deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-45869
Published: 2023-10-26
Description: ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://rehmeinfosec.de/labor/cve-2023-45869; https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/; https://rehmeinfosec.de/labor/cve-2023-45869
CVE: CVE-2023-46234
Published: 2023-10-26
Description: browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30; https://github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw; https://lists.debian.org/debian-lts-announce/2023/10/msg00040.html
CVE: CVE-2023-46238
Published: 2023-10-26
Description: ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to an SVG to gain access to the victim’s account in certain scenarios. A victim would need to directly open the malicious image in the browser, where a single session in ZITADEL needs to be active for this exploit to work. If the possible victim had multiple or no active sessions in ZITADEL, the attack would not succeed. This issue has been patched in version 2.39.2 and 2.38.2.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/zitadel/zitadel/releases/tag/v2.38.2; https://github.com/zitadel/zitadel/releases/tag/v2.39.2; https://github.com/zitadel/zitadel/security/advisories/GHSA-954h-jrpm-72pm
CVE: CVE-2023-46449
Published: 2023-10-26
Description: Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of another user and takeover the account via IDOR in the password change function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://github.com/sajaljat/CVE-2023-46449/tree/main; https://www.youtube.com/watch?v=H5QnsOKjs3s; https://github.com/sajaljat/CVE-2023-46449/tree/main
CVE: CVE-2023-46450
Published: 2023-10-26
Description: Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yte121/-CVE-2023-46450/; https://youtu.be/LQy0_xIK2q0; https://github.com/yte121/-CVE-2023-46450/
CVE: CVE-2023-5784
Published: 2023-10-26
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /protocol/firewall/uploadfirewall.php. The manipulation of the argument messagecontent leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-243590 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/gb111d/ns-asg_poc/; https://vuldb.com/?ctiid.243590; https://vuldb.com/?id.243590
CVE: CVE-2023-5785
Published: 2023-10-26
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/firewall/addaddress_interpret.php. The manipulation of the argument messagecontent leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243591. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/ggg48966/cve/blob/main/NS-ASG-sql-addaddress_interpret.md; https://vuldb.com/?ctiid.243591; https://vuldb.com/?id.243591
CVE: CVE-2023-5786
Published: 2023-10-26
Description: A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geoserver/gwc/rest.html. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243592.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425, CWE-425
References: https://github.com/Qxyday/GeoServe---unauthorized; https://vuldb.com/?ctiid.243592; https://vuldb.com/?id.243592
CVE: CVE-2023-5787
Published: 2023-10-26
Description: A vulnerability was found in Shaanxi Chanming Education Technology Score Query System 5.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument stuIdCard leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243593 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Echosssy/-SQL-injection-exists-in-the-score-query-system/blob/main/README.md; https://vuldb.com/?ctiid.243593; https://vuldb.com/?id.243593
CVE: CVE-2023-41966
Published: 2023-10-26
Description: 


The application suffers from a privilege escalation vulnerability. A 
user with read permissions can elevate privileges by sending a HTTP POST
 to set a parameter.








CVSS Score: 6.5 (MEDIUM)
CWE: CWE-267, CWE-269
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08; https://www.sielco.org/en/contacts; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08
CVE: CVE-2023-42769
Published: 2023-10-26
Description: The cookie session ID is of insufficient length and can be exploited by 
brute force, which may allow a remote attacker to obtain a valid 
session, bypass authentication, and manipulate the transmitter.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-307
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08; https://www.sielco.org/en/contacts; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08
CVE: CVE-2023-43208
Published: 2023-10-26
Description: NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78, CWE-502
References: http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html; https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/; http://packetstormsecurity.com/files/176920/Mirth-Connect-4.4.0-Remote-Command-Execution.html
CVE: CVE-2023-45228
Published: 2023-10-26
Description: 

The application suffers from improper access control when editing users.
 A user with read permissions can manipulate users, passwords, and 
permissions by sending a single HTTP POST request with modified 
parameters.






CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08; https://www.sielco.org/en/contacts; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08
CVE: CVE-2023-45317
Published: 2023-10-26
Description: 
The application interface allows users to perform certain actions via 
HTTP requests without performing any validity checks to verify the 
requests. This can be exploited to perform certain actions with 
administrative privileges if a logged-in user visits a malicious web 
site.




CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08; https://www.sielco.org/en/contacts; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08
CVE: CVE-2023-46666
Published: 2023-10-26
Description: An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the Sharepoint site through Elasticsearch.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://discuss.elastic.co/t/elastic-sharepoint-online-python-connector-v8-10-3-0-security-update/344732; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-sharepoint-online-python-connector-v8-10-3-0-security-update/344732
CVE: CVE-2023-5622
Published: 2023-10-26
Description: 
Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing a specially crafted file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://www.tenable.com/security/tns-2023-34; https://www.tenable.com/security/tns-2023-34
CVE: CVE-2023-5623
Published: 2023-10-26
Description: 
NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location


CVSS Score: 7.0 (HIGH)
CWE: CWE-94, CWE-276
References: https://www.tenable.com/security/tns-2023-34; https://www.tenable.com/security/tns-2023-34
CVE: CVE-2023-5624
Published: 2023-10-26
Description: 
Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that could potentially allow a blindSQL injection.


CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.tenable.com/security/tns-2023-34; https://www.tenable.com/security/tns-2023-34
CVE: CVE-2023-5789
Published: 2023-10-26
Description: A vulnerability classified as problematic has been found in Dragon Path 707GR1 up to 20231022. Affected is an unknown function of the component Ping Diagnostics. The manipulation of the argument Host Address with the input >><img/src/onerror=alert(1)> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-243594 is the identifier assigned to this vulnerability.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://drive.google.com/file/d/1s_NzD0Z6lMvRoo9sLXqRvYRaF7XTAYBE/view?usp=sharing; https://vuldb.com/?ctiid.243594; https://vuldb.com/?id.243594
CVE: CVE-2023-5790
Published: 2023-10-26
Description: A vulnerability classified as critical was found in SourceCodester File Manager App 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/add-file.php. The manipulation of the argument uploadedFileName leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243595.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://github.com/Yp1oneer/cve_hub/blob/main/File%20Manager%20App/Unrestricted%20File%20Upload.pdf; https://vuldb.com/?ctiid.243595; https://vuldb.com/?id.243595
CVE: CVE-2023-5791
Published: 2023-10-26
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Sticky Notes App 1.0. This affects an unknown part of the file endpoint/add-note.php. The manipulation of the argument noteTitle/noteContent leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243597 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/Yp1oneer/cve_hub/blob/main/Sticky%20Notes%20App/Cross%20Site%20Scripting.pdf; https://vuldb.com/?ctiid.243597; https://vuldb.com/?id.243597
CVE: CVE-2023-5792
Published: 2023-10-26
Description: A vulnerability has been found in SourceCodester Sticky Notes App 1.0 and classified as critical. This vulnerability affects unknown code of the file endpoint/delete-note.php. The manipulation of the argument note leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-243598 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/Yp1oneer/cve_hub/blob/main/Sticky%20Notes%20App/SQL%20Injection-1.pdf; https://vuldb.com/?ctiid.243598; https://vuldb.com/?id.243598
CVE: CVE-2023-31417
Published: 2023-10-26
Description: Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.elastic.co/community/security
CVE: CVE-2023-31418
Published: 2023-10-26
Description: An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.elastic.co/community/security
CVE: CVE-2023-31419
Published: 2023-10-26
Description: A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.elastic.co/community/security
CVE: CVE-2023-46435
Published: 2023-10-26
Description: Sourcecodester Packers and Movers Management System v1.0 is vulnerable to SQL Injection via mpms/?p=services/view_service&id.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/kirra-max/bug_reports/blob/main/packers-and-movers-management-system-phpoop-free-source-code/SQL-1.md; https://github.com/kirra-max/bug_reports/blob/main/packers-and-movers-management-system-phpoop-free-source-code/SQL-1.md
CVE: CVE-2023-5793
Published: 2023-10-26
Description: A vulnerability was found in flusity CMS and classified as problematic. This issue affects the function loadCustomBlocCreateForm of the file /core/tools/customblock.php of the component Dashboard. The manipulation of the argument customblock_place leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 81252bc764e1de2422e79e36194bba1289e7a0a5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-243599.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/flusity/flusity-CMS/commit/81252bc764e1de2422e79e36194bba1289e7a0a5; https://github.com/flusity/flusity-CMS/issues/1; https://vuldb.com/?ctiid.243599
CVE: CVE-2023-5794
Published: 2023-10-26
Description: A vulnerability was found in PHPGurukul Online Railway Catering System 1.0. It has been classified as critical. Affected is an unknown function of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-243600.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/JacksonStonee/Online-Railway-Catering-System-1.0-has-a-SQL-injection-vulnerability-in-index.php/tree/main; https://vuldb.com/?ctiid.243600; https://vuldb.com/?id.243600
CVE: CVE-2023-5795
Published: 2023-10-26
Description: A vulnerability was found in CodeAstro POS System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /profil of the component Profile Picture Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-243601 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://drive.google.com/file/d/1bjDpJdG28Q5-RGJB89Dzw6YzZ1VHN23X/view?usp=sharing; https://vuldb.com/?ctiid.243601; https://vuldb.com/?id.243601
CVE: CVE-2023-5796
Published: 2023-10-26
Description: A vulnerability was found in CodeAstro POS System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /setting of the component Logo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-243602 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://drive.google.com/file/d/1LIXuVmxby4QTY7v7dD-F0oRnwVVOwlmJ/view?usp=sharing; https://vuldb.com/?ctiid.243602; https://vuldb.com/?id.243602
CVE: CVE-2023-31416
Published: 2023-10-26
Description: Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854
CVE: CVE-2023-0897
Published: 2023-10-26
Description: 
Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.





CVSS Score: 8.8 (HIGH)
CWE: CWE-384, CWE-384
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE: CVE-2023-39427
Published: 2023-10-26
Description: 
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.


CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03
CVE: CVE-2023-39936
Published: 2023-10-26
Description: 


In Ashlar-Vellum Graphite v13.0.48, the affected application lacks proper validation of user-supplied data when parsing VC6 files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.




CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03
CVE: CVE-2023-44267
Published: 2023-10-26
Description: Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'lnm' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/ono; https://https://projectworlds.in/; https://fluidattacks.com/advisories/ono
CVE: CVE-2023-46661
Published: 2023-10-26
Description: 
Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.





CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE: CVE-2023-46662
Published: 2023-10-26
Description: 




Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this via a specially crafted request to gain access to sensitive information.








CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE: CVE-2023-5754
Published: 2023-10-26
Description: 




Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.








CVSS Score: 9.1 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07; https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07
CVE: CVE-2023-5804
Published: 2023-10-26
Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file login.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The identifier VDB-243617 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/JacksonStonee/Nipah-virus-NiV-Testing-Management-System-Using-PHP-and-MySQL-1.0-has-a-SQL-injection-vuln-login.php/blob/main/README.md; https://vuldb.com/?ctiid.243617; https://vuldb.com/?id.243617
CVE: CVE-2023-33558
Published: 2023-10-26
Description: An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e-mails and usernames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/ninj4c0d3r/OcoMon-Research; https://github.com/ninj4c0d3r/OcoMon-Research/commit/6357def478b11119270b89329fceb115f12c69fc; https://github.com/ninj4c0d3r/OcoMon-Research
CVE: CVE-2023-33559
Published: 2023-10-26
Description: A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://github.com/ninj4c0d3r/OcoMon-Research; https://github.com/ninj4c0d3r/OcoMon-Research/commit/7459ff397f48b5356930c16c522331e39158461dv; https://github.com/ninj4c0d3r/OcoMon-Research