deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-11527
Published: 2018-05-29
Description: An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpass_save.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/fanyibo2009/cscms/blob/master/v4.1%20csrf; https://github.com/fanyibo2009/cscms/blob/master/v4.1%20csrf
CVE: CVE-2018-11528
Published: 2018-05-29
Description: WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/wuzhicms/wuzhicms/issues/138; https://github.com/wuzhicms/wuzhicms/issues/138
CVE: CVE-2018-11531
Published: 2018-05-29
Description: Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Exiv2/exiv2/issues/283; https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html; https://security.gentoo.org/glsa/201811-14
CVE: CVE-2018-11532
Published: 2018-05-29
Description: An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/vintagedaddyo/MyBB_Plugin-ChangUonDyU-Advanced-Statistics/commit/8122c93f4c3b517b9d35338fe77ba91d9a6ac08a; https://www.exploit-db.com/exploits/44795/; https://github.com/vintagedaddyo/MyBB_Plugin-ChangUonDyU-Advanced-Statistics/commit/8122c93f4c3b517b9d35338fe77ba91d9a6ac08a
CVE: CVE-2018-11535
Published: 2018-05-29
Description: An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/NinjaXshell/f894bd79f9707a92a7b6934711a8fdc9; https://www.exploit-db.com/exploits/44793/; https://gist.github.com/NinjaXshell/f894bd79f9707a92a7b6934711a8fdc9
CVE: CVE-2018-11536
Published: 2018-05-29
Description: md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/mity/md4c/issues/36; https://github.com/mity/md4c/issues/36
CVE: CVE-2016-7076
Published: 2018-05-29
Description: sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-184, CWE-77
References: http://rhn.redhat.com/errata/RHSA-2016-2872.html; http://www.securityfocus.com/bid/95778; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7076
CVE: CVE-2017-1768
Published: 2018-05-29
Description: IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 136471.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22016515; http://www.securityfocus.com/bid/104493; https://exchange.xforce.ibmcloud.com/vulnerabilities/136471
CVE: CVE-2018-1369
Published: 2018-05-29
Description: IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 137767.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22016131; https://exchange.xforce.ibmcloud.com/vulnerabilities/137767; http://www.ibm.com/support/docview.wss?uid=swg22016131
CVE: CVE-2018-1370
Published: 2018-05-29
Description: IBM Security Guardium Big Data Intelligence (SonarG) 3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 137769.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-732
References: http://www.ibm.com/support/docview.wss?uid=swg22016132; https://exchange.xforce.ibmcloud.com/vulnerabilities/137769; http://www.ibm.com/support/docview.wss?uid=swg22016132
CVE: CVE-2018-1375
Published: 2018-05-29
Description: IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 137776.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384
References: http://www.ibm.com/support/docview.wss?uid=swg22016513; https://exchange.xforce.ibmcloud.com/vulnerabilities/137776; http://www.ibm.com/support/docview.wss?uid=swg22016513
CVE: CVE-2018-1376
Published: 2018-05-29
Description: IBM Security Guardium Big Data Intelligence (SonarG) 3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137777.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22016512; https://exchange.xforce.ibmcloud.com/vulnerabilities/137777; http://www.ibm.com/support/docview.wss?uid=swg22016512
CVE: CVE-2018-5241
Published: 2018-05-29
Description: Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, ASG and ProxySG incorrectly handle XML nodes with comments. A remote attacker can modify a valid SAML response without invalidating its cryptographic signature. This may allow the attacker to bypass user authentication security controls in ASG and ProxySG. This vulnerability only affects authentication of network users in intercepted traffic. It does not affect administrator user authentication for the ASG and ProxySG management consoles.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/104282; http://www.securitytracker.com/id/1040993; https://www.symantec.com/security-center/network-protection-security-advisories/SA167
CVE: CVE-2018-1235
Published: 2018-05-29
Description: Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://seclists.org/fulldisclosure/2018/May/61; http://www.securityfocus.com/bid/104246; https://www.exploit-db.com/exploits/44920/
CVE: CVE-2018-1241
Published: 2018-05-29
Description: Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP password in plain-text into the RecoverPoint log file. An authenticated malicious user with access to the RecoverPoint log files may obtain the exposed LDAP password to use it in further attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-532, CWE-532
References: http://seclists.org/fulldisclosure/2018/May/61; http://www.securityfocus.com/bid/104246; http://seclists.org/fulldisclosure/2018/May/61
CVE: CVE-2018-1242
Published: 2018-05-29
Description: Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability in the Boxmgmt CLI. An authenticated malicious user with boxmgmt privileges may potentially exploit this vulnerability to read RPA files. Note that files that require root permission cannot be read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: http://seclists.org/fulldisclosure/2018/May/61; http://www.securityfocus.com/bid/104246; http://seclists.org/fulldisclosure/2018/May/61
CVE: CVE-2018-1495
Published: 2018-05-29
Description: IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of service. IBM X-Force ID: 141148.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: http://www.ibm.com/support/docview.wss?uid=ssg1S1012280; http://www.ibm.com/support/docview.wss?uid=ssg1S1012281; https://exchange.xforce.ibmcloud.com/vulnerabilities/141148
CVE: CVE-2014-10067
Published: 2018-05-29
Description: paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://github.com/andzdroid/paypal-ipn/issues/11; https://nodesecurity.io/advisories/26; https://github.com/andzdroid/paypal-ipn/issues/11
CVE: CVE-2014-10068
Published: 2018-05-29
Description: The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82; https://github.com/hapijs/inert/pull/15; https://nodesecurity.io/advisories/14
CVE: CVE-2015-9235
Published: 2018-05-29
Description: In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-327
References: https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/; https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687; https://nodesecurity.io/advisories/17
CVE: CVE-2015-9240
Published: 2018-05-29
Description: Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: https://nodesecurity.io/advisories/60; https://nodesecurity.io/advisories/60
CVE: CVE-2015-9241
Published: 2018-05-29
Description: Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580; https://github.com/jfhbrook/node-ecstatic/pull/179; https://nodesecurity.io/advisories/63
CVE: CVE-2015-9242
Published: 2018-05-29
Description: Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-20
References: https://bugs.chromium.org/p/v8/issues/detail?id=4640; https://github.com/jfhbrook/node-ecstatic/pull/179; https://nodesecurity.io/advisories/64
CVE: CVE-2015-9243
Published: 2018-05-29
Description: When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config that included security restrictions (like origin) would have those restrictions overridden by less restrictive defaults (e.g. origin defaults to all origins `*`).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284, CWE-254
References: https://github.com/hapijs/hapi/issues/2980; https://nodesecurity.io/advisories/65; https://github.com/hapijs/hapi/issues/2980
CVE: CVE-2015-9244
Published: 2018-05-29
Description: Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/felixge/node-mysql/issues/342; https://nodesecurity.io/advisories/66; https://github.com/felixge/node-mysql/issues/342
CVE: CVE-2016-10525
Published: 2018-05-29
Description: When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/dwyl/hapi-auth-jwt2/issues/111; https://github.com/dwyl/hapi-auth-jwt2/pull/112; https://nodesecurity.io/advisories/81
CVE: CVE-2016-10551
Published: 2018-05-29
Description: waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contains`, `startsWith`, or `endsWith` will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in waterline-sequel 0.50 that will get executed and have full access to the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/balderdashy/waterline/issues/1219#issuecomment-157294530; https://nodesecurity.io/advisories/115; https://github.com/balderdashy/waterline/issues/1219#issuecomment-157294530
CVE: CVE-2016-10556
Published: 2018-05-29
Description: sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. This causes potential SQL injection in sequelize 3.19.3 and earlier, where a malicious user could put `["test", "'); DELETE TestTable WHERE Id = 1 --')"]` inside of ``` database.query('SELECT * FROM TestTable WHERE Name IN (:names)', { replacements: { names: directCopyOfUserInput } }); ``` and cause the SQL statement to become `SELECT Id FROM Table WHERE Name IN ('test', '\'); DELETE TestTable WHERE Id = 1 --')`. In Postgres, MSSQL, and SQLite, the backslash has no special meaning. This causes the the statement to delete whichever Id has a value of 1 in the TestTable table.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/sequelize/sequelize/issues/5671; https://nodesecurity.io/advisories/102; https://github.com/sequelize/sequelize/issues/5671
CVE: CVE-2016-10558
Published: 2018-05-29
Description: aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/167; https://nodesecurity.io/advisories/167
CVE: CVE-2016-10559
Published: 2018-05-29
Description: selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/164; https://nodesecurity.io/advisories/164
CVE: CVE-2016-10566
Published: 2018-05-29
Description: install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/204; https://nodesecurity.io/advisories/204
CVE: CVE-2016-10567
Published: 2018-05-29
Description: product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download JavaScript resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/171; https://nodesecurity.io/advisories/171
CVE: CVE-2016-10568
Published: 2018-05-29
Description: geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/183; https://nodesecurity.io/advisories/183
CVE: CVE-2016-10570
Published: 2018-05-29
Description: pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/189; https://nodesecurity.io/advisories/189
CVE: CVE-2016-10573
Published: 2018-05-29
Description: baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versions below 3.0.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/240; https://nodesecurity.io/advisories/240
CVE: CVE-2016-10577
Published: 2018-05-29
Description: ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://github.com/ibmdb/node-ibm_db/commit/d7e2d4b4cbeb6f067df8bba7d0b2ac5d40fcfc19#diff-315091eb[PII_REDACTED]e05ebc21cd2a94; https://nodesecurity.io/advisories/163; https://github.com/ibmdb/node-ibm_db/commit/d7e2d4b4cbeb6f067df8bba7d0b2ac5d40fcfc19#diff-315091eb[PII_REDACTED]e05ebc21cd2a94
CVE: CVE-2016-10578
Published: 2018-05-29
Description: unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/161; https://nodesecurity.io/advisories/161
CVE: CVE-2016-10584
Published: 2018-05-29
Description: dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/181; https://nodesecurity.io/advisories/181
CVE: CVE-2016-10586
Published: 2018-05-29
Description: macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/180; https://nodesecurity.io/advisories/180
CVE: CVE-2016-10589
Published: 2018-05-29
Description: selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/175; https://nodesecurity.io/advisories/175
CVE: CVE-2016-10590
Published: 2018-05-29
Description: cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/190; https://nodesecurity.io/advisories/190
CVE: CVE-2016-10591
Published: 2018-05-29
Description: Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI. prince downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://nodesecurity.io/advisories/185; https://nodesecurity.io/advisories/185
CVE: CVE-2016-10593
Published: 2018-05-29
Description: ibapi is an Interactive Brokers API addon for NodeJS. ibapi downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. Before 2.5.6, it may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-311, CWE-310
References: https://gitlord.com/commitdiff/~dchem%2Fnode-ibapi-addon.git/c00dd7c98cca[PII_REDACTED]337e523eeb7776da68; https://gitlord.com/summary/~dchem%2Fnode-ibapi-addon.git; https://nodesecurity.io/advisories/182