deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-20616
Published: 2023-02-06
Description: In ion, there is a possible out of bounds read due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07560720; Issue ID: ALPS07560720.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20618
Published: 2023-02-06
Description: In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519184; Issue ID: ALPS07519184.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-20619
Published: 2023-02-06
Description: In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519159; Issue ID: ALPS07519159.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://corp.mediatek.com/product-security-bulletin/February-2023; https://corp.mediatek.com/product-security-bulletin/February-2023
CVE: CVE-2023-23944
Published: 2023-02-06
Description: Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue.
CVSS Score: 2.0 (LOW)
CWE: CWE-312
References: https://github.com/nextcloud/mail/pull/7797; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g86r-x755-93f4; https://hackerone.com/reports/1806275
CVE: CVE-2022-42439
Published: 2023-02-06
Description: 
IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Connector nodes which may cause a 3rd party system’s credentials to be exposed to a privileged attacker. IBM X-Force ID: 238211.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238211; https://www.ibm.com/support/pages/node/6952435; https://exchange.xforce.ibmcloud.com/vulnerabilities/238211
CVE: CVE-2022-42950
Published: 2023-02-06
Description: An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2022-42951
Published: 2023-02-06
Description: An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-362, CWE-287
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2022-44267
Published: 2023-02-06
Description: ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://imagemagick.org/; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AINSUL2QBKETGYRPA7XSCMJWLUB44M6S/
CVE: CVE-2022-44268
Published: 2023-02-06
Description: ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/171727/ImageMagick-7.1.0-48-Arbitrary-File-Read.html; https://imagemagick.org/; https://lists.debian.org/debian-lts-announce/2023/03/msg00008.html
CVE: CVE-2022-45589
Published: 2023-02-06
Description: All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks in the provisioning service only. Users of the provisioning service should upgrade to either 8.0.1-R2022-10-RT or 7.3.1-R2022-09-RT or a later release and use it in place of the previous version.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: http://talend.com; https://www.talend.com/security/incident-response/#CVE-2022-45588; http://talend.com
CVE: CVE-2022-48311
Published: 2023-02-06
Description: **UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows authenticated attacker to inject their own script into the page via HTTP configuration page. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/swzhouu/CVE-2022-48311; https://github.com/swzhouu/CVE-2022-48311
CVE: CVE-2023-23942
Published: 2023-02-06
Description: The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nextcloud/desktop/pull/5233; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64qc-vf6v-8xgg; https://hackerone.com/reports/1788598
CVE: CVE-2023-23943
Published: 2023-02-06
Description: Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://github.com/nextcloud/mail/pull/7796; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6; https://hackerone.com/reports/1736390
CVE: CVE-2023-25016
Published: 2023-02-06
Description: Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2021-31573
Published: 2023-02-06
Description: In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-31574
Published: 2023-02-06
Description: In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-31575
Published: 2023-02-06
Description: In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-31576
Published: 2023-02-06
Description: In Boa, there is a possible information disclosure due to a missing permission check. This could lead to remote information disclosure to a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB00123241.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-31577
Published: 2023-02-06
Description: In Boa, there is a possible escalation of privilege due to a missing permission check. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB00123241.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-31578
Published: 2023-02-06
Description: In Boa, there is a possible escalation of privilege due to a stack buffer overflow. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210008; Issue ID: OSBNB00123241.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2022-48166
Published: 2023-02-06
Description: An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://docs.google.com/document/d/1zvbuu3Hkk3CAkojAivlUESvtHblHJNLJdpGOoNtk-Vo/edit?usp=sharing; https://github.com/strik3r0x1/Vulns/blob/main/WAVLINK%20WN530HG4.md; https://docs.google.com/document/d/1zvbuu3Hkk3CAkojAivlUESvtHblHJNLJdpGOoNtk-Vo/edit?usp=sharing
CVE: CVE-2023-23333
Published: 2023-02-06
Description: There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/174537/SolarView-Compact-6.00-Remote-Command-Execution.html; https://github.com/Timorlover/CVE-2023-23333; http://packetstormsecurity.com/files/174537/SolarView-Compact-6.00-Remote-Command-Execution.html
CVE: CVE-2022-28923
Published: 2023-02-06
Description: Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability/; https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability/
CVE: CVE-2022-3229
Published: 2023-02-06
Description: Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code of the attacker's choosing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285, CWE-306
References: https://github.com/rapid7/metasploit-framework/pull/16989; https://github.com/rapid7/metasploit-framework/pull/16989
CVE: CVE-2022-44617
Published: 2023-02-06
Description: A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=2160193; https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28; https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
CVE: CVE-2022-46496
Published: 2023-02-06
Description: BTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://labs.integrity.pt/advisories/cve-2022-46496/; https://labs.integrity.pt/advisories/cve-2022-46496/
CVE: CVE-2023-0615
Published: 2023-02-06
Description: A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-190, CWE-369, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=2166287; https://bugzilla.redhat.com/show_bug.cgi?id=2166287
CVE: CVE-2023-23849
Published: 2023-02-06
Description: Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious purposes. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/RL:O/RC:C
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2023-23849-affecting-Coverity; https://community.synopsys.com/s/article/SIG-Product-Security-Advisory-CVE-2023-23849-affecting-Coverity
CVE: CVE-2023-24808
Published: 2023-02-07
Description:  PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service (DOS) vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28kb in size and was discovered via fuzzing. Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf. Please see the linked GHSA for an example pdf. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-835
References: https://github.com/michaelrsweet/pdfio/commit/4f10021e7ee527c1aa24853e2947e38e154d9ccb; https://github.com/michaelrsweet/pdfio/security/advisories/GHSA-cjc4-x96x-fvgf; https://github.com/michaelrsweet/pdfio/commit/4f10021e7ee527c1aa24853e2947e38e154d9ccb
CVE: CVE-2023-24827
Published: 2023-02-07
Description: syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASSWORD environment variable. The `SYFT_ATTEST_PASSWORD` environment variable is for the `syft attest` command to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided with `syft attest --key <path-to-key-file>`)  during the signing process while generating an SBOM attestation. This vulnerability affects users running syft that have the `SYFT_ATTEST_PASSWORD` environment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variable `SYFT_ATTEST_PASSWORD` set are not affected by this issue. The credentials are leaked in two ways: in the syft logs when `-vv` or `-vvv` are used in the syft command (which is any log level >= `DEBUG`) and in the attestation or SBOM only when the `syft-json` format is used. Note that as of v0.69.0 any generated attestations by the `syft attest` command are uploaded to the OCI registry (if you have write access to that registry) in the same way `cosign attach` is done. This means that any attestations generated for the affected versions of syft when the `SYFT_ATTEST_PASSWORD` environment variable was set would leak credentials in the attestation payload uploaded to the OCI registry. This issue has been patched in commit `9995950c70` and has been released as v0.70.0. There are no workarounds for this vulnerability. Users are advised to upgrade.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-532, CWE-532
References: https://github.com/anchore/syft/commit/9995950c70e849f9921919faffbfcf46401f71f3; https://github.com/anchore/syft/security/advisories/GHSA-jp7v-3587-2956; https://github.com/anchore/syft/commit/9995950c70e849f9921919faffbfcf46401f71f3
CVE: CVE-2022-38547
Published: 2023-02-07
Description: A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-rce-in-firewalls; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-rce-in-firewalls
CVE: CVE-2022-45441
Published: 2023-02-07
Description: A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker to store malicious scripts in the Logs page of the GUI on a vulnerable device. A successful XSS attack could force an authenticated user to execute the stored malicious scripts and then result in a denial-of-service (DoS) condition when the user visits the Logs page of the GUI on the device.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-nbg-418n-v2-home-router; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-nbg-418n-v2-home-router
CVE: CVE-2022-45854
Published: 2023-02-07
Description: An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to cause a temporary denial-of-service (DoS) by sending crafted VLAN frames if the MAC address of the vulnerable AP were intercepted by the attacker.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dos-vulnerability-of-aps; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dos-vulnerability-of-aps
CVE: CVE-2022-31611
Published: 2023-02-07
Description: 
NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user level privileges may cause the installer to load an arbitrary DLL when the installer is launched. A successful exploit of this vulnerability could lead to escalation of privileges and code execution.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5384; https://nvidia.custhelp.com/app/answers/detail/a_id/5384
CVE: CVE-2022-42291
Published: 2023-02-07
Description: 
NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inadvertently delete data from a linked location, which may lead to data tampering. An attacker does not have explicit control over the exploitation of this vulnerability, which requires the user to explicitly launch the installer from the compromised directory.


CVSS Score: 8.2 (HIGH)
CWE: CWE-1386, CWE-59
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5384; https://nvidia.custhelp.com/app/answers/detail/a_id/5384
CVE: CVE-2015-10074
Published: 2023-02-07
Description: A vulnerability was found in OpenSeaMap online_chart 1.2. It has been classified as problematic. Affected is the function init of the file index.php. The manipulation of the argument mtext leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version staging is able to address this issue. The patch is identified as[PII_REDACTED]f921590d650e2d2f4bdf0df1017e9d. It is recommended to upgrade the affected component. VDB-220218 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/OpenSeaMap/online_chart/commit/[PII_REDACTED]f921590d650e2d2f4bdf0df1017e9d; https://github.com/OpenSeaMap/online_chart/pull/70; https://github.com/OpenSeaMap/online_chart/releases/tag/staging
CVE: CVE-2022-31254
Published: 2023-02-07
Description: A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the _rmt user to escalate to root. This issue affects: SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.10. SUSE Linux Enterprise Server for SAP 15-SP1 rmt-server versions prior to 2.10. SUSE Manager Server 4.1 rmt-server versions prior to 2.10. openSUSE Leap 15.3 rmt-server versions prior to 2.10. openSUSE Leap 15.4 rmt-server versions prior to 2.10.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://bugzilla.suse.com/show_bug.cgi?id=1204285; https://bugzilla.suse.com/show_bug.cgi?id=1204285
CVE: CVE-2023-0706
Published: 2023-02-07
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Medical Certificate Generator App 1.0. Affected by this issue is some unknown functionality of the file manage_record.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-220340.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.220340; https://vuldb.com/?id.220340; https://vuldb.com/?ctiid.220340