deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-2190
Published: 2020-06-03
Description: Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1866; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-2191
Published: 2020-06-03
Description: Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1200; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-2192
Published: 2020-06-03
Description: A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1200; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-2193
Published: 2020-06-03
Description: Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1841; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-2194
Published: 2020-06-03
Description: Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1842; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-2195
Published: 2020-06-03
Description: Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1837; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-2196
Published: 2020-06-03
Description: Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; http://www.openwall.com/lists/oss-security/2022/04/14/2; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1766
CVE: CVE-2020-2197
Published: 2020-06-03
Description: Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Project job configurations in XML format.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1582; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-2198
Published: 2020-06-03
Description: Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting job config.xml data to users without Job/Configure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1582; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-2199
Published: 2020-06-03
Description: Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1726; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-2200
Published: 2020-06-03
Description: Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.openwall.com/lists/oss-security/2020/06/03/3; https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1879; http://www.openwall.com/lists/oss-security/2020/06/03/3
CVE: CVE-2020-7115
Published: 2020-06-03
Description: The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. Upon successful bypass an attacker could then execute an exploit that would allow to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://packetstormsecurity.com/files/158368/ClearPass-Policy-Manager-Unauthenticated-Remote-Command-Execution.html; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt; http://packetstormsecurity.com/files/158368/ClearPass-Policy-Manager-Unauthenticated-Remote-Command-Execution.html
CVE: CVE-2020-7116
Published: 2020-06-03
Description: The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.
CVSS Score: 7.2 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt
CVE: CVE-2020-7117
Published: 2020-06-03
Description: The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. When the attacker is already authenticated to the administrative interface, they could then exploit the system, leading to remote command execution in the underlying operating system. Resolution: Fixed in 6.7.13-HF, 6.8.5-HF, 6.8.6, 6.9.1 and higher.
CVSS Score: 7.2 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-005.txt
CVE: CVE-2020-10516
Published: 2020-06-03
Description: An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285, CWE-552
References: https://enterprise.github.com/releases/2.18.20/notes; https://enterprise.github.com/releases/2.19.15/notes; https://enterprise.github.com/releases/2.20.9/notes
CVE: CVE-2020-10749
Published: 2020-06-03
Description: A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-300
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00063.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00065.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10749
CVE: CVE-2020-13254
Published: 2020-06-03
Description: An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://docs.djangoproject.com/en/3.0/releases/security/; https://groups.google.com/d/msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ; https://lists.debian.org/debian-lts-announce/2020/06/msg00016.html
CVE: CVE-2020-13596
Published: 2020-06-03
Description: An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.djangoproject.com/en/3.0/releases/security/; https://groups.google.com/forum/#%21msg/django-announce/pPEmb2ot4Fo/X-SMalYSBAAJ; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
CVE: CVE-2020-13756
Published: 2020-06-03
Description: Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html; http://seclists.org/fulldisclosure/2020/Jun/7; https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4
CVE: CVE-2020-1703
Published: 2020-06-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Red Hat Product Security does not consider this as a security flaw. Password changes aren't expected to invalidate existing sessions. Though this is how Kerberos behaves: incrementing kvno will not invalidate any existing service tickets. This is not a concern because the lifetime on service tickets should be set appropriately (initially only a global, now also more finely configurable with the kdcpolicy plugin). This belief is reinforced by our use of mod_session: existing sessions there aren't terminated, but instead wait for expiration
CVE: CVE-2020-4177
Published: 2020-06-03
Description: IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174732.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174732; https://www.ibm.com/support/pages/node/6218970; https://exchange.xforce.ibmcloud.com/vulnerabilities/174732
CVE: CVE-2020-4180
Published: 2020-06-03
Description: IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 174735.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174735; https://www.ibm.com/support/pages/node/6218960; https://exchange.xforce.ibmcloud.com/vulnerabilities/174735
CVE: CVE-2020-4182
Published: 2020-06-03
Description: IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174738.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174738; https://www.ibm.com/support/pages/node/6218964; https://exchange.xforce.ibmcloud.com/vulnerabilities/174738
CVE: CVE-2020-4187
Published: 2020-06-03
Description: IBM Security Guardium 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-Force ID: 174805.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174805; https://www.ibm.com/support/pages/node/6218972; https://exchange.xforce.ibmcloud.com/vulnerabilities/174805
CVE: CVE-2020-4190
Published: 2020-06-03
Description: IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174851.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174851; https://www.ibm.com/support/pages/node/6218958; https://exchange.xforce.ibmcloud.com/vulnerabilities/174851
CVE: CVE-2020-4307
Published: 2020-06-03
Description: IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service attack. IBM X-Force ID: 176997.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176997; https://www.ibm.com/support/pages/node/6218974; https://exchange.xforce.ibmcloud.com/vulnerabilities/176997
CVE: CVE-2019-19213
Published: 2020-06-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none
CVE: CVE-2019-19214
Published: 2020-06-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none
CVE: CVE-2019-20809
Published: 2020-06-03
Description: The price oracle in PriceOracle.sol in Compound Finance Compound Price Oracle 1.0 through 2.0 allows a price poster to set an invalid asset price via the setPrice function, and consequently violate the intended limits on price swings.
CVSS Score: 7.5 (HIGH)
References: https://privacylog.blogspot.com/2019/10/compound-finance-zero-day-prices-can.html; https://privacylog.blogspot.com/2019/10/compound-finance-zero-day-prices-can.html
CVE: CVE-2020-12846
Published: 2020-06-03
Description: Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2020-13597
Published: 2020-06-03
Description: Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-201, CWE-200
References: https://github.com/kubernetes/kubernetes/issues/91507; https://groups.google.com/forum/#%21topic/kubernetes-security-announce/BMb_6ICCfp8; https://www.projectcalico.org/security-bulletins/
CVE: CVE-2020-13782
Published: 2020-06-03
Description: D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174; https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174
CVE: CVE-2020-13783
Published: 2020-06-03
Description: D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174; https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174
CVE: CVE-2020-13784
Published: 2020-06-03
Description: D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-335
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174; https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174
CVE: CVE-2020-13785
Published: 2020-06-03
Description: D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174; https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174
CVE: CVE-2020-13786
Published: 2020-06-03
Description: D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174; https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174
CVE: CVE-2020-13787
Published: 2020-06-03
Description: D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174; https://unit42.paloaltonetworks.com/6-new-d-link-vulnerabilities-found-on-home-routers/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10174
CVE: CVE-2020-3319
Published: 2020-06-03
Description: A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file. This vulnerability affects Cisco Webex Network Recording Player and Webex Player releases earlier than Release 3.0 MR3 Security Patch 2 and 4.0 MR3.
CVSS Score: 3.3 (LOW)
CWE: CWE-20, CWE-20
References: https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs98254; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs98254
CVE: CVE-2020-3321
Published: 2020-06-03
Description: A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-20, CWE-20
References: https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs98259; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs98259
CVE: CVE-2020-3322
Published: 2020-06-03
Description: A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-20, CWE-20
References: https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs98269; https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs98269
CVE: CVE-2020-4035
Published: 2020-06-03
Description: In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Injection vulnerability in iOS adapter implementation and cause the app to delete all or selected records from the database, generally causing the app to become unusable. This may happen in apps that don't validate IDs (valid IDs are `/^[a-zA-Z0-9_-.]+$/`) and use Watermelon Sync or low-level `database.adapter.destroyDeletedRecords` method. The integrity risk is low due to the fact that maliciously deleted records won't synchronize, so logout-login will restore all data, although some local changes may be lost if the malicious deletion causes the sync process to fail to proceed to push stage. No way to breach confidentiality with this vulnerability is known. Full exploitation of SQL Injection is mitigated, because it's not possible to nest an insert/update query inside a delete query in SQLite, and it's not possible to pass a semicolon-separated second query. There's also no known practicable way to breach confidentiality by selectively deleting records, because those records will not be synchronized. It's theoretically possible that selective record deletion could cause an app to behave insecurely if lack of a record is used to make security decisions by the app. This is patched in versions 0.15.1, 0.16.2, and 0.16.1-fix
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/Nozbe/WatermelonDB/commit/924c7ae2a8d7d[PII_REDACTED]e5b9b1bf91a218025; https://github.com/Nozbe/WatermelonDB/security/advisories/GHSA-38f9-m297-6q9g; https://github.com/Nozbe/WatermelonDB/commit/924c7ae2a8d7d[PII_REDACTED]e5b9b1bf91a218025