deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10692
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10693
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10694
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10695
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. However, the same functionality allows an attacker to execute commands on the device. The POST parameters "to1,to2,to3,to4" are all susceptible to buffer overflow. By crafting a packet that contains a string of 678 characters, it is possible for an attacker to execute the attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10696
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a web interface to allow an administrator to manage the device. However, this interface is not protected against CSRF attacks, which allows an attacker to trick an administrator into executing actions without his/her knowledge, as demonstrated by the forms/iw_webSetParameters and forms/webSetMainRestart URIs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10697
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10698
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-311
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10699
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_privatePass" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10700
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the name of the device. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iw_board_deviceName" is susceptible to this injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10701
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_filename" is susceptible to buffer overflow. By crafting a packet that contains a string of 162 characters, it is possible for an attacker to execute the attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10702
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_filename" is susceptible to command injection via shell metacharacters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2018-10703
Published: 2019-06-07
Description: An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_serverip" is susceptible to buffer overflow. By crafting a packet that contains a string of 480 characters, it is possible for an attacker to execute the attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html; https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121; https://seclists.org/bugtraq/2019/Jun/8
CVE: CVE-2019-12779
Published: 2019-06-07
Description: libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00017.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00031.html
CVE: CVE-2019-2090
Published: 2019-06-07
Description: In isPackageDeviceAdminOnAnyUser of PackageManagerService.java, there is a possible permissions bypass due to a missing permissions check. This could lead to local escalation of privilege, with no additional permissions required. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-128599183
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2091
Published: 2019-06-07
Description: In GetPermittedAccessibilityServicesForUser of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege, with no additional permissions required. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-128599660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2092
Published: 2019-06-07
Description: In isSeparateProfileChallengeAllowed of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege, with no additional permissions required. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-128599668.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2093
Published: 2019-06-07
Description: In huff_dec_1D of nlc_dec.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-119292397.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2094
Published: 2019-06-07
Description: In parseMPEGCCData of NuPlayerCCDecoder.cpp, there is a possible out of bounds write due to missing bounds checks. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-129068792.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2095
Published: 2019-06-07
Description: In callGenIDChangeListeners and related functions of SkPixelRef.cpp, there is a possible use after free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-124232283.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2096
Published: 2019-06-07
Description: In EffectRelease of EffectBundle.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege in the audio server with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-123237974.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2097
Published: 2019-06-07
Description: In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion. This could lead to remote code execution from a malicious proxy configuration, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-117606285.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2098
Published: 2019-06-07
Description: In areNotificationsEnabledForPackage of NotificationManagerService.java, there is a possible permissions bypass due to a missing permissions check. This could lead to local escalation of privilege, with no additional privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-128599467.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2099
Published: 2019-06-07
Description: In nfa_rw_store_ndef_rx_buf of nfa_rw_act.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-123583388.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2019-06-01; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2101
Published: 2019-06-07
Description: In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-111760968.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html; https://lists.debian.org/debian-lts-announce/2019/07/msg00022.html; https://source.android.com/security/bulletin/2019-06-01
CVE: CVE-2019-2102
Published: 2019-06-07
Description: In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK). If a BLE device were to use this as a hardcoded LTK, it is theoretically possible for a proximate attacker to remotely inject keystrokes on a paired Android host due to improperly used crypto. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-128843052.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://source.android.com/security/bulletin/2019-06-01; https://support.apple.com/kb/HT210118; https://support.apple.com/kb/HT210119
CVE: CVE-2019-3955
Published: 2019-06-07
Description: Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly validating RsaPubKeyLen during key negotiation. An unauthenticated remote attacker can cause a heap buffer overflow by specifying a large RsaPubKeyLen, which could cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://www.tenable.com/security/research/tra-2019-26; https://www.tenable.com/security/research/tra-2019-26
CVE: CVE-2019-5441
Published: 2019-06-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-12739. Reason: This candidate is a reservation duplicate of CVE-2019-12739. Notes: All CVE users should reference CVE-2019-12739 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-12504
Published: 2019-06-07
Description: Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319
References: http://packetstormsecurity.com/files/153185/Inateck-2.4-GHz-Wearable-Wireless-Presenter-WP2002-Keystroke-Injection.html; http://seclists.org/fulldisclosure/2019/Jun/14; https://seclists.org/bugtraq/2019/Jun/3
CVE: CVE-2019-12505
Published: 2019-06-07
Description: Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-319
References: http://packetstormsecurity.com/files/153184/Inateck-2.4-GHz-Wireless-Presenter-WP1001-Keystroke-Injection.html; http://seclists.org/fulldisclosure/2019/Jun/4; https://seclists.org/bugtraq/2019/Jun/2
CVE: CVE-2019-12506
Published: 2019-06-07
Description: Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer that is operated with an affected receiver of this device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-319
References: http://packetstormsecurity.com/files/153186/Logitech-R700-Laser-Presentation-Remote-Keystroke-Injection.html; http://seclists.org/fulldisclosure/2019/Jun/15; https://seclists.org/bugtraq/2019/Jun/4
CVE: CVE-2019-3956
Published: 2019-06-07
Description: Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating CltDHPubKeyLen during key negotiation, which could crash the application or leak sensitive information.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-125
References: https://www.tenable.com/security/research/tra-2019-26; https://www.tenable.com/security/research/tra-2019-26
CVE: CVE-2019-3957
Published: 2019-06-07
Description: Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSignatureLen during key negotiation, which could crash the application or leak sensitive information.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-125
References: https://www.tenable.com/security/research/tra-2019-26; https://www.tenable.com/security/research/tra-2019-26
CVE: CVE-2019-9084
Published: 2019-06-07
Description: In Hoteldruid before 2.3.1, a division by zero was discovered in $num_tabelle in tab_tariffe.php (aka the numtariffa1 parameter) due to the mishandling of non-numeric values, as demonstrated by the /tab_tariffe.php?anno=[YEAR]&numtariffa1=1a URI. It could allow an administrator to conduct remote denial of service (disrupting certain business functions of the product).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-369
References: http://www.hoteldruid.com/en/download.html; https://metamorfosec.com/Files/Advisories/METS-2019-005-A_division_by_zero_in_Hoteldruid_before_v2.3.1.txt; http://www.hoteldruid.com/en/download.html
CVE: CVE-2019-9086
Published: 2019-06-07
Description: HotelDruid before v2.3.1 has SQL Injection via the /visualizza_tabelle.php anno parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.hoteldruid.com/en/download.html; https://metamorfosec.com/Files/Advisories/METS-2019-007-A_SQL_Injection_in_HotelDruid_before_v2.3.1.txt; http://www.hoteldruid.com/en/download.html
CVE: CVE-2019-9087
Published: 2019-06-07
Description: HotelDruid before v2.3.1 has SQL Injection via the /tab_tariffe.php numtariffa1 parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.hoteldruid.com/en/download.html; https://metamorfosec.com/Files/Advisories/METS-2019-008-A_SQL_Injection_in_HotelDruid_before_v2.3.1.txt; http://www.hoteldruid.com/en/download.html
CVE: CVE-2019-12387
Published: 2019-06-10
Description: In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html; https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2
CVE: CVE-2019-0209
Published: 2019-06-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2019-5243
Published: 2019-06-10
Description: There is a Clickjacking vulnerability in Huawei HG255s product. An attacker may trick user to click a link and affect the integrity of a device by exploiting this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://support.huawei.com/carrier/navi?lang=en&coltype=software#col=software&detailId=PBI1-22976324&path=PBI1-7275726/PBI1-7275742/PBI1-22892608/PBI1-22903845/PBI1-21219153&lang=en; https://utkusen.com/advisories/CVE-2019-5243.txt; https://support.huawei.com/carrier/navi?lang=en&coltype=software#col=software&detailId=PBI1-22976324&path=PBI1-7275726/PBI1-7275742/PBI1-22892608/PBI1-22903845/PBI1-21219153&lang=en
CVE: CVE-2019-12780
Published: 2019-06-10
Description: The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.exploit-db.com/exploits/46436; https://www.exploit-db.com/exploits/46436