deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-48408
Published: 2023-12-08
Description: In ProtocolNetSimFileInfoAdapter() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48409
Published: 2023-12-08
Description: In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48410
Published: 2023-12-08
Description: In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48411
Published: 2023-12-08
Description: In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48412
Published: 2023-12-08
Description: In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak  due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48413
Published: 2023-12-08
Description: In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48414
Published: 2023-12-08
Description: In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48415
Published: 2023-12-08
Description: In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48416
Published: 2023-12-08
Description: In multiple locations, there is a possible null dereference due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48420
Published: 2023-12-08
Description: there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48421
Published: 2023-12-08
Description: In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/platform/pixel/pixel_gpu_slc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48422
Published: 2023-12-08
Description: In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-48423
Published: 2023-12-08
Description: In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-12-01; https://source.android.com/security/bulletin/pixel/2023-12-01
CVE: CVE-2023-6612
Published: 2023-12-08
Description: A vulnerability was found in Totolink X5000R 9.1.0cu.2300_B20230112. It has been rated as critical. This issue affects the function setDdnsCfg/setDynamicRoute/setFirewallType/setIPSecCfg/setIpPortFilterRules/setLancfg/setLoginPasswordCfg/setMacFilterRules/setMtknatCfg/setNetworkConfig/setPortForwardRules/setRemoteCfg/setSSServer/setScheduleCfg/setSmartQosCfg/setStaticDhcpRules/setStaticRoute/setVpnAccountCfg/setVpnPassCfg/setVpnUser/setWiFiAclAddConfig/setWiFiEasyGuestCfg/setWiFiGuestCfg/setWiFiRepeaterConfig/setWiFiScheduleCfg/setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247247. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-78
References: https://github.com/OraclePi/repo/tree/main/totolink%20X5000R; https://vuldb.com/?ctiid.247247; https://vuldb.com/?id.247247
CVE: CVE-2023-6613
Published: 2023-12-08
Description: A vulnerability classified as problematic has been found in Typecho 1.2.1. Affected is an unknown function of the file /admin/options-theme.php of the component Logo Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247248. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/JTZ-a/SRC/blob/master/Typecho/Typecho-Stored%20XSS/en-us.md; https://vuldb.com/?ctiid.247248; https://vuldb.com/?id.247248
CVE: CVE-2023-6614
Published: 2023-12-08
Description: A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-pages.php of the component Page Handler. The manipulation leads to backdoor. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247249 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.7 (LOW)
CWE: CWE-912
References: https://github.com/JTZ-a/SRC/blob/master/Typecho/Typecho-IDOR/en-us.md; https://vuldb.com/?ctiid.247249; https://vuldb.com/?id.247249
CVE: CVE-2023-6606
Published: 2023-12-08
Description: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:0723; https://access.redhat.com/errata/RHSA-2024:0725; https://access.redhat.com/errata/RHSA-2024:0881
CVE: CVE-2023-6610
Published: 2023-12-08
Description: An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:0723; https://access.redhat.com/errata/RHSA-2024:0724; https://access.redhat.com/errata/RHSA-2024:0725
CVE: CVE-2023-6615
Published: 2023-12-08
Description: A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. Affected by this issue is some unknown functionality of the file /admin/manage-users.php. The manipulation of the argument page leads to information disclosure. The exploit has been disclosed to the public and may be used. VDB-247250 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://github.com/JTZ-a/SRC/blob/master/Typecho/Typecho-Information%20leakage/en-us.md; https://vuldb.com/?ctiid.247250; https://vuldb.com/?id.247250
CVE: CVE-2023-6616
Published: 2023-12-08
Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as problematic. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247253 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.247253; https://vuldb.com/?id.247253; https://www.yuque.com/u39339523/el4dxs/sxa6f9gywg6vfbur
CVE: CVE-2023-6617
Published: 2023-12-08
Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as critical. Affected is an unknown function of the file attendance.php. The manipulation of the argument class_id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-247254 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.247254; https://vuldb.com/?id.247254; https://www.yuque.com/u39339523/el4dxs/gcsvdc5oohx6v38c
CVE: CVE-2023-6618
Published: 2023-12-08
Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247255.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://vuldb.com/?ctiid.247255; https://vuldb.com/?id.247255; https://www.yuque.com/u39339523/el4dxs/krpez3nzv1144cuc
CVE: CVE-2023-6619
Published: 2023-12-08
Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /modals/class_form.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247256.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/daydust/vuln/blob/main/Simple_Student_Attendance_System/class_form.php_SQL-injection.md; https://vuldb.com/?ctiid.247256; https://vuldb.com/?id.247256
CVE: CVE-2023-6622
Published: 2023-12-08
Description: A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/errata/RHSA-2024:2394; https://access.redhat.com/errata/RHSA-2024:2950; https://access.redhat.com/errata/RHSA-2024:3138
CVE: CVE-2023-6507
Published: 2023-12-08
Description: An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases.

When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list.

This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-269
References: https://github.com/python/cpython/commit/10e9bb13b8dcaa414645b9bd10718d8f7179e82b; https://github.com/python/cpython/commit/85bbfa8a4bbdbb61a3a84fbd7cb29a4096ab8a06; https://github.com/python/cpython/commit/9fe7655c6ce0b8e9adc229daf681b6d30e6b1610
CVE: CVE-2023-46493
Published: 2023-12-08
Description: Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function in fileBrowser/browser.js.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://devhub.checkmarx.com/cve-details/CVE-2023-46493/; https://devhub.checkmarx.com/cve-details/Cxa4d94170-be41/; https://devhub.checkmarx.com/cve-details/CVE-2023-46493/
CVE: CVE-2023-46494
Published: 2023-12-08
Description: Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid function in admin/productGrid/Grid.jsx.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://devhub.checkmarx.com/cve-details/CVE-2023-46494/; https://devhub.checkmarx.com/cve-details/Cx8ecec391-2014/; https://devhub.checkmarx.com/cve-details/CVE-2023-46494/
CVE: CVE-2023-46495
Published: 2023-12-08
Description: Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://devhub.checkmarx.com/cve-details/CVE-2023-46495/; https://devhub.checkmarx.com/cve-details/Cxbc6d4599-c1bd/; https://devhub.checkmarx.com/cve-details/CVE-2023-46495/
CVE: CVE-2023-46496
Published: 2023-12-08
Description: Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint.
CVSS Score: 8.3 (HIGH)
CWE: CWE-22
References: https://devhub.checkmarx.com/cve-details/CVE-2023-46496/; https://devhub.checkmarx.com/cve-details/Cx943be66a-54cc/; https://devhub.checkmarx.com/cve-details/CVE-2023-46496/
CVE: CVE-2023-46497
Published: 2023-12-08
Description: Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js endpoint.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://devhub.checkmarx.com/cve-details/CVE-2023-46497/; https://devhub.checkmarx.com/cve-details/Cx16846793-56b6/; https://devhub.checkmarx.com/cve-details/CVE-2023-46497/
CVE: CVE-2023-46498
Published: 2023-12-08
Description: An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.
CVSS Score: 9.8 (CRITICAL)
References: https://devhub.checkmarx.com/cve-details/Cx8b24ace3-0c9a/; https://devhub.checkmarx.com/cve-details/cve-2023-46498/; https://devhub.checkmarx.com/cve-details/Cx8b24ace3-0c9a/
CVE: CVE-2023-46499
Published: 2023-12-08
Description: Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://devhub.checkmarx.com/cve-details/Cx0f8b38be-d5de/; https://devhub.checkmarx.com/cve-details/cve-2023-46499/; https://devhub.checkmarx.com/cve-details/Cx0f8b38be-d5de/
CVE: CVE-2023-48311
Published: 2023-12-08
Description: dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20
References: https://github.com/jupyterhub/dockerspawner/commit/3ba4b665b6ca6027ea7a032d7ca3eab977574626; https://github.com/jupyterhub/dockerspawner/security/advisories/GHSA-hfgr-h3vc-p6c2; https://github.com/jupyterhub/dockerspawner/commit/3ba4b665b6ca6027ea7a032d7ca3eab977574626
CVE: CVE-2023-49782
Published: 2023-12-08
Description: Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with `Collabora Online - Built-in CODE Server` app can be vulnerable to attack via proxy.php. The bug was fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.601. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://apps.nextcloud.com/apps/richdocumentscode; https://github.com/CollaboraOnline/online/security/advisories/GHSA-8xm5-pgfr-8mjr; https://apps.nextcloud.com/apps/richdocumentscode
CVE: CVE-2023-49788
Published: 2023-12-08
Description: Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server (richdocumentscode) is run without chroot sandboxing. Vulnerable versions of the richdocumentscode app can be susceptible to attack via modified client->server commands to overwrite files outside the sub directory the server has provided for the transient session. Files which can be accessed are limited to those that the server process has access to. The bug was fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.602. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-501
References: https://github.com/CollaboraOnline/online/security/advisories/GHSA-3r69-xvf7-v94j; https://github.com/CollaboraOnline/online/security/advisories/GHSA-3r69-xvf7-v94j
CVE: CVE-2023-34320
Published: 2023-12-08
Description: Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412
where software, under certain circumstances, could deadlock a core
due to the execution of either a load to device or non-cacheable memory,
and either a store exclusive or register read of the Physical
Address Register (PAR_EL1) in close proximity.

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://xenbits.xenproject.org/xsa/advisory-436.html; http://xenbits.xen.org/xsa/advisory-436.html; https://xenbits.xenproject.org/xsa/advisory-436.html
CVE: CVE-2023-6337
Published: 2023-12-08
Description: HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.

Fixed in Vault 1.15.4, 1.14.8, 1.13.12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741
CVE: CVE-2023-49798
Published: 2023-12-09
Description: OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/contracts@4.9.4` and `@openzeppelin/contracts-upgradeable@4.9.4`, all subcalls are executed twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. The duplicated delegatecall was removed in version 4.9.5. The 4.9.4 version is marked as deprecated. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-670
References: https://github.com/OpenZeppelin/openzeppelin-contracts/commit/88ac712e06832bce73b41e8166cded2729e25205; https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-699g-q6qh-q4v8; https://github.com/OpenZeppelin/openzeppelin-contracts/commit/88ac712e06832bce73b41e8166cded2729e25205
CVE: CVE-2023-49799
Published: 2023-12-09
Description: `nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression `^https?://`, however this regular expression can be bypassed by an absolute URL with leading whitespace. For example `\nhttps://whatever.com` which has a leading newline. According to the fetch specification, before a fetch is made the URL is normalized. "To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from potentialValue.". This means the final request will be normalized to `https://whatever.com` bypassing the check and nuxt-api-party will send a request outside of the whitelist. This could allow us to leak credentials or perform Server-Side Request Forgery (SSRF). This vulnerability has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should revert to the previous method of detecting absolute URLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://fetch.spec.whatwg.org/; https://fetch.spec.whatwg.org/#http-whitespace-byte; https://github.com/johannschopplich/nuxt-api-party/blob/777462e1e3af1d9f8938aa33f230cd8cb6e0cc9a/src/runtime/server/handler.ts#L31