deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-4341
Published: 2024-07-08
Description: Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users.This issue affects Extreme XDS: before 3928.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-862
References: https://www.usom.gov.tr/bildirim/tr-24-0893; https://www.usom.gov.tr/bildirim/tr-24-0893
CVE: CVE-2024-25639
Published: 2024-07-08
Description: Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-80, CWE-77, CWE-79
References: https://github.com/khoj-ai/khoj/commit/1dfd6d7391862d3564db7f[PII_REDACTED]b73cb6cc; https://github.com/khoj-ai/khoj/security/advisories/GHSA-h2q2-vch3-72qm; https://github.com/khoj-ai/khoj/commit/1dfd6d7391862d3564db7f[PII_REDACTED]b73cb6cc
CVE: CVE-2024-39308
Published: 2024-07-08
Description: RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef; https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673; https://github.com/railsadminteam/rails_admin/issues/3686
CVE: CVE-2024-39677
Published: 2024-07-08
Description: NHibernate is an object-relational mapper for the .NET framework. A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. Callers of these methods are exposed to the vulnerability, which includes mappings using inheritance with discriminator values; HQL queries referencing a static field of the application; users of the SqlInsertBuilder and SqlUpdateBuilder utilities, calling their AddColumn overload taking a literal value; and any direct use of the ObjectToSQLString methods for building SQL queries on the user side. This vulnerability is fixed in 5.4.9 and 5.5.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/nhibernate/nhibernate-core/commit/b4a69d1a5ff[PII_REDACTED]d70308329af496e4ba9; https://github.com/nhibernate/nhibernate-core/issues/3516; https://github.com/nhibernate/nhibernate-core/pull/3517
CVE: CVE-2023-34435
Published: 2024-07-08
Description: A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead to arbitrary firmware update. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1874; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1874; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1874
CVE: CVE-2023-41251
Published: 2024-07-08
Description: A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1894; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1894; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1894
CVE: CVE-2023-45215
Published: 2024-07-08
Description: A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1891; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1891; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1891
CVE: CVE-2023-45742
Published: 2024-07-08
Description: An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1877; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1877; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1877
CVE: CVE-2023-46685
Published: 2024-07-08
Description: A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted network packets can lead to arbitrary command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1871; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1871; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1871
CVE: CVE-2023-47677
Published: 2024-07-08
Description: A cross-site request forgery (csrf) vulnerability exists in the boa CSRF protection functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network request can lead to CSRF. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1872; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1872; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1872
CVE: CVE-2023-47856
Published: 2024-07-08
Description: A stack-based buffer overflow vulnerability exists in the boa set_RadvdPrefixParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1892; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1892; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1892
CVE: CVE-2023-48270
Published: 2024-07-08
Description: A stack-based buffer overflow vulnerability exists in the boa formDnsv6 functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1876; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1876; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1876
CVE: CVE-2023-49073
Published: 2024-07-08
Description: A stack-based buffer overflow vulnerability exists in the boa formFilter functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1875; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1875; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1875
CVE: CVE-2023-49593
Published: 2024-07-08
Description: Leftover debug code exists in the boa formSysCmd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A specially crafted network request can lead to arbitrary command execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-489
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1873; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1873; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1873
CVE: CVE-2023-49595
Published: 2024-07-08
Description: A stack-based buffer overflow vulnerability exists in the boa rollback_control_code functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to arbitrary code execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1878; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1878; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1878
CVE: CVE-2023-49867
Published: 2024-07-08
Description: A stack-based buffer overflow vulnerability exists in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1904; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1904; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1904
CVE: CVE-2023-50239
Published: 2024-07-08
Description: Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `interfacename` request's parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1893; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1893; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1893
CVE: CVE-2023-50240
Published: 2024-07-08
Description: Two stack-based buffer overflow vulnerabilities exist in the boa set_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `AdvDefaultPreference` request's parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1893; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1893; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1893
CVE: CVE-2023-50243
Published: 2024-07-08
Description: Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `comment` request's parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1895; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1895; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1895
CVE: CVE-2023-50244
Published: 2024-07-08
Description: Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This stack-based buffer overflow is related to the `entry_name` request's parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1895; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1895; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1895
CVE: CVE-2023-50330
Published: 2024-07-08
Description: A stack-based buffer overflow vulnerability exists in the boa getInfo functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1903; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1903; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1903
CVE: CVE-2023-50381
Published: 2024-07-08
Description: Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `targetAPSsid` request's parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1899
CVE: CVE-2023-50382
Published: 2024-07-08
Description: Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `peerPin` request's parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1899
CVE: CVE-2023-50383
Published: 2024-07-08
Description: Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `localPin` request's parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1899
CVE: CVE-2024-21778
Published: 2024-07-08
Description: A heap-based buffer overflow vulnerability exists in the configuration file mib_init_value_array functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted .dat file can lead to arbitrary code execution. An attacker can upload a malicious file to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1911; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1911; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1911
CVE: CVE-2024-23562
Published: 2024-07-08
Description: A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information.  A remote unauthenticated attacker could exploit this vulnerability to obtain information to launch further attacks against the affected system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0116923; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113822
CVE: CVE-2024-31504
Published: 2024-07-08
Description: Buffer Overflow vulnerability in SILA Embedded Solutions GmbH freemodbus v.2018-09-12 allows a remtoe attacker to cause a denial of service via the LINUXTCP server component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120, CWE-121
References: https://gist.github.com/CAPCOMIN/a[PII_REDACTED]dce21a557cf9fa01d0a02; https://gist.github.com/CAPCOMIN/a[PII_REDACTED]dce21a557cf9fa01d0a02
CVE: CVE-2024-39202
Published: 2024-07-08
Description: D-Link DIR-823X firmware - 240126 was discovered to contain a remote command execution (RCE) vulnerability via the dhcpd_startip parameter at /goform/set_lan_settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/Swind1er/40c33f1b[PII_REDACTED]cb4e2e5ef69109; https://gist.github.com/Swind1er/40c33f1b[PII_REDACTED]cb4e2e5ef69109
CVE: CVE-2024-39203
Published: 2024-07-08
Description: A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/5r1an/CVE-2024-39203/issues/1; https://github.com/5r1an/CVE-2024-39203/issues/1
CVE: CVE-2024-39695
Published: 2024-07-08
Description: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/Exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387; https://github.com/Exiv2/exiv2/pull/3006; https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh
CVE: CVE-2024-39699
Published: 2024-07-08
Description: Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security measure and execute a SSRF using redirects. Directus allows redirects when importing file from the URL and does not check the result URL. Thus, it is possible to execute a request to an internal IP, for example to 127.0.0.1. However, it is blind SSRF, because Directus also uses response interception technique to get the information about the connect from the socket directly and it does not show a response if the IP address is internal. This vulnerability is fixed in 10.9.3.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/directus/directus/commit/d577b44231c0923aca99cac5770fd853801caee1; https://github.com/directus/directus/security/advisories/GHSA-8p72-rcq4-h6pw; https://github.com/directus/directus/commit/d577b44231c0923aca99cac5770fd853801caee1
CVE: CVE-2024-6563
Published: 2024-07-08
Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files  https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C .




In line 313 "addr_loaded_cnt" is checked not to be "CHECK_IMAGE_AREA_CNT" (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of "dst" will be written to the area immediately after the buffer, which is "addr_loaded_cnt". This will allow an attacker to freely control the value of "addr_loaded_cnt" and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value ("len") they desire.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-123, CWE-120
References: https://asrg.io/security-advisories/cve-2024-6563/; https://github.com/renesas-rcar/arm-trusted-firmware/commit/235f85b654a031f7647e81b86fc8e4ffeb430164; https://asrg.io/security-advisories/cve-2024-6563/
CVE: CVE-2024-6564
Published: 2024-07-08
Description: Buffer overflow in "rcar_dev_init"  due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://asrg.io/security-advisories/cve-2024-6564/; https://github.com/renesas-rcar/arm-trusted-firmware/commit/c9fb[PII_REDACTED]d2660c7f3b7d4b87dec09fe2f2; https://asrg.io/security-advisories/cve-2024-6564/
CVE: CVE-2024-34702
Published: 2024-07-08
Description: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters.  Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-405
References: https://github.com/randombit/botan/commit/21dccc8fef18c165ba3301d850ac61521f85637e; https://github.com/randombit/botan/commit/39535f13c322f56aa3da2f44b2b6abb8619a82ac; https://github.com/randombit/botan/commit/477822a2d10f02d8ba46c9d8a5132f25843f5cc1
CVE: CVE-2024-39312
Published: 2024-07-08
Description: Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://github.com/randombit/botan/security/advisories/GHSA-jp24-56jm-gg86; https://github.com/randombit/botan/security/advisories/GHSA-jp24-56jm-gg86
CVE: CVE-2024-39701
Published: 2024-07-08
Description: Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do: Pass rule if **field** matches any of the **values**. This vulnerability is fixed in 10.6.0.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/directus/directus/security/advisories/GHSA-hxgm-ghmv-xjjm; https://github.com/directus/directus/security/advisories/GHSA-hxgm-ghmv-xjjm