deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-10136
Published: 2017-01-13
Description: An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete files owned by the system user. The third-party app can modify the /data/system/users/0/settings_secure.xml file to add an app as a notification listener to be able to receive the text of notifications as they are received on the device. This also allows the /data/system/users/0/accounts.db to be read which contains authentication tokens for various accounts on the device. The third-party app can obtain privileged information and also modify files to obtain more privileges on the device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://www.securityfocus.com/bid/96854; https://www.kryptowire.com/adups_security_analysis.html; https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html
CVE: CVE-2016-10137
Published: 2017-01-13
Description: An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://www.securityfocus.com/bid/96852; https://www.kryptowire.com/adups_security_analysis.html; https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html
CVE: CVE-2016-10138
Published: 2017-01-13
Description: An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and cannot be disabled by the user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. The app has an exported broadcast receiver named com.adups.fota.sysoper.WriteCommandReceiver which any app on the device can interact with. Therefore, any app can send a command embedded in an intent which will be executed by the WriteCommandReceiver component which is executing as the system user. The third-party app, utilizing the WriteCommandReceiver, can perform the following actions: call a phone number, factory reset the device, take pictures of the screen, record the screen in a video, install applications, inject events, obtain the Android log, and others. In addition, the com.adups.fota.sysoper.TaskService component will make a request to a URL of http://rebootv5.adsunflower.com/ps/fetch.do where the commands in the String array with a key of sf in the JSON Object sent back by the server will be executed as the system user. Since the connection is made via HTTP, it is vulnerable to a MITM attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://www.securityfocus.com/bid/96853; https://www.kryptowire.com/adups_security_analysis.html; https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html
CVE: CVE-2016-10139
Published: 2017-01-13
Description: An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfiltration are com.adups.fota and com.adups.fota.sysoper. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. Therefore, the app executing as the system user has been granted a number of powerful permissions even though they are not present in the com.adups.fota.sysoper app's AndroidManifest.xml file. This app provides the com.adups.fota app access to the user's call log, text messages, and various device identifiers through the com.adups.fota.sysoper.provider.InfoProvider component. The com.adups.fota app uses timestamps when it runs and is eligible to exfiltrate the user's PII every 72 hours. If 72 hours have passed since the value of the timestamp, then the exfiltration will be triggered by the user plugging in the device to charge or when they leave or enter a wireless network. The exfiltration occurs in the background without any user interaction.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://www.securityfocus.com/bid/96858; https://www.kryptowire.com/adups_security_analysis.html; https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html
CVE: CVE-2016-10140
Published: 2017-01-13
Description: Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://seclists.org/bugtraq/2017/Feb/6; http://seclists.org/fulldisclosure/2017/Feb/11; http://www.securityfocus.com/bid/96849
CVE: CVE-2016-10141
Published: 2017-01-13
Description: An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045. The attack requires a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://git.ghostscript.com/?p=mujs.git%3Bh=fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045; http://www.securityfocus.com/bid/95876; https://bugs.ghostscript.com/show_bug.cgi?id=697448
CVE: CVE-2016-3128
Published: 2017-01-13
Description: A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to enroll an illegitimate device to the BES, gain access to device parameters for the BES, or send false information to the BES by gaining access to specific information about a device that was legitimately enrolled on the BES.
CVSS Score: 8.2 (HIGH)
CWE: CWE-254
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000038913; http://www.securityfocus.com/bid/95624; http://www.securitytracker.com/id/1037585
CVE: CVE-2016-3130
Published: 2017-01-13
Description: An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to obtain local or domain credentials of an administrator or user account by sniffing traffic between the two elements during a login attempt.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200, CWE-255
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000038914; http://www.securityfocus.com/bid/95924; http://www.securitytracker.com/id/1037584
CVE: CVE-2016-9882
Published: 2017-01-13
Description: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from service brokers in Cloud Controller system component logs. These logs are written to disk and often sent to a log aggregator via syslog.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/95441; https://www.cloudfoundry.org/cve-2016-9882/; http://www.securityfocus.com/bid/95441
CVE: CVE-2017-3890
Published: 2017-01-13
Description: A reflected cross-site scripting vulnerability in the BlackBerry WatchDox Server components Appliance-X, version 1.8.1 and earlier, and vAPP, versions 4.6.0 to 5.4.1, allows remote attackers to execute script commands in the context of the affected browser by persuading a user to click an attacker-supplied malicious link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000038915; http://www.securityfocus.com/bid/95442; http://support.blackberry.com/kb/articleDetail?articleNumber=000038915
CVE: CVE-2017-5364
Published: 2017-01-13
Description: Memory Corruption Vulnerability in Foxit PDF Toolkit v1.3 allows an attacker to cause Denial of Service and Remote Code Execution when the victim opens the specially crafted PDF file. The Vulnerability has been fixed in v2.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/95356; https://www.foxitsoftware.com/support/security-bulletins.php; http://www.securityfocus.com/bid/95356
CVE: CVE-2015-3188
Published: 2017-01-13
Description: The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://packetstormsecurity.com/files/132417/Apache-Storm-0.10.0-beta-Code-Execution.html; http://www.securityfocus.com/archive/1/535804/100/0/threaded; http://www.securitytracker.com/id/1032695
CVE: CVE-2016-2090
Published: 2017-01-13
Description: Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, which trigger a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/01/28/5; https://blog.fuzzing-project.org/36-Heap-buffer-overflow-in-fgetwln-function-of-libbsd.html; https://bugs.freedesktop.org/show_bug.cgi?id=93881
CVE: CVE-2016-6885
Published: 2017-01-13
Description: The pstm_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free and crash) via a base zero value for the modular exponentiation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://www.matrixssl.org/blog/releases/matrixssl_3_8_4; https://blog.fuzzing-project.org/51-Fun-with-Bignums-Crashing-MatrixSSL-and-more.html; http://www.matrixssl.org/blog/releases/matrixssl_3_8_4
CVE: CVE-2016-6886
Published: 2017-01-13
Description: The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via a (1) zero value or (2) the key's modulus for the secret key during RSA key exchange.
CVSS Score: 7.5 (HIGH)
CWE: CWE-320
References: http://www.matrixssl.org/blog/releases/matrixssl_3_8_4; http://www.securityfocus.com/bid/92604; https://blog.fuzzing-project.org/51-Fun-with-Bignums-Crashing-MatrixSSL-and-more.html
CVE: CVE-2016-6887
Published: 2017-01-13
Description: The pstm_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the secret key via a CRT attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.matrixssl.org/blog/releases/matrixssl_3_8_4; https://blog.fuzzing-project.org/51-Fun-with-Bignums-Crashing-MatrixSSL-and-more.html; http://www.matrixssl.org/blog/releases/matrixssl_3_8_4
CVE: CVE-2016-7426
Published: 2017-01-13
Description: NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://nwtime.org/ntp428p9_release/; http://rhn.redhat.com/errata/RHSA-2017-0252.html; http://support.ntp.org/bin/view/Main/NtpBug3071
CVE: CVE-2016-7427
Published: 2017-01-13
Description: The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: http://nwtime.org/ntp428p9_release/; http://support.ntp.org/bin/view/Main/NtpBug3114; http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
CVE: CVE-2016-7428
Published: 2017-01-13
Description: ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: http://nwtime.org/ntp428p9_release/; http://support.ntp.org/bin/view/Main/NtpBug3113; http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
CVE: CVE-2016-7429
Published: 2017-01-13
Description: NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of service (prevent communication with a source) by sending a response for a source to an interface the source does not use.
CVSS Score: 3.7 (LOW)
CWE: CWE-18
References: http://nwtime.org/ntp428p9_release/; http://rhn.redhat.com/errata/RHSA-2017-0252.html; http://support.ntp.org/bin/view/Main/NtpBug3072
CVE: CVE-2016-7431
Published: 2017-01-13
Description: NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero.  NOTE: this vulnerability exists because of a CVE-2015-8138 regression.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00153.html; http://nwtime.org/ntp428p9_release/; http://packetstormsecurity.com/files/140240/FreeBSD-Security-Advisory-FreeBSD-SA-16.39.ntp.html
CVE: CVE-2016-7433
Published: 2017-01-13
Description: NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include the peer dispersion."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-682
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00153.html; http://nwtime.org/ntp428p9_release/; http://rhn.redhat.com/errata/RHSA-2017-0252.html
CVE: CVE-2016-7434
Published: 2017-01-13
Description: The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://nwtime.org/ntp428p9_release/; http://support.ntp.org/bin/view/Main/NtpBug3082; http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
CVE: CVE-2016-8467
Published: 2017-01-13
Description: An elevation of privilege vulnerability in the bootloader could enable a local attacker to execute arbitrary modem commands on the device. This issue is rated as High because it is a local permanent denial of service (device interoperability: completely permanent or requiring re-flashing the entire operating system). Product: Android. Versions: N/A. Android ID: A-30308784.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/95250; https://securityintelligence.com/android-vulnerabilities-attacking-nexus-6-and-6p-custom-boot-modes/; https://source.android.com/security/bulletin/2017-01-01.html
CVE: CVE-2016-8671
Published: 2017-01-13
Description: The pstm_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the secret key via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6887.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/10/15/2; http://www.openwall.com/lists/oss-security/2016/10/15/8; http://www.securityfocus.com/bid/95439
CVE: CVE-2016-8880
Published: 2017-01-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-4516. Reason: This candidate is a duplicate of CVE-2011-4516. Notes: All CVE users should reference CVE-2011-4516 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-8881
Published: 2017-01-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-4517. Reason: This candidate is a duplicate of CVE-2011-4517. Notes: All CVE users should reference CVE-2011-4517 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-8882
Published: 2017-01-13
Description: The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.debian.org/security/2017/dsa-3785; http://www.openwall.com/lists/oss-security/2016/10/17/1; http://www.openwall.com/lists/oss-security/2016/10/23/8
CVE: CVE-2016-8883
Published: 2017-01-13
Description: The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2016/10/17/1; http://www.openwall.com/lists/oss-security/2016/10/23/8; http://www.securityfocus.com/bid/95865
CVE: CVE-2016-9107
Published: 2017-01-13
Description: The OTR plugin for Gajim sends information in cleartext when using XHTML, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/10/30/11; http://www.openwall.com/lists/oss-security/2016/10/30/2; http://www.securityfocus.com/bid/94099
CVE: CVE-2016-9310
Published: 2017-01-13
Description: The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://nwtime.org/ntp428p9_release/; http://rhn.redhat.com/errata/RHSA-2017-0252.html; http://support.ntp.org/bin/view/Main/NtpBug3118
CVE: CVE-2016-9311
Published: 2017-01-13
Description: ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: http://nwtime.org/ntp428p9_release/; http://rhn.redhat.com/errata/RHSA-2017-0252.html; http://support.ntp.org/bin/view/Main/NtpBug3119
CVE: CVE-2016-9312
Published: 2017-01-13
Description: ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large UDP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://nwtime.org/ntp428p9_release/; http://support.ntp.org/bin/view/Main/NtpBug3110; http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
CVE: CVE-2016-9807
Published: 2017-01-13
Description: The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted FLIC file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://rhn.redhat.com/errata/RHSA-2016-2975.html; http://rhn.redhat.com/errata/RHSA-2017-0019.html; http://rhn.redhat.com/errata/RHSA-2017-0020.html
CVE: CVE-2016-9808
Published: 2017-01-13
Description: The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://rhn.redhat.com/errata/RHSA-2016-2975.html; http://rhn.redhat.com/errata/RHSA-2017-0019.html; http://rhn.redhat.com/errata/RHSA-2017-0020.html
CVE: CVE-2016-9809
Published: 2017-01-13
Description: Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://rhn.redhat.com/errata/RHSA-2017-0018.html; http://rhn.redhat.com/errata/RHSA-2017-0021.html; http://www.debian.org/security/2017/dsa-3818
CVE: CVE-2016-9810
Published: 2017-01-13
Description: The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/12/01/2; http://www.openwall.com/lists/oss-security/2016/12/05/8; http://www.securityfocus.com/bid/95163
CVE: CVE-2016-9811
Published: 2017-01-13
Description: The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3819; http://www.openwall.com/lists/oss-security/2016/12/01/2; http://www.openwall.com/lists/oss-security/2016/12/05/8
CVE: CVE-2016-9812
Published: 2017-01-13
Description: The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://rhn.redhat.com/errata/RHSA-2017-0021.html; http://www.debian.org/security/2017/dsa-3818; http://www.openwall.com/lists/oss-security/2016/12/01/2
CVE: CVE-2016-9813
Published: 2017-01-13
Description: The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://rhn.redhat.com/errata/RHSA-2017-0021.html; http://www.debian.org/security/2017/dsa-3818; http://www.openwall.com/lists/oss-security/2016/12/01/2
CVE: CVE-2017-0398
Published: 2017-01-13
Description: An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android IDs: A-32438594, A-32635664.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95226; https://source.android.com/security/bulletin/2017-01-01.html; http://www.securityfocus.com/bid/95226
CVE: CVE-2010-5327
Published: 2017-01-13
Description: Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://dev.liferay.com/web/community-security-team/known-vulnerabilities; https://dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapUm8Xc/content/lps-64547-remote-code-execution-and-privilege-escalation-in-templates; https://github.com/liferay/liferay-portal/commit/90c4e85a8f8135f069f3f05e4d54a77704769f91