deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-35050
Published: 2021-06-25
Description: User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.3. This vulnerability has been addressed in version 9.3.3 and subsequent versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-257, CWE-522
References: https://support.fidelissecurity.com/hc/en-us/categories/[PII_REDACTED]94-Advisories-News-and-Policies; https://www.securifera.com/blog/2021/06/24/operation-eagle-eye/; https://support.fidelissecurity.com/hc/en-us/categories/[PII_REDACTED]94-Advisories-News-and-Policies
CVE: CVE-2020-26801
Published: 2021-06-25
Description: A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://su2200rtxl2ua.com; http://tripplite.com; https://www.blacklanternsecurity.com/2021-06-21-Tripplite-CVE/
CVE: CVE-2021-27040
Published: 2021-06-25
Description: A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulnerability can be exploited to execute arbitrary code.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0004; https://www.zerodayinitiative.com/advisories/ZDI-21-1236/; https://www.zerodayinitiative.com/advisories/ZDI-21-1238/
CVE: CVE-2021-27041
Published: 2021-06-25
Description: A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007
CVE: CVE-2021-27042
Published: 2021-06-25
Description: A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. The vulnerability exists because the application fails to handle a crafted DWG file, which causes an unhandled exception. An attacker can leverage this vulnerability to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007
CVE: CVE-2021-27043
Published: 2021-06-25
Description: An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpected paths. In order to exploit this the attacker would need the victim to enable full page heap in the application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007
CVE: CVE-2021-33895
Published: 2021-06-25
Description: ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI application, the system procedure (USER_AUTHENTICATE_) used for verifying the Password returns 0 (no error). The reason is that the user is not running the XYGate application. Hence, BBSV assumes the Password is correct. For H4.09, the affected version isT0954V04^AAO. For E4.09, the affected version is 22SEP2020. Note: If your current version is E4.10-16MAY2021 (version procedure T9999V04_16MAY2022_BPAKETI_10), a hotfix (FIXPAK-19OCT-2022) is available in version E4.10-19OCT2022. Resolution to CVE-2021-33895 in version E4.11-19OCT2022
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://etinet.com/products/backbox-virtual-tape-controller/; https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbns04172en_us; https://etinet.com/products/backbox-virtual-tape-controller/
CVE: CVE-2021-34183
Published: 2021-06-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-34184
Published: 2021-06-25
Description: Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in miniaudio.h.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://github.com/mackron/miniaudio/issues/319; https://github.com/mackron/miniaudio/issues/319
CVE: CVE-2021-34185
Published: 2021-06-25
Description: Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left shift in drwav_bytes_to_u32 in miniaudio.h
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/mackron/miniaudio/issues/320; https://github.com/mackron/miniaudio/issues/320
CVE: CVE-2021-34074
Published: 2021-06-25
Description: PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path is used in the requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://k4m1ll0.com/cve-pandorafms754-chained-xss-rce.html; https://k4m1ll0.com/cve-pandorafms754-chained-xss-rce.html
CVE: CVE-2021-35501
Published: 2021-06-25
Description: PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/163466/Pandora-FMS-7.54-Cross-Site-Scripting.html; https://k4m1ll0.com/cve-pandorafms754-chained-xss-rce.html; http://packetstormsecurity.com/files/163466/Pandora-FMS-7.54-Cross-Site-Scripting.html
CVE: CVE-2021-3314
Published: 2021-06-25
Description: Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://n4nj0.github.io/advisories/oracle-glassfish-reflected-xss/; https://www.gruppotim.it/redteam; https://n4nj0.github.io/advisories/oracle-glassfish-reflected-xss/
CVE: CVE-2021-32702
Published: 2021-06-25
Description: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/auth0/nextjs-auth0/commit/6996e2528ceed98627caa28abafbc09e90163ccf; https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-954c-jjx6-cxv7; https://www.npmjs.com/package/%40auth0/nextjs-auth0
CVE: CVE-2020-4609
Published: 2021-06-25
Description: IBM Security Sevret Server (IBM Security Verify Privilege Manager 10.8.2) is vulnerable to a buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and execute arbitrary code on the system or cause the system to crash. IBM X-Force ID: 184917.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184917; https://www.ibm.com/support/pages/node/6467047; https://exchange.xforce.ibmcloud.com/vulnerabilities/184917
CVE: CVE-2020-4610
Published: 2021-06-25
Description: IBM Security Secret Server (IBM Security Verify Privilege Manager 10.8.2 ) could allow a local user to execute code due to improper integrity checks. IBM X-Force ID: 184919.
CVSS Score: 7.8 (HIGH)
CWE: CWE-354
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184919; https://www.ibm.com/support/pages/node/6467047; https://exchange.xforce.ibmcloud.com/vulnerabilities/184919
CVE: CVE-2021-20583
Published: 2021-06-25
Description: IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) could disclose sensitive information through an HTTP GET request by a privileged user due to improper input validation.. IBM X-Force ID: 199396.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199396; https://www.ibm.com/support/pages/node/6467045; https://exchange.xforce.ibmcloud.com/vulnerabilities/199396
CVE: CVE-2021-29676
Published: 2021-06-25
Description: IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199575; https://www.ibm.com/support/pages/node/6467045; https://exchange.xforce.ibmcloud.com/vulnerabilities/199575
CVE: CVE-2021-29677
Published: 2021-06-25
Description: IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/199578; https://www.ibm.com/support/pages/node/6467045; https://exchange.xforce.ibmcloud.com/vulnerabilities/199578
CVE: CVE-2021-21002
Published: 2021-06-25
Description: In Phoenix Contact FL COMSERVER UNI in versions < 2.40 a invalid Modbus exception response can lead to a temporary denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://cert.vde.com/en-us/advisories/vde-2021-022; https://cert.vde.com/en-us/advisories/vde-2021-022
CVE: CVE-2021-21003
Published: 2021-06-25
Description: In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://cert.vde.com/en-us/advisories/vde-2021-023; https://cert.vde.com/en-us/advisories/vde-2021-023
CVE: CVE-2021-21004
Published: 2021-06-25
Description: In Phoenix Contact FL SWITCH SMCS series products in multiple versions an attacker may insert malicious code via LLDP frames into the web-based management which could then be executed by the client.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://cert.vde.com/en-us/advisories/vde-2021-023; https://cert.vde.com/en-us/advisories/vde-2021-023
CVE: CVE-2021-21005
Published: 2021-06-25
Description: In Phoenix Contact FL SWITCH SMCS series products in multiple versions if an attacker sends a hand-crafted TCP-Packet with the Urgent-Flag set and the Urgent-Pointer set to 0, the network stack will crash. The device needs to be rebooted afterwards.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://cert.vde.com/en-us/advisories/vde-2021-023; https://cert.vde.com/en-us/advisories/vde-2021-023
CVE: CVE-2021-33528
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable privilege escalation vulnerability exists in the iw_console functionality. A specially crafted menu selection string can cause an escape from the restricted console, resulting in system access as the root user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-710
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33529
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryption of captured traffic across the network from or to the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33530
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the devices. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed, resulting in remote control over the device. An attacker can send diagnostic while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33531
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities. The device operating system contains an undocumented encryption password, allowing for the creation of custom diagnostic scripts. An attacker can send diagnostic scripts while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33532
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33533
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted iw_serverip parameter can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33534
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send various requests while authenticated as a high privilege user to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33535
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33536
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable denial-of-service vulnerability exists in ServiceAgent functionality. A specially crafted packet can cause an integer underflow, triggering a large memcpy that will access unmapped or out-of-bounds memory. An attacker can send this packet while unauthenticated to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33537
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality. A specially crafted user name entry can cause an overflow of an error message buffer, resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33538
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable improper access control vulnerability exists in the iw_webs account settings functionality. A specially crafted user name entry can cause the overwrite of an existing user account password, resulting in remote shell access to the device as that user. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33539
Published: 2021-06-25
Description: In Weidmueller Industrial WLAN devices in multiple versions an exploitable authentication bypass vulnerability exists in the hostname processing. A specially configured device hostname can cause the device to interpret selected remote traffic as local traffic, resulting in a bypass of web authentication. An attacker can send authenticated SNMP requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: https://cert.vde.com/en-us/advisories/vde-2021-026; https://cert.vde.com/en-us/advisories/vde-2021-026
CVE: CVE-2021-33540
Published: 2021-06-25
Description: In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists.
CVSS Score: 7.3 (HIGH)
CWE: CWE-798
References: https://cert.vde.com/en-us/advisories/vde-2021-021; https://cert.vde.com/en-us/advisories/vde-2021-021
CVE: CVE-2021-33541
Published: 2021-06-25
Description: Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of service on the PLC's network communication module. A successful attack stops all network communication. To restore the network connectivity the device needs to be restarted. The automation task is not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://cert.vde.com/en-us/advisories/vde-2021-019; https://cert.vde.com/en-us/advisories/vde-2021-019
CVE: CVE-2021-33542
Published: 2021-06-25
Description: Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://cert.vde.com/en-us/advisories/vde-2021-020; https://www.zerodayinitiative.com/advisories/ZDI-21-782/; https://cert.vde.com/en-us/advisories/vde-2021-020
CVE: CVE-2021-34427
Published: 2021-06-25
Description: In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-434
References: http://packetstormsecurity.com/files/170326/Eclipse-Business-Intelligence-Reporting-Tool-4.11.0-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2022/Dec/30; https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142
CVE: CVE-2021-1073
Published: 2021-06-25
Description: NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser. In this situation, the web page can get access to the token of the user login session, leading to the possibility that the user’s account is compromised. This may lead to the targeted user’s data being accessed, altered, or lost.
CVSS Score: 8.3 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5199; https://nvidia.custhelp.com/app/answers/detail/a_id/5199
CVE: CVE-2021-25654
Published: 2021-06-25
Description: An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-378
References: https://support.avaya.com/css/P8/documents/101076523; https://support.avaya.com/css/P8/documents/101076523
CVE: CVE-2021-35502
Published: 2021-06-25
Description: app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/MISP/MISP/commit/2fde6476dc3173affc61874ba2adb35400a8fda5; https://github.com/MISP/MISP/commit/2fde6476dc3173affc61874ba2adb35400a8fda5
CVE: CVE-2021-35513
Published: 2021-06-27
Description: Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mermaid-js/mermaid/issues/2122; https://github.com/mermaid-js/mermaid/pull/2123; https://github.com/mermaid-js/mermaid/releases/tag/8.11.0-rc2
CVE: CVE-2021-20740
Published: 2021-06-28
Description: Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08(NEC2.5.4a) and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08(NEC3.4.2) allow remote authenticated attackers to execute arbitrary OS commands with root privileges via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jpn.nec.com/security-info/secinfo/nv21-011.html; https://jvn.jp/en/jp/JVN21298724/index.html; https://www.hitachi.co.jp/products/it/storage-solutions/global/sec_info/2021/2021_306.html