deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-32962
Published: 2024-05-02
Description: xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional validation steps, the default configuration allows a malicious actor to re-sign an XML document, place the certificate in a `<KeyInfo />` element, and pass `xml-crypto` default validation checks. As a result `xml-crypto` trusts by default any certificate provided via digitally signed XML document's `<KeyInfo />`. `xml-crypto` prefers to use any certificate provided via digitally signed XML document's `<KeyInfo />` even if library was configured to use specific certificate (`publicCert`) for signature verification purposes.  An attacker can spoof signature verification by modifying XML document and replacing existing signature with signature generated with malicious private key (created by attacker) and by attaching that private key's certificate to `<KeyInfo />` element. This vulnerability is combination of changes introduced to `4.0.0` on pull request 301 / commit `c2b83f98` and has been addressed in version 6.0.0 with pull request 445 / commit `21201723d`. Users are advised to upgrade. Users unable to upgrade may either check the certificate extracted via `getCertFromKeyInfo` against trusted certificates before accepting the results of the validation or set `xml-crypto's getCertFromKeyInfo` to `() => undefined` forcing `xml-crypto` to use an explicitly configured `publicCert` or `privateKey` for signature verification.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-347
References: https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000; https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca; https://github.com/node-saml/xml-crypto/pull/301
CVE: CVE-2024-32971
Published: 2024-05-02
Description: Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operations being executed which can result in unintended data or effects. This only affects Router instances configured to use distributed query plan caching. The root cause of this defect is a bug in Apollo Router’s cache retrieval logic: When this defect is present and distributed query planning caching is enabled, asking the Router to execute an operation (whether it is a query, a mutation, or a subscription) may result in an unexpected variation of that operation being executed or the generation of unexpected errors. The issue stems from inadvertently executing a modified version of a previously executed operation, whose query plan is stored in the underlying cache (specifically, Redis). Depending on the type of the operation, the result may vary. For a query, results may be fetched that don’t match what was requested (e.g., rather than running `fetchUsers(type: ENTERPRISE)` the Router may run `fetchUsers(type: TRIAL)`. For a mutation, this may result in incorrect mutations being sent to underlying subgraph servers (e.g., rather than sending `deleteUser(id: 10)` to a subgraph, the Router may run `deleteUser(id: 12)`. Users who are using distributed query plan caching, are advised to either upgrade to version 1.45.1 or above or downgrade to version 1.43.2 of the Apollo Router. Apollo Router versions 1.44.0 or 1.45.0 are not recommended for use and have been withdrawn. Users unable to upgrade can disable distributed query plan caching to mitigate this issue.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-440, CWE-670
References: https://github.com/apollographql/router/commit/ff9f666598cd17661880fe7fc6e9c9611316e529; https://github.com/apollographql/router/releases/tag/v1.45.1; https://github.com/apollographql/router/security/advisories/GHSA-q9p4-hw9m-fj2v
CVE: CVE-2024-3490
Published: 2024-05-02
Description: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in all versions up to, and including, 9.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3078644/wp-recipe-maker; https://www.wordfence.com/threat-intel/vulnerabilities/id/69cc7b6c-b6c2-4bba-afb4-86ba1b36b295?source=cve; https://plugins.trac.wordpress.org/changeset/3078644/wp-recipe-maker
CVE: CVE-2024-3280
Published: 2024-05-02
Description: The Follow Us Badges plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsite_follow_us_badges shortcode in all versions up to, and including, 3.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3078718/wpsite-follow-us-badges; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef1ccef8-9066-4f5c-b5c5-9fa6e54f0e87?source=cve; https://plugins.trac.wordpress.org/changeset/3078718/wpsite-follow-us-badges
CVE: CVE-2024-32114
Published: 2024-05-02
Description: In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).
It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).

To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
<bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
  <property name="constraint" ref="securityConstraint" />
  <property name="pathSpec" value="/" />
</bean>

Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.

CVSS Score: 8.5 (HIGH)
CWE: CWE-1188
References: https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt; https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt
CVE: CVE-2024-3883
Published: 2024-05-02
Description: The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and including, 1.15.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3079536/interactive-3d-flipbook-powered-physics-engine; https://www.wordfence.com/threat-intel/vulnerabilities/id/016462cf-abe9-4c90-abd2-b5bb69348d7e?source=cve; https://plugins.trac.wordpress.org/changeset/3079536/interactive-3d-flipbook-powered-physics-engine
CVE: CVE-2024-32638
Published: 2024-05-02
Description: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0.

Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-444, CWE-444
References: http://www.openwall.com/lists/oss-security/2024/05/02/2; https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov; http://www.openwall.com/lists/oss-security/2024/05/02/2
CVE: CVE-2024-3955
Published: 2024-05-02
Description: URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing to execute arbitrary code.This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cert.pl/en/posts/2024/05/CVE-2024-3955/; https://cert.pl/posts/2024/05/CVE-2024-3955/; https://github.com/PiBrewing/craftbeerpi4/issues/132
CVE: CVE-2024-33911
Published: 2024-05-02
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar School Management Pro.This issue affects School Management Pro: from n/a through 10.3.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/school-management-pro/wordpress-the-school-management-pro-plugin-10-3-4-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/school-management-pro/wordpress-the-school-management-pro-plugin-10-3-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-33913
Published: 2024-05-02
Description: Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/xserver-migrator/wordpress-xserver-migrator-plugin-1-6-1-csrf-to-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/xserver-migrator/wordpress-xserver-migrator-plugin-1-6-1-csrf-to-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-33922
Published: 2024-05-02
Description: Insertion of Sensitive Information into Log File vulnerability in Jordy Meow WP Media Cleaner.This issue affects WP Media Cleaner: from n/a through 6.7.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/media-cleaner/wordpress-wp-media-cleaner-plugin-6-7-2-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/media-cleaner/wordpress-wp-media-cleaner-plugin-6-7-2-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-33930
Published: 2024-05-02
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ILLID Share This Image.This issue affects Share This Image: from n/a through 1.97.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/vulnerability/share-this-image/wordpress-share-this-image-plugin-1-97-open-redirection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/share-this-image/wordpress-share-this-image-plugin-1-97-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-3005
Published: 2024-05-02
Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's LaStudioKit Post Author widget in all versions up to, and including, 1.3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3079793/lastudio-element-kit; https://www.wordfence.com/threat-intel/vulnerabilities/id/544db0d5-1760-4229-8429-d2391e328304?source=cve; https://plugins.trac.wordpress.org/changeset/3079793/lastudio-element-kit
CVE: CVE-2024-33944
Published: 2024-05-02
Description: Missing Authorization vulnerability in Kestrel WooCommerce AWeber Newsletter Subscription.This issue affects WooCommerce AWeber Newsletter Subscription: from n/a through 4.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-aweber-newsletter-subscription/wordpress-woocommerce-aweber-newsletter-subscription-plugin-4-0-1-unauthenticated-access-token-change-reset-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-aweber-newsletter-subscription/wordpress-woocommerce-aweber-newsletter-subscription-plugin-4-0-1-unauthenticated-access-token-change-reset-vulnerability?_s_id=cve
CVE: CVE-2023-28798
Published: 2024-05-02
Description: An out-of-bounds write to heap in the pacparser library on Zscaler Client Connector on Mac may lead to arbitrary code execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.7&deployment_date=2022-08-19&id=1414851; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.7&deployment_date=2022-08-19&id=1414851
CVE: CVE-2023-41970
Published: 2024-05-02
Description: An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on Windows during the Repair App functionality may allow Local Execution of Code.This issue affects Client Connector on Windows: before 4.1.0.62.


CVSS Score: 6.0 (MEDIUM)
CWE: CWE-354
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=windows&applicable_version=4.1; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=windows&applicable_version=4.1
CVE: CVE-2023-41971
Published: 2024-05-02
Description: An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-59
References: https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021??applicable_category=windows&applicable_version=3.7; https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021??applicable_category=windows&applicable_version=3.7
CVE: CVE-2024-23459
Published: 2024-05-02
Description: An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to be overwritten.This issue affects Zscaler Client Connector on Mac : before 3.7.


CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macos&applicable_version=3.7; https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macos&applicable_version=3.7
CVE: CVE-2024-23461
Published: 2024-05-02
Description: An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Code.This issue affects Client Connector on MacOS: before 3.4.


CVSS Score: 4.2 (MEDIUM)
CWE: CWE-354
References: https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=macos&applicable_version=3.4; https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=macos&applicable_version=3.4
CVE: CVE-2024-23462
Published: 2024-05-02
Description: An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4.


CVSS Score: 3.3 (LOW)
CWE: CWE-354
References: https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=macos&applicable_version=3.4; https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=macos&applicable_version=3.4
CVE: CVE-2023-37244
Published: 2024-05-02
Description: The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attacker to manipulate the process into performing arbitrary file deletions. We recommend upgrading to version 2.91.0.0
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0016.md; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0016.md
CVE: CVE-2024-30251
Published: 2024-05-02
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2024/05/02/4; https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597; https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19
CVE: CVE-2024-33302
Published: 2024-05-02
Description: SourceCodester Product Show Room 1.0 and before is vulnerable to Cross Site Scripting (XSS) via "Middle Name" under Add Users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-33302.md; https://portswigger.net/web-security/cross-site-scripting/stored; https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-33302.md
CVE: CVE-2024-33303
Published: 2024-05-02
Description: SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" under Add Users.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-33303.md; https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-33303.md
CVE: CVE-2024-33305
Published: 2024-05-02
Description: SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Middle Name" parameter in Create User.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-33305.md; https://github.com/Mohitkumar0786/CVE/blob/main/CVE-2024-33305.md
CVE: CVE-2024-34061
Published: 2024-05-02
Description: changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/dgtlmoon/changedetection.io/commit/c0f000b1d1ce[PII_REDACTED]5dbbedde445fe2c762; https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-pwgc-w4x9-gw67; https://github.com/dgtlmoon/changedetection.io/commit/c0f000b1d1ce[PII_REDACTED]5dbbedde445fe2c762
CVE: CVE-2024-34144
Published: 2024-05-02
Description: A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-693
References: http://www.openwall.com/lists/oss-security/2024/05/02/3; https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341; http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE: CVE-2024-34145
Published: 2024-05-02
Description: A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVSS Score: 8.8 (HIGH)
CWE: CWE-290
References: http://www.openwall.com/lists/oss-security/2024/05/02/3; https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341; http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE: CVE-2024-34146
Published: 2024-05-02
Description: Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers with a previously configured SSH public key but lacking Overall/Read permission to access these repositories.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-862, CWE-863
References: http://www.openwall.com/lists/oss-security/2024/05/02/3; https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3342; http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE: CVE-2024-34147
Published: 2024-05-02
Description: Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2024/05/02/3; https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3294; http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE: CVE-2024-34148
Published: 2024-05-02
Description: Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system property 'hudson.model.ParametersAction.keepUndefinedParameters'.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1321
References: http://www.openwall.com/lists/oss-security/2024/05/02/3; https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3331; http://www.openwall.com/lists/oss-security/2024/05/02/3
CVE: CVE-2024-3543
Published: 2024-05-02
Description: 
Use of reversible password encryption algorithm allows attackers to decrypt passwords.  Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.


CVSS Score: 6.4 (MEDIUM)
CWE: CWE-257, CWE-522
References: https://kemptechnologies.com/; https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]8605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543; https://kemptechnologies.com/
CVE: CVE-2024-4128
Published: 2024-05-02
Description: This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit  068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0 

CVSS Score: 2.6 (LOW)
CWE: CWE-352
References: https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0; https://github.com/firebase/firebase-tools/pull/6944; https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0