deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-48304
Published: 2023-11-21
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, an attacker could enable and disable the birthday calendar for any user on the same server. Nextcloud Server 25.0.11, 26.0.6, and 27.1.0 and Nextcloud Enterprise Server 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 contain patches for this issue. No known workarounds are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8jwv-c8c8-9fr3; https://github.com/nextcloud/server/pull/40292; https://hackerone.com/reports/2112973
CVE: CVE-2023-49103
Published: 2023-11-21
Description: An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-200
References: https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/; https://owncloud.org/security; https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
CVE: CVE-2023-49104
Published: 2023-11-21
Description: An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker.
CVSS Score: 8.7 (HIGH)
CWE: CWE-601
References: https://owncloud.com/security-advisories/subdomain-validation-bypass/; https://owncloud.org/security; https://owncloud.com/security-advisories/subdomain-validation-bypass/
CVE: CVE-2023-49105
Published: 2023-11-21
Description: An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/; https://owncloud.org/security; https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/
CVE: CVE-2023-6248
Published: 2023-11-21
Description: The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video and diagnostic data from each connected device. An attacker who knows the IP address of the server is able to connect and perform the following operations:

  *  Get location data of the vehicle the device is connected to
  *  Send CAN bus messages via the ECU module ( https://syrus.digitalcomtech.com/docs/ecu-1 https://syrus.digitalcomtech.com/docs/ecu-1 )

  *  Immobilize the vehicle via the safe-immobilizer module ( https://syrus.digitalcomtech.com/docs/system-tools#safe-immobilization https://syrus.digitalcomtech.com/docs/system-tools#safe-immobilization )

  *  Get live video through the connected video camera

  *  Send audio messages to the driver ( https://syrus.digitalcomtech.com/docs/system-tools#apx-tts https://syrus.digitalcomtech.com/docs/system-tools#apx-tts )






CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94, CWE-200, CWE-287, CWE-319
References: https://www.digitalcomtech.com/product/syrus-4g-iot-telematics-gateway/; https://www.digitalcomtech.com/product/syrus-4g-iot-telematics-gateway/
CVE: CVE-2023-48305
Published: 2023-11-21
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the user_ldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords would be leaked. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. As a workaround, change config setting `loglevel` to `1` or higher (should always be higher than 1 in production environments).
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-312
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-35p6-4992-w5fr; https://github.com/nextcloud/server/issues/38461; https://github.com/nextcloud/server/pull/40013
CVE: CVE-2023-48306
Published: 2023-11-21
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, the DNS pin middleware was vulnerable to DNS rebinding allowing an attacker to perform SSRF as a final result. Nextcloud Server 25.0.11, 26.0.6, and 27.1.0 and Nextcloud Enterprise Server 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 contain patches for this issue. No known workarounds are available.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8f69-f9jg-4x3v; https://github.com/nextcloud/server/pull/40234; https://hackerone.com/reports/2115212
CVE: CVE-2023-48307
Published: 2023-11-21
Description: Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for this issue. As a workaround, disable the mail app.
CVSS Score: 3.5 (LOW)
CWE: CWE-918
References: https://github.com/nextcloud/mail/pull/8709; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4pp4-m8ph-2999; https://hackerone.com/reports/1869714
CVE: CVE-2023-48699
Published: 2023-11-21
Description: fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function `def __locator__(self, locator_name: str)` in `page.py`. In order to mitigate this issue, upgrade to fastbots version 0.1.5 or above.
CVSS Score: 8.4 (HIGH)
CWE: CWE-95, CWE-94
References: https://github.com/ubertidavide/fastbots/commit/73eb03bd75365e112b39877e26ef52853f5e9f57; https://github.com/ubertidavide/fastbots/pull/3#issue[PII_REDACTED]; https://github.com/ubertidavide/fastbots/security/advisories/GHSA-vccg-f4gp-45x9
CVE: CVE-2023-48700
Published: 2023-11-21
Description: The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many cases, an IP Address and a Location. Starting in version 2.0.0 and prior to version 3.0.0, credentials provided to onboarding task are visible via Job Results from an execution of an Onboarding Task. Version 3.0.0 fixes this issue; no known workarounds are available. Mitigation recommendations include deleting all Job Results for any onboarding task to remove clear text credentials from database entries that were run while on v2.0.X, upgrading to v3.0.0, and rotating any exposed credentials.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-256, CWE-312
References: https://github.com/nautobot/nautobot-plugin-device-onboarding/security/advisories/GHSA-qf3c-rw9f-jh7v; https://github.com/nautobot/nautobot-plugin-device-onboarding/security/advisories/GHSA-qf3c-rw9f-jh7v
CVE: CVE-2023-48701
Published: 2023-11-21
Description: Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be uploaded regardless of mime validation. This is only applicable on front-end forms using the "Forms" feature containing an assets field, or within the control panel which requires authentication. This issue has been patched on 3.4.15 and 4.36.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/statamic/cms/releases/tag/v3.4.15; https://github.com/statamic/cms/releases/tag/v4.36.0; https://github.com/statamic/cms/security/advisories/GHSA-8jjh-j3c2-cjcv
CVE: CVE-2021-22142
Published: 2023-11-22
Description: Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protections to prevent this browser from rendering arbitrary content.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-1104
References: https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964/1; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-7-13-0-and-6-8-16-security-update/273964/1
CVE: CVE-2021-22150
Published: 2023-11-22
Description: It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077
CVE: CVE-2021-22151
Published: 2023-11-22
Description: It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.
CVSS Score: 3.1 (LOW)
CWE: CWE-22, CWE-22
References: https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077
CVE: CVE-2023-35127
Published: 2023-11-22
Description: Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a; https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02; https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a
CVE: CVE-2023-40152
Published: 2023-11-22
Description: When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file an out of bounds write may occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a; https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02; https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a
CVE: CVE-2023-5299
Published: 2023-11-22
Description: A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-284
References: https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a; https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02; https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a
CVE: CVE-2021-22143
Published: 2023-11-22
Description: The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers will not be sanitized before being sent.
CVSS Score: 2.1 (LOW)
CWE: CWE-200, CWE-532
References: https://discuss.elastic.co/t/elastic-apm-net-agent-1-10-0-security-update/274668; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-apm-net-agent-1-10-0-security-update/274668
CVE: CVE-2021-37937
Published: 2023-11-22
Description: An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-269
References: https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077
CVE: CVE-2021-37942
Published: 2023-11-22
Description: A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://discuss.elastic.co/t/apm-java-agent-security-update/291355; https://www.elastic.co/community/security; https://discuss.elastic.co/t/apm-java-agent-security-update/291355
CVE: CVE-2022-35638
Published: 2023-11-22
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  230824.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230824; https://www.ibm.com/support/pages/node/7080104; https://exchange.xforce.ibmcloud.com/vulnerabilities/230824
CVE: CVE-2023-46814
Published: 2023-11-22
Description: A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute code with elevated privileges out of a standard user writable location. Standard users may use this to gain arbitrary code execution as SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.videolan.org/security/sb-vlc3019.html; https://www.videolan.org/security/sb-vlc3019.html
CVE: CVE-2023-48161
Published: 2023-11-22
Description: Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://github.com/tacetool/TACE#cve-2023-48161; https://sourceforge.net/p/giflib/bugs/167/; https://github.com/tacetool/TACE#cve-2023-48161
CVE: CVE-2023-29069
Published: 2023-11-22
Description: A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with malicious DLLs. These files may then have elevated privileges leading to a Privilege Escalation vulnerability.

CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0013; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0013
CVE: CVE-2023-41145
Published: 2023-11-22
Description: Autodesk users who no longer have an active license for an account can still access cases for that account.

CVSS Score: 5.3 (MEDIUM)
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0020; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0020
CVE: CVE-2023-41146
Published: 2023-11-22
Description: Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.

CVSS Score: 4.3 (MEDIUM)
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0020; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0020
CVE: CVE-2023-47016
Published: 2023-11-22
Description: radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://gist.github.com/gandalf4a/65705be4f84269cb7cd725a1d4ab2ffa; https://github.com/radareorg/radare2/commit/40c9f50e127be80b9d816bce2ab2ee790831aefd; https://github.com/radareorg/radare2/issues/22349
CVE: CVE-2023-47392
Published: 2023-11-22
Description: An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gist.github.com/wwwziziyu/d0ae135b8075f6db735d75135254e7a1; https://gist.github.com/wwwziziyu/d0ae135b8075f6db735d75135254e7a1
CVE: CVE-2023-47393
Published: 2023-11-22
Description: An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access sensitive user information via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gist.github.com/wwwziziyu/7dbf7fd43f9e304ce0819f8a9784d2c6; https://gist.github.com/wwwziziyu/7dbf7fd43f9e304ce0819f8a9784d2c6
CVE: CVE-2023-2446
Published: 2023-11-22
Description: The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681; https://www.wordfence.com/threat-intel/vulnerabilities/id/4072ba5f-6385-4fa3-85b6-89dac7b60a92?source=cve; http://packetstormsecurity.com/files/175871/WordPress-UserPro-5.1.x-Password-Reset-Authentication-Bypass-Escalation.html
CVE: CVE-2023-2447
Published: 2023-11-22
Description: The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the 'export_users' function. This makes it possible for unauthenticated attackers to export the users to a csv file, granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681; https://www.wordfence.com/threat-intel/vulnerabilities/id/0372efe4-b5be-4601-be43-5c12332ea1a5?source=cve; https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
CVE: CVE-2023-5921
Published: 2023-11-22
Description: Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass.This issue affects Geodi: before 8.0.0.27396.


CVSS Score: 7.1 (HIGH)
CWE: CWE-841
References: https://www.usom.gov.tr/bildirim/tr-23-0650; https://www.usom.gov.tr/bildirim/tr-23-0650
CVE: CVE-2023-6011
Published: 2023-11-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geodi allows Stored XSS.This issue affects Geodi: before 8.0.0.27396.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.usom.gov.tr/bildirim/tr-23-0650; https://www.usom.gov.tr/bildirim/tr-23-0650
CVE: CVE-2023-37924
Published: 2023-11-22
Description: Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login.
Now we have fixed this issue and now user must have the correct login to access workbench.
This issue affects Apache Submarine: from 0.7.0 before 0.8.0. We recommend that all submarine users with 0.7.0 upgrade to 0.8.0, which not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins.
If using the version lower than 0.8.0 and not want to upgrade, you can try cherry-pick PR  https://github.com/apache/submarine/pull/1037 https://github.com/apache/submarine/pull/1054  and rebuild the submarine-server image to fix this.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/apache/submarine/pull/1037; https://issues.apache.org/jira/browse/SUBMARINE-1361; https://lists.apache.org/thread/g99h773vd49n1wyghdq1llv2f83w1b3r
CVE: CVE-2023-46673
Published: 2023-11-22
Description: It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708
CVE: CVE-2023-6117
Published: 2023-11-22
Description: A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server

 before 23.11.13156.0 which allows attackers to execute DoS attacks.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-770
References: https://empower.m-files.com/security-advisories/CVE-2023-6117; https://product.m-files.com/security-advisories/cve-2023-6117/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6117/
CVE: CVE-2023-6189
Published: 2023-11-22
Description: Missing access permissions checks

 in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export

jobs using the M-Files API methods.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-280
References: https://empower.m-files.com/security-advisories/CVE-2023-6189; https://product.m-files.com/security-advisories/cve-2023-6189/; https://https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6189/