deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28573
Published: 2020-12-01
Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal the total agents managed by the server.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000281947; https://success.trendmicro.com/solution/000281949; https://www.zerodayinitiative.com/advisories/ZDI-20-1374/
CVE: CVE-2020-28575
Published: 2020-12-01
Description: A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target in order to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://success.trendmicro.com/solution/000281950; https://www.zerodayinitiative.com/advisories/ZDI-20-1378/; https://success.trendmicro.com/solution/000281950
CVE: CVE-2020-28576
Published: 2020-12-01
Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version and build information.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000281947; https://success.trendmicro.com/solution/000281949; https://www.zerodayinitiative.com/advisories/ZDI-20-1375/
CVE: CVE-2020-28577
Published: 2020-12-01
Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000281947; https://success.trendmicro.com/solution/000281949; https://www.zerodayinitiative.com/advisories/ZDI-20-1376/
CVE: CVE-2020-28582
Published: 2020-12-01
Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal number of managed agents.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000281947; https://success.trendmicro.com/solution/000281949; https://www.zerodayinitiative.com/advisories/ZDI-20-1386/
CVE: CVE-2020-28583
Published: 2020-12-01
Description: An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version, build and patch information.
CVSS Score: 5.3 (MEDIUM)
References: https://success.trendmicro.com/solution/000281947; https://success.trendmicro.com/solution/000281949; https://www.zerodayinitiative.com/advisories/ZDI-20-1387/
CVE: CVE-2020-26250
Published: 2020-12-01
Description: OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all authenticated users will be allowed. Provider-based restrictions, including deprecated values such as `GitHubOAuthenticator.org_whitelist` are **not** affected. All users of OAuthenticator 0.12.0 and 0.12.1 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users` configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not** affected. If you see a log line like this and expect a specific list of allowed usernames: "[I 2020-11-27 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authenticated user will be allowed." you are likely affected. Updating oauthenticator to 0.12.2 is recommended. A workaround is to replace the deprecated `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...`. If any users have been authorized during this time who should not have been, they must be deleted via the API or admin interface, per the referenced documentation.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/jupyterhub/oauthenticator/blob/master/docs/source/changelog.md#0122---2020-11-30; https://github.com/jupyterhub/oauthenticator/commit/a4aac191c16cf6281f3d346615aefa75702b02d7; https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-384w-5v3f-q499
CVE: CVE-2012-0955
Published: 2020-12-02
Description: software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://code.launchpad.net/~cyphermox/software-properties/lp1036839/+merge/119753; https://launchpad.net/bugs/1036839; https://code.launchpad.net/~cyphermox/software-properties/lp1036839/+merge/119753
CVE: CVE-2020-14260
Published: 2020-12-02
Description: HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Domino or execute attacker-controlled code on the server system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085500; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085500
CVE: CVE-2020-14305
Published: 2020-12-02
Description: An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugs.openvz.org/browse/OVZ-7188; https://bugzilla.redhat.com/show_bug.cgi?id=1850716; https://patchwork.ozlabs.org/project/netfilter-devel/patch/c2385b5c-309c-cc64-2e10-a0ef62897502%40virtuozzo.com/
CVE: CVE-2020-14383
Published: 2020-12-02
Description: A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-391
References: https://bugzilla.redhat.com/show_bug.cgi?id=1892636; https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html; https://security.gentoo.org/glsa/202012-24
CVE: CVE-2020-25656
Published: 2020-12-02
Description: A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1888726; https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html; https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
CVE: CVE-2020-25704
Published: 2020-12-02
Description: A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1895961; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7bdb157cdebbf95a1cd94ed2e01b338714075d00; https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
CVE: CVE-2020-25723
Published: 2020-12-02
Description: A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
CVSS Score: 3.2 (LOW)
CWE: CWE-617, CWE-617
References: http://www.openwall.com/lists/oss-security/2020/12/22/1; https://bugzilla.redhat.com/show_bug.cgi?id=1898579; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2020-27813
Published: 2020-12-02
Description: An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190, CWE-400
References: https://bugzilla.redhat.com/show_bug.cgi?id=1902111; https://github.com/gorilla/websocket/security/advisories/GHSA-jf24-p9p9-4rjh; https://lists.debian.org/debian-lts-announce/2021/01/msg00008.html
CVE: CVE-2020-27816
Published: 2020-12-02
Description: The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://bugzilla.redhat.com/show_bug.cgi?id=1902698; https://bugzilla.redhat.com/show_bug.cgi?id=1902698
CVE: CVE-2020-4102
Published: 2020-12-02
Description: HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successful exploit could enable an attacker to crash Notes or execute attacker-controlled code on the client system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085499; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085499
CVE: CVE-2020-6018
Published: 2020-12-02
Description: Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES_GCM_DecryptContext::Decrypt() when compiled using libsodium, leading to a Stack-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://github.com/ValveSoftware/GameNetworkingSockets/commit/bea84e2844b647532a9b7fbc3a6a8989d66e49e3; https://research.checkpoint.com/2020/game-on-finding-vulnerabilities-in-valves-steam-sockets/; https://github.com/ValveSoftware/GameNetworkingSockets/commit/bea84e2844b647532a9b7fbc3a6a8989d66e49e3
CVE: CVE-2020-7199
Published: 2020-12-02
Description: A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04063en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04063en_us
CVE: CVE-2020-29454
Published: 2020-12-02
Description: Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/umbraco/Umbraco-CMS/pull/9361; https://github.com/umbraco/Umbraco-CMS/pull/9361
CVE: CVE-2020-5423
Published: 2020-12-02
Description: CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://www.cloudfoundry.org/blog/cve-2020-5423; https://www.cloudfoundry.org/blog/cve-2020-5423
CVE: CVE-2020-29456
Published: 2020-12-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ciur/papermerge/issues/228; https://github.com/ciur/papermerge/releases/tag/v1.5.2; https://www.papermerge.com/
CVE: CVE-2020-29458
Published: 2020-12-02
Description: Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/48907; https://www.exploit-db.com/exploits/48907
CVE: CVE-2020-12524
Published: 2020-12-02
Description: Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive and not accurately update the display content (Denial of Service).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://cert.vde.com/en-us/advisories/vde-2020-047; https://cert.vde.com/en-us/advisories/vde-2020-047
CVE: CVE-2020-14369
Published: 2020-12-02
Description: This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://bugzilla.redhat.com/show_bug.cgi?id=1871921; https://bugzilla.redhat.com/show_bug.cgi?id=1871921
CVE: CVE-2020-25638
Published: 2020-12-02
Description: A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS Score: 7.4 (HIGH)
CWE: CWE-89, CWE-89
References: https://bugzilla.redhat.com/show_bug.cgi?id=1881353; https://lists.apache.org/thread.html/r833c1276e41334fa675848a08daf0c61f39009f9f9a400d9f7006d44%40%3Cdev.turbine.apache.org%3E; https://lists.apache.org/thread.html/rf2378209c676a28b71f9b604a3b3517c448540b85367160e558ef9df%40%3Ccommits.turbine.apache.org%3E
CVE: CVE-2020-28272
Published: 2020-12-02
Description: Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/rumkin/keyget/commit/17d15b6c75036eb429075a8cfeccfc18094dd2e2; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28272; https://github.com/rumkin/keyget/commit/17d15b6c75036eb429075a8cfeccfc18094dd2e2
CVE: CVE-2020-28273
Published: 2020-12-02
Description: Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/ahdinosaur/set-in/commit/e431effa00195a6f06b111e09733cd1445a91a88; https://www.whitesourcesoftware.com/vulnerability-database; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28273
CVE: CVE-2020-13956
Published: 2020-12-02
Description: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVSS Score: 5.3 (MEDIUM)
References: https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E; https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a[PII_REDACTED]acf9363f9%40%3Cdev.hive.apache.org%3E; https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E
CVE: CVE-2020-25265
Published: 2020-12-02
Description: AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by providing a .desktop file that contains Name= with path components.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/refi64/CVE-2020-25265-25266; https://github.com/refi64/CVE-2020-25265-25266
CVE: CVE-2020-25266
Published: 2020-12-02
Description: AppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid appimage. For example, it will accept a crafted mp3 file that contains an appimage, and install it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-494
References: https://github.com/refi64/CVE-2020-25265-25266; https://github.com/refi64/CVE-2020-25265-25266
CVE: CVE-2020-29239
Published: 2020-12-02
Description: Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the View Detail of Application section from the admin panel, the attacker can able to steal the cookie according to the crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49159; https://www.exploit-db.com/exploits/49159
CVE: CVE-2020-29240
Published: 2020-12-02
Description: Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and each time an admin visits the Menu-Pages-Pages Overview section, the XSS will be triggered.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://lepton-cms.org/english/home.php; https://www.exploit-db.com/exploits/49137; https://lepton-cms.org/english/home.php
CVE: CVE-2020-29389
Published: 2020-12-02
Description: The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user. System using the Crux Linux Docker container deployed by affected versions of the Docker image may allow an attacker to achieve root access with a blank password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/koharin/koharin2/blob/main/CVE-2020-29389; https://github.com/koharin/koharin2/blob/main/CVE-2020-29389
CVE: CVE-2017-14451
Published: 2020-12-02
Description: An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read which can subsequently trigger an out-of-bounds write resulting in remote code execution. An attacker can create/send malicious smart contract to trigger this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0500; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0500
CVE: CVE-2017-2910
Published: 2020-12-02
Description: An exploitable Out-of-bounds Write vulnerability exists in the xls_addCell function of libxls 2.0. A specially crafted xls file can cause a memory corruption resulting in remote code execution. An attacker can send malicious xls file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0417; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0417
CVE: CVE-2020-13493
Published: 2020-12-02
Description: A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. A specially crafted USDC file format path jumps decompression heap overflow in a way path jumps are processed. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1094; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1094
CVE: CVE-2020-13494
Published: 2020-12-02
Description: A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. A specially crafted malformed file can trigger a heap overflow which can result in out of bounds memory access which could lead to information disclosure. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, victim needs to access an attacker-provided malformed file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1103; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1103
CVE: CVE-2020-13496
Published: 2020-12-02
Description: An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in TfToken Type Index. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1105; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1105
CVE: CVE-2020-13497
Published: 2020-12-02
Description: An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in String Type Index. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1105; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1105
CVE: CVE-2020-13498
Published: 2020-12-02
Description: An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access which could lead to information disclosure. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1105; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1105