deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-1523
Published: 2021-08-25
Description: A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, remote attacker to cause a queue wedge on a leaf switch, which could result in critical control plane traffic to the device being dropped. This could result in one or more leaf switches being removed from the fabric. This vulnerability is due to mishandling of ingress TCP traffic to a specific port. An attacker could exploit this vulnerability by sending a stream of TCP packets to a specific port on a Switched Virtual Interface (SVI) configured on the device. A successful exploit could allow the attacker to cause a specific packet queue to queue network buffers but never process them, leading to an eventual queue wedge. This could cause control plane traffic to be dropped, resulting in a denial of service (DoS) condition where the leaf switches are unavailable. Note: This vulnerability requires a manual intervention to power-cycle the device to recover.
CVSS Score: 8.6 (HIGH)
CWE: CWE-772, CWE-772
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9kaci-queue-wedge-cLDDEfKF; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9kaci-queue-wedge-cLDDEfKF
CVE: CVE-2021-21778
Published: 2021-08-25
Description: A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NET 2.2.0. A specially crafted network request can lead to loss of communications. An attacker can send an unauthenticated message to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1236; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1236
CVE: CVE-2021-21834
Published: 2021-08-25
Description: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when decoding the atom for the “co64” FOURCC can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21835
Published: 2021-08-25
Description: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when decoding the atom associated with the “csgp” FOURCC can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21836
Published: 2021-08-25
Description: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input using the “ctts” FOURCC code can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21840
Published: 2021-08-25
Description: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input used to process an atom using the “saio” FOURCC code cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21841
Published: 2021-08-25
Description: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when reading an atom using the 'sbgp' FOURCC code can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21842
Published: 2021-08-25
Description: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow when processing an atom using the 'ssix' FOURCC code, due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21848
Published: 2021-08-25
Description: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The library will actually reuse the parser for atoms with the “stsz” FOURCC code when parsing atoms that use the “stz2” FOURCC code and can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21849
Published: 2021-08-25
Description: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow when the library encounters an atom using the “tfra” FOURCC code due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21850
Published: 2021-08-25
Description: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow when the library encounters an atom using the “trun” FOURCC code due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297; https://www.debian.org/security/2021/dsa-4966; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
CVE: CVE-2021-21869
Published: 2021-08-25
Description: An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download=; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1306; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16805&token=ee583c498941d9fda86490bca98ff21928eec08a&download=
CVE: CVE-2021-22236
Published: 2021-08-25
Description: Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22236.json; https://gitlab.com/gitlab-org/gitlab/-/issues/334925; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22236.json
CVE: CVE-2021-22237
Published: 2021-08-25
Description: Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-384
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22237.json; https://gitlab.com/gitlab-org/gitlab/-/issues/297516; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22237.json
CVE: CVE-2021-22242
Published: 2021-08-25
Description: Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22242.json; https://gitlab.com/gitlab-org/gitlab/-/issues/332528; https://hackerone.com/reports/1212822
CVE: CVE-2021-22243
Published: 2021-08-25
Description: Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22243.json; https://gitlab.com/gitlab-org/gitlab/-/issues/325934; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22243.json
CVE: CVE-2021-22244
Published: 2021-08-25
Description: Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data
CVSS Score: 3.1 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22244.json; https://gitlab.com/gitlab-org/gitlab/-/issues/299039; https://hackerone.com/reports/1047140
CVE: CVE-2021-22245
Published: 2021-08-25
Description: Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22245.json; https://gitlab.com/gitlab-org/gitlab/-/issues/255612; https://hackerone.com/reports/987689
CVE: CVE-2021-22247
Published: 2021-08-25
Description: Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22247.json; https://gitlab.com/gitlab-org/gitlab/-/issues/299333; https://hackerone.com/reports/1074326
CVE: CVE-2021-22250
Published: 2021-08-25
Description: Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administrators created for their account
CVSS Score: 5.4 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22250.json; https://gitlab.com/gitlab-org/gitlab/-/issues/332410; https://hackerone.com/reports/1205916
CVE: CVE-2021-22256
Published: 2021-08-25
Description: Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22256.json; https://gitlab.com/gitlab-org/gitlab/-/issues/326948; https://hackerone.com/reports/1117768
CVE: CVE-2021-31989
Published: 2021-08-25
Description: A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump from the built-in Windows Task Manager application. The memory dump may potentially contain credentials of connected Axis devices.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-316, CWE-312
References: https://www.axis.com/files/tech_notes/CVE-2021-31989.pdf; https://www.axis.com/files/tech_notes/CVE-2021-31989.pdf
CVE: CVE-2021-32975
Published: 2021-08-25
Description: Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-224-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-224-02
CVE: CVE-2021-32995
Published: 2021-08-25
Description: Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-224-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-224-02
CVE: CVE-2021-33015
Published: 2021-08-25
Description: Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write via an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-224-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-224-02
CVE: CVE-2021-39159
Published: 2021-08-25
Description: BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment, with the potential to escalate to the host depending on the underlying kubernetes configuration. Users are advised to update to version 0.2.0-n653. If users are unable to update they may disable the git repo provider by specifying the `BinderHub.repo_providers` as a workaround.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-94, CWE-78
References: https://github.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182.patch; https://github.com/jupyterhub/binderhub/security/advisories/GHSA-9jjr-qqfp-ppwx; https://github.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182.patch
CVE: CVE-2021-3605
Published: 2021-08-25
Description: There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The greatest risk from this flaw is to application availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1970991; https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html; https://security.gentoo.org/glsa/202210-31
CVE: CVE-2021-3713
Published: 2021-08-25
Description: An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
CVSS Score: 7.4 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1994640; https://lists.debian.org/debian-lts-announce/2021/09/msg00000.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2020-18065
Published: 2021-08-25
Description: Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/PopojiCMS/PopojiCMS/issues/16; https://github.com/PopojiCMS/PopojiCMS/issues/16
CVE: CVE-2020-19547
Published: 2021-08-25
Description: Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/PopojiCMS/PopojiCMS/issues/19; https://github.com/PopojiCMS/PopojiCMS/issues/19
CVE: CVE-2021-1577
Published: 2021-08-25
Description: A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-frw-Nt3RYxR2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-frw-Nt3RYxR2
CVE: CVE-2021-1578
Published: 2021-08-25
Description: A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker to elevate privileges to Administrator on an affected device. This vulnerability is due to an improper policy default setting. An attacker could exploit this vulnerability by using a non-privileged credential for Cisco ACI Multi-Site Orchestrator (MSO) to send a specific API request to a managed Cisco APIC or Cloud APIC device. A successful exploit could allow the attacker to obtain Administrator credentials on the affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-636, CWE-755
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-pesc-pkmGK4J; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-pesc-pkmGK4J
CVE: CVE-2021-1579
Published: 2021-08-25
Description: A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read-only credentials to elevate privileges on an affected system. This vulnerability is due to an insufficient role-based access control (RBAC). An attacker with Administrator read-only credentials could exploit this vulnerability by sending a specific API request using an app with admin write credentials. A successful exploit could allow the attacker to elevate privileges to Administrator with write privileges on the affected device.
CVSS Score: 8.1 (HIGH)
CWE: CWE-250, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-chvul-CKfGYBh8; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-chvul-CKfGYBh8
CVE: CVE-2021-1580
Published: 2021-08-25
Description: Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-77
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-mdvul-HBsJBuvW; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-mdvul-HBsJBuvW
CVE: CVE-2021-1581
Published: 2021-08-25
Description: Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-mdvul-HBsJBuvW; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-mdvul-HBsJBuvW
CVE: CVE-2021-1582
Published: 2021-08-25
Description: A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to improper input validation in the web UI. An authenticated attacker could exploit this vulnerability by sending malicious input to the web UI. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-scss-bFT75YrM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-scss-bFT75YrM
CVE: CVE-2021-1583
Published: 2021-08-25
Description: A vulnerability in the fabric infrastructure file system access control of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to read arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker with Administrator privileges could exploit this vulnerability by executing a specific vulnerable command on an affected device. A successful exploit could allow the attacker to read arbitrary files on the file system of the affected device.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-naci-afr-UtjfO2D7; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-naci-afr-UtjfO2D7