deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-50777
Published: 2023-12-13
Description: Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312, CWE-863
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50778
Published: 2023-12-13
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified token.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3179; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-50779
Published: 2023-12-13
Description: Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2023/12/13/4; https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3179; http://www.openwall.com/lists/oss-security/2023/12/13/4
CVE: CVE-2023-6765
Published: 2023-12-13
Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects the function prepare of the file email_setup.php. The manipulation of the argument name leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247895.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/xitanging/article/details/134903112; https://vuldb.com/?ctiid.247895; https://vuldb.com/?id.247895
CVE: CVE-2023-6766
Published: 2023-12-13
Description: A vulnerability classified as problematic has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the file /admin/course.php of the component Delete Course Handler. The manipulation of the argument delid leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247896.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/csrf_delete_course.md; https://vuldb.com/?ctiid.247896; https://vuldb.com/?id.247896
CVE: CVE-2023-6767
Published: 2023-12-13
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Wedding Guest e-Book 1.0. This affects an unknown part of the file /endpoint/add-guest.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-247899.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://vuldb.com/?ctiid.247899; https://vuldb.com/?id.247899; https://vuldb.com/?ctiid.247899
CVE: CVE-2023-43813
Published: 2023-12-13
Description: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/commit/4bd7f02d940953b9cbc9d285f7544bb0e490e75e; https://github.com/glpi-project/glpi/releases/tag/10.0.11; https://github.com/glpi-project/glpi/security/advisories/GHSA-94c3-fw5r-3362
CVE: CVE-2023-46726
Published: 2023-12-13
Description: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://github.com/glpi-project/glpi/commit/42ba2b031bec0b3889317db25f3adf9080fc11b2; https://github.com/glpi-project/glpi/releases/tag/10.0.11; https://github.com/glpi-project/glpi/security/advisories/GHSA-qc92-gxc6-5f95
CVE: CVE-2023-46727
Published: 2023-12-13
Description: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory.
CVSS Score: 8.6 (HIGH)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/commit/ee2d674481ebef177037e8e14d35c9455b5cfd46; https://github.com/glpi-project/glpi/releases/tag/10.0.11; https://github.com/glpi-project/glpi/security/advisories/GHSA-v799-2mp3-wgfr
CVE: CVE-2023-6771
Published: 2023-12-13
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Simple Student Attendance System 1.0. This issue affects the function save_attendance of the file actions.class.php. The manipulation of the argument sid leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247907.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Glunko/Simple-Student-Attendance-System_vulnerability/blob/main/README.md; https://vuldb.com/?ctiid.247907; https://vuldb.com/?id.247907
CVE: CVE-2023-6772
Published: 2023-12-13
Description: A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/Num-Nine/CVE/issues/8; https://vuldb.com/?ctiid.247908; https://vuldb.com/?id.247908
CVE: CVE-2023-6789
Published: 2023-12-13
Description: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface. Then, when viewed by a properly authenticated administrator, the JavaScript payload executes and disguises all associated actions as performed by that unsuspecting authenticated administrator.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2023-6789; https://security.paloaltonetworks.com/CVE-2023-6789
CVE: CVE-2023-6790
Published: 2023-12-13
Description: A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an administrator’s browser when they view a specifically crafted link to the PAN-OS web interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/CVE-2023-6790; https://security.paloaltonetworks.com/CVE-2023-6790
CVE: CVE-2023-6791
Published: 2023-12-13
Description: A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-701, CWE-522
References: https://security.paloaltonetworks.com/CVE-2023-6791; https://security.paloaltonetworks.com/CVE-2023-6791
CVE: CVE-2023-6792
Published: 2023-12-13
Description: An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-88, CWE-78
References: https://security.paloaltonetworks.com/CVE-2023-6792; https://security.paloaltonetworks.com/CVE-2023-6792
CVE: CVE-2023-6793
Published: 2023-12-13
Description: An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API keys from the firewall and disrupt XML API usage.
CVSS Score: 2.7 (LOW)
CWE: CWE-269, CWE-269
References: https://security.paloaltonetworks.com/CVE-2023-6793; https://security.paloaltonetworks.com/CVE-2023-6793
CVE: CVE-2023-6794
Published: 2023-12-13
Description: An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://security.paloaltonetworks.com/CVE-2023-6794; https://security.paloaltonetworks.com/CVE-2023-6794
CVE: CVE-2023-6795
Published: 2023-12-13
Description: An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://security.paloaltonetworks.com/CVE-2023-6795; https://security.paloaltonetworks.com/CVE-2023-6795
CVE: CVE-2023-46247
Published: 2023-12-13
Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used `math.ceil(type_.size_in_bytes / 32)`. The intermediate floating point step can produce a rounding error if there are enough bits set in the IEEE-754 mantissa. Roughly speaking, if `type_.size_in_bytes` is large (> 2**46), and slightly less than a power of 2, the calculation can overestimate how many slots are needed by 1. If `type_.size_in_bytes` is slightly more than a power of 2, the calculation can underestimate how many slots are needed by 1. This issue is patched in version 0.3.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-193, CWE-682
References: https://github.com/vyperlang/vyper/blob/6020b8bbf66b062d299d87bc7e4eddc4c9d1c157/vyper/semantics/validation/data_positions.py#L197; https://github.com/vyperlang/vyper/commit/0bb7203b584e771b23536ba065a6efda457161bb; https://github.com/vyperlang/vyper/security/advisories/GHSA-6m97-7527-mh74
CVE: CVE-2023-49296
Published: 2023-12-13
Description: The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. A vulnerability in versions prior to 1.3.6 affects the endpoint `/certificate.crt` and the way the web interface of the ArduinoCreateAgent handles custom error messages. An attacker that is able to persuade a victim into clicking on a malicious link can perform a Reflected Cross-Site Scripting attack on the web interface of the create agent, which would allow the attacker to execute arbitrary browser client side code. Version 1.3.6 contains a fix for the issue.

CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/arduino/arduino-create-agent/commit/9a0e582bb8a1ff8e70d202943ddef8625ccefcc8; https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-j5hc-wx84-844h; https://github.com/arduino/arduino-create-agent/commit/9a0e582bb8a1ff8e70d202943ddef8625ccefcc8
CVE: CVE-2023-50441
Published: 2023-12-13
Description: Encrypted folders created by PRIMX ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission) or ZONECENTRAL for Windows before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger outbound network traffic from computers on which folders are opened.
CVSS Score: 5.5 (MEDIUM)
References: https://www.primx.eu/en/bulletins/security-bulletin-23B3093A/; https://www.primx.eu/fr/blog/; https://www.primx.eu/en/bulletins/security-bulletin-23B3093A/
CVE: CVE-2023-50444
Published: 2023-12-13
Description: By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before 2023.5; ZEDMAIL for Windows before 2023.5; and ZED! for Windows, Mac, Linux before 2023.5 include an encrypted version of sensitive user information, which could allow an unauthenticated attacker to obtain it via brute force.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://www.primx.eu/en/bulletins/security-bulletin-23B30874/; https://www.primx.eu/fr/blog/; https://www.primx.eu/en/bulletins/security-bulletin-23B30874/
CVE: CVE-2023-6773
Published: 2023-12-13
Description: A vulnerability has been found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /accounts_con/register_account of the component User Creation Handler. The manipulation of the argument account_type with the input Admin leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247909 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://drive.google.com/drive/folders/1yuc1n6tr57wD8qsT0HAFDVAuii7iibDM?usp=sharing; https://vuldb.com/?ctiid.247909; https://vuldb.com/?id.247909
CVE: CVE-2023-6774
Published: 2023-12-13
Description: A vulnerability was found in CodeAstro POS and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /accounts_con/register_account. The manipulation of the argument Username with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247910 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/drive/folders/1wnrdIuBhZh5ia9Q61b_V_72eIaHsX-B1?usp=sharing; https://vuldb.com/?ctiid.247910; https://vuldb.com/?id.247910
CVE: CVE-2023-47619
Published: 2023-12-13
Description: Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of time of publication, no patches are available.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200, CWE-918, CWE-918
References: https://github.com/advplyr/audiobookshelf/blob/d7b2476473ef1934eedec41425837cddf2d4b13e/server/controllers/AuthorController.js#L66; https://securitylab.github.com/advisories/GHSL-2023-203_GHSL-2023-204_audiobookshelf/; https://github.com/advplyr/audiobookshelf/blob/d7b2476473ef1934eedec41425837cddf2d4b13e/server/controllers/AuthorController.js#L66
CVE: CVE-2023-47624
Published: 2023-12-13
Description: Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files from the local file system due to a path traversal in the `/hls` endpoint. This issue may lead to Information Disclosure. As of time of publication, no patches are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/advplyr/audiobookshelf/blob/d7b2476473ef1934eedec41425837cddf2d4b13e/server/routers/HlsRouter.js#L32; https://securitylab.github.com/advisories/GHSL-2023-203_GHSL-2023-204_audiobookshelf/; https://github.com/advplyr/audiobookshelf/blob/d7b2476473ef1934eedec41425837cddf2d4b13e/server/routers/HlsRouter.js#L32
CVE: CVE-2023-48702
Published: 2023-12-13
Description: Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `ProcessStartInfo` via the `ValidateVersion` function. A malicious administrator can setup a network share and supply a UNC path to `/System/MediaEncoder/Path` which points to an executable on the network share, causing Jellyfin server to run the executable in the local context. The endpoint was removed in version 10.8.13.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://github.com/jellyfin/jellyfin/commit/83d2c69516471e2db72d9273c6a04247d0f37c86; https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rr9h-w522-cvmr; https://securitylab.github.com/advisories/GHSL-2023-028_jellyfin/
CVE: CVE-2023-49877
Published: 2023-12-13
Description: IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive information, caused by improper filtering of URLs. By submitting a specially crafted HTTP GET request, an attacker could exploit this vulnerability to view application source code, system configuration information, or other sensitive data related to the Management Interface.   IBM X-Force ID:  272651.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/272651; https://www.ibm.com/support/pages/node/7092383; https://exchange.xforce.ibmcloud.com/vulnerabilities/272651
CVE: CVE-2023-49878
Published: 2023-12-13
Description: IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  272652.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/272652; https://www.ibm.com/support/pages/node/7092383; https://exchange.xforce.ibmcloud.com/vulnerabilities/272652
CVE: CVE-2023-50246
Published: 2023-12-13
Description: jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120, CWE-122, CWE-787
References: http://www.openwall.com/lists/oss-security/2023/12/15/10; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574; https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297
CVE: CVE-2023-50248
Published: 2023-12-13
Description: CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-130
References: https://github.com/ckan/ckan/commit/bd02018b65c5b81d7ede195d00d0fcbac3aa33be; https://github.com/ckan/ckan/security/advisories/GHSA-7fgc-89cx-w8j5; https://github.com/ckan/ckan/commit/bd02018b65c5b81d7ede195d00d0fcbac3aa33be
CVE: CVE-2023-50262
Published: 2023-12-13
Description: Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not reference itself. However, prior to version 2.0.4, a recursive chained using two or more SVG documents is not correctly validated. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself.

php-svg-lib, when run in isolation, does not support SVG references for `image` elements. However, when used in combination with Dompdf, php-svg-lib will process SVG images referenced by an `image` element. Dompdf currently includes validation to prevent self-referential `image` references, but a chained reference is not checked. A malicious actor may thus trigger infinite recursion by chaining references between two or more SVG images.

When Dompdf parses a malicious payload, it will crash due after exceeding the allowed execution time or memory usage. An attacker sending multiple request to a system can potentially cause resource exhaustion to the point that the system is unable to handle incoming request.

Version 2.0.4 contains a fix for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-674
References: https://github.com/dompdf/dompdf/blob/v2.0.3/src/Image/Cache.php#L136-L153; https://github.com/dompdf/dompdf/commit/41cbac16f3cf56affa49f06e8dae66d0eac2b593; https://github.com/dompdf/dompdf/security/advisories/GHSA-3qx2-6f78-w2j2
CVE: CVE-2023-50268
Published: 2023-12-13
Description: jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120, CWE-121, CWE-787
References: http://www.openwall.com/lists/oss-security/2023/12/15/10; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771; https://github.com/jqlang/jq/commit/c9a51565214eece8f[PII_REDACTED]aea73145bfd6b
CVE: CVE-2023-50439
Published: 2023-12-13
Description: ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission), ZED! for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission), ZONECENTRAL for Windows before 2023.5, or ZEDMAIL for Windows before 2023.5 disclose the original path in which the containers were created, which allows an unauthenticated attacker to obtain some information regarding the context of use (project name, etc.).
CVSS Score: 5.3 (MEDIUM)
References: https://www.primx.eu/en/bulletins/security-bulletin-23B30930/; https://www.primx.eu/fr/blog/; https://www.primx.eu/en/bulletins/security-bulletin-23B30930/
CVE: CVE-2023-50440
Published: 2023-12-13
Description: ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission); ZONECENTRAL for Windows before 2023.5; ZEDMAIL for Windows before 2023.5; ZED! for Windows, Mac, Linux before 2023.5; ZEDFREE for Windows, Mac, Linux before 2023.5; or ZEDPRO for Windows, Mac, Linux before 2023.5 can be modified by an unauthenticated attacker to include a UNC reference so that it could trigger network access to an attacker-controlled computer when opened by the victim.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://www.primx.eu/en/bulletins/security-bulletin-23B30931/; https://www.primx.eu/fr/blog/; https://www.primx.eu/en/bulletins/security-bulletin-23B30931/
CVE: CVE-2023-50442
Published: 2023-12-13
Description: Encrypted folders created by PRIMX ZONECENTRAL through 2023.5 can be modified by a local attacker (with appropriate privileges) so that specific file types are excluded from encryption temporarily. (This modification can, however, be detected, as described in the Administrator Guide.)
CVSS Score: 5.5 (MEDIUM)
References: https://www.primx.eu/en/bulletins/security-bulletin-23B30933/; https://www.primx.eu/fr/blog/; https://www.primx.eu/en/bulletins/security-bulletin-23B30933/