnerability has been identified in Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.4), Mendix SAML (Mendix 9 compatible, New Track) (All versions >= V3.3.0 < V3.3.9), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.8). The affected module is vulnerable to reflected cross-site scripting (XSS) attacks. This could allow an attacker to extract sensitive information by tricking users into accessing a malicious link.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-496604.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-496604.pdf
CVE: CVE-2022-47935
Published: 2023-01-10
Description: A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains a memory corruption vulnerability while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19078)
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf
CVE: CVE-2022-47967
Published: 2023-01-10
Description: A vulnerability has been identified in Solid Edge (All versions < V2023 MP1). The DOCMGMT.DLL contains a memory corruption vulnerability that could be triggered while parsing files in different file formats such as PAR, ASM, DFT. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-997779.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-997779.pdf
CVE: CVE-2022-3792
Published: 2023-01-10
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GullsEye GullsEye terminal operating system allows SQL Injection.This issue affects GullsEye terminal operating system: from unspecified before 5.0.13.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://fordefence.com/cve-2022-3792-gullseye-terminal-operation-system/; https://omrylmz.com/cve-2022-3792-terminal-operation-system/; https://www.usom.gov.tr/bildirim/tr-22-0747-2
CVE: CVE-2022-46610
Published: 2023-01-10
Description: 72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/72wukong/72crm-9.0-PHP/issues/36; https://github.com/72wukong/72crm-9.0-PHP/issues/36
CVE: CVE-2022-4422
Published: 2023-01-10
Description: Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0 


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-22-0747; https://www.usom.gov.tr/bildirim/tr-22-0747
CVE: CVE-2016-15017
Published: 2023-01-10
Description: A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a[PII_REDACTED]c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-21, CWE-22
References: https://github.com/fabarea/media_upload/commit/b25d42a[PII_REDACTED]c1a363311d8ea2a4ac8763a; https://github.com/fabarea/media_upload/issues/6; https://github.com/fabarea/media_upload/releases/tag/0.9.0
CVE: CVE-2014-125073
Published: 2023-01-10
Description: A vulnerability was found in mapoor voteapp. It has been rated as critical. Affected by this issue is the function create_poll/do_poll/show_poll/show_refresh of the file app.py. The manipulation leads to sql injection. The patch is identified as b290c21a0d8bcdbd55db860afd3cadec97388e72. It is recommended to apply a patch to fix this issue. VDB-217790 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/mapoor/voteapp/commit/b290c21a0d8bcdbd55db860afd3cadec97388e72; https://vuldb.com/?ctiid.217790; https://vuldb.com/?id.217790
CVE: CVE-2022-47083
Published: 2023-01-10
Description: A PHP Object Injection vulnerability in the unserialize() function Spitfire CMS v1.0.475 allows authenticated attackers to execute arbitrary code via sending crafted requests to the web application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5720.php; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5720.php
CVE: CVE-2022-4700
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'royal-elementor-kit' theme. If no such theme is installed doing so can also impact site availability as the site attempts to load a nonexistent theme.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd464ad-24bc-4922-8bfa-ac42fbe60b52?source=cve
CVE: CVE-2022-4701
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'contact-form-7', 'media-library-assistant', or 'woocommerce' plugins if they are installed on the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/55f7e39b-e7a5-462b-b1e4-c3d92038f17e?source=cve
CVE: CVE-2022-4702
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on the site unless it is part of an extremely limited hardcoded selection. This also switches the site to the 'royal-elementor-kit' theme, potentially resulting in availability issues.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/cb47b6cc-87e4-4d29-bbc7-6d7552bc3943?source=cve
CVE: CVE-2022-4703
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to reset previously imported data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/62a5c796-1c14-4cb1-9f21-340b40e418df?source=cve
CVE: CVE-2022-4704
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site configuration templates including images and settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/64cce528-0ad0-45ec-a8f6-e8791b0bece0?source=cve
CVE: CVE-2022-4705
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation of preset site configuration templates, which can be chosen and imported via a separate action documented in CVE-2022-4704.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a941aef-85f6-4719-b6ab-ace77a03e93e?source=cve
CVE: CVE-2022-4707
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated attackers to create Mega Menu templates, granted they can trick an administrator into performing an action, such as clicking a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/mega-menu.php?rev=2809656; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/55db7d81-7ffb-49da-b64e-23e892bddc57?source=cve
CVE: CVE-2022-4708
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to modify the conditions under which templates are displayed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/includes/wpr-templates-actions.php?rev=2834217; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e12653-ddfe-4e02-9d9e-0263b9f71def?source=cve
CVE: CVE-2022-4709
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import and activate templates from the plugin's template library.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/includes/wpr-templates-actions.php?rev=2834217; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/fa530112-a7cd-4c54-aa87-9e7337d01557?source=cve