deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-0715
Published: 2024-02-20
Description: Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows allows Code Injection.This issue affects Hitachi Global Link Manager: before 8.8.7-03.


CVSS Score: 7.6 (HIGH)
CWE: CWE-917, CWE-917
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-112/index.html; https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-112/index.html
CVE: CVE-2024-21890
Published: 2024-02-20
Description: The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example:
```
 --allow-fs-read=/home/node/.ssh/*.pub
```

will ignore `pub` and give access to everything after `.ssh/`.

This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/03/11/1; https://hackerone.com/reports/2257156; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-21891
Published: 2024-02-20
Description: Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack.
This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: http://www.openwall.com/lists/oss-security/2024/03/11/1; https://hackerone.com/reports/2259914; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-21892
Published: 2024-02-20
Description: On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE.
Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set.
This allows unprivileged users to inject code that inherits the process's elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-269
References: http://www.openwall.com/lists/oss-security/2024/03/11/1; https://hackerone.com/reports/2237545; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-21896
Published: 2024-02-20
Description: The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability.
This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-27
References: http://www.openwall.com/lists/oss-security/2024/03/11/1; https://hackerone.com/reports/2218653; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-22019
Published: 2024-02-20
Description: A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: http://www.openwall.com/lists/oss-security/2024/03/11/1; https://hackerone.com/reports/2233486; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-6764
Published: 2024-02-20
Description: 











A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50(W) series firmware versions from 4.16 through 5.37 Patch 1, and USG20(W)-VPN series firmware versions from 4.16 through 5.37 Patch 1 could allow an attacker to achieve unauthorized remote code execution by sending a sequence of specially crafted payloads containing an invalid pointer; however, such an attack would require detailed knowledge of an affected device’s memory layout and configuration.




CVSS Score: 8.1 (HIGH)
CWE: CWE-134, CWE-134
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps-02-20-2024
CVE: CVE-2024-1510
Published: 2024-02-20
Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_tooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping on user supplied attributes and user supplied tags. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.0.2/includes/shortcodes/tooltip.php; https://plugins.trac.wordpress.org/changeset/3037436/shortcodes-ultimate/trunk/includes/shortcodes/tooltip.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/ee03d780-076b-4501-a353-376198a4bd7b?source=cve
CVE: CVE-2024-1559
Published: 2024-02-20
Description: The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3037265%40link-library&new=3037265%40link-library&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/407a5c69-cce0-4868-aef0-ffc88981e256?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3037265%40link-library&new=3037265%40link-library&sfp_email=&sfph_mail=
CVE: CVE-2022-45320
Published: 2024-02-20
Description: Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-45320; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-45320
CVE: CVE-2023-5190
Published: 2024-02-20
Description: Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-5190; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-5190
CVE: CVE-2023-44308
Published: 2024-02-20
Description: Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44308; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44308
CVE: CVE-2024-22234
Published: 2024-02-20
Description: In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method.

Specifically, an application is vulnerable if:

  *  The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value.


An application is not vulnerable if any of the following is true:

  *  The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly.
  *  The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated
  *  The application only uses isFullyAuthenticated via  Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or  HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html
CVSS Score: 7.4 (HIGH)
CWE: CWE-284
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://spring.io/security/cve-2024-22234; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-25149
Published: 2024-02-20
Description: Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149
CVE: CVE-2024-25150
Published: 2024-02-20
Description: Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-201
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150
CVE: CVE-2024-25973
Published: 2024-02-20
Description: The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. An attacker with rights to create or edit groups can create a course with a name that contains an XSS payload. Furthermore, attackers with the permissions to create or rename a catalog (sub-category) can enter unfiltered input in the name field. In addition, attackers who are allowed to create curriculums can also enter unfiltered input in the name field. This allows an attacker to execute stored JavaScript code with the permissions of the victim in the context of the user's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: http://seclists.org/fulldisclosure/2024/Feb/23; https://r.sec-consult.com/openolat; http://seclists.org/fulldisclosure/2024/Feb/23
CVE: CVE-2024-25974
Published: 2024-02-20
Description: The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability. It is possible to upload files within the Media Center of OpenOlat version 18.1.5 (or lower) as an authenticated user without any other rights. Although the filetypes are limited, an SVG image containing an XSS payload can be uploaded. After a successful upload the file can be shared with groups of users (including admins) who can be attacked with the JavaScript payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: http://seclists.org/fulldisclosure/2024/Feb/23; https://r.sec-consult.com/openolat; http://seclists.org/fulldisclosure/2024/Feb/23
CVE: CVE-2024-1608
Published: 2024-02-20
Description: In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-280
References: https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]954552832; https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]954552832
CVE: CVE-2024-25604
Published: 2024-02-20
Description: Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604
CVE: CVE-2024-25605
Published: 2024-02-20
Description: The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605
CVE: CVE-2024-25606
Published: 2024-02-20
Description: XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
CVSS Score: 8.0 (HIGH)
CWE: CWE-611, CWE-611
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606
CVE: CVE-2023-49109
Published: 2024-02-20
Description: Exposure of Remote Code Execution in Apache Dolphinscheduler.

This issue affects Apache DolphinScheduler: before 3.2.1. 

We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/02/20/4; https://github.com/apache/dolphinscheduler/pull/14991; https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8
CVE: CVE-2023-49250
Published: 2024-02-20
Description: Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.

This issue affects Apache DolphinScheduler: before 3.2.0.

Users are recommended to upgrade to version 3.2.1, which fixes the issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-295
References: http://www.openwall.com/lists/oss-security/2024/02/20/1; https://github.com/apache/dolphinscheduler/pull/15288; https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn
CVE: CVE-2023-50270
Published: 2024-02-20
Description: Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613, CWE-384
References: https://github.com/apache/dolphinscheduler/pull/15219; https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6; https://lists.apache.org/thread/lmnf21obyos920dnvbfpwq29c1sd2r9r
CVE: CVE-2023-51770
Published: 2024-02-20
Description: Arbitrary File Read Vulnerability in Apache Dolphinscheduler.

This issue affects Apache DolphinScheduler: before 3.2.1. 

We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2024/02/20/2; https://github.com/apache/dolphinscheduler/pull/15433; https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g
CVE: CVE-2024-25607
Published: 2024-02-20
Description: The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.
CVSS Score: 8.1 (HIGH)
CWE: CWE-916, CWE-916
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607
CVE: CVE-2024-25608
Published: 2024-02-20
Description: HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608
CVE: CVE-2024-25609
Published: 2024-02-20
Description: HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609; https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609
CVE: CVE-2023-7245
Published: 2024-02-20
Description: The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable

CVSS Score: 7.8 (HIGH)
CWE: CWE-95
References: https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/; https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/; https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/
CVE: CVE-2024-24793
Published: 2024-02-20
Description: A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable application to process a malicious DICOM image.The Use-After-Free happens in the `parse_meta_element_create()` parsing the elements in the File Meta Information header.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1931; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1931; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1931
CVE: CVE-2024-24794
Published: 2024-02-20
Description: A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. To trigger this vulnerability, an attacker would need to induce the vulnerable application to process a malicious DICOM image.The Use-After-Free happens in the `parse_meta_sequence_end()` parsing the Sequence Value Represenations.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1931; https://talosintelligence.com/vulnerability_reports/TALOS-2024-1931; https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1931
CVE: CVE-2023-52433
Published: 2024-02-20
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

New elements in this transaction might expired before such transaction
ends. Skip sync GC for such elements otherwise commit path might walk
over an already released object. Once transaction is finished, async GC
will collect such expired element.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-273
References: https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017; https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4; https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1
CVE: CVE-2024-1661
Published: 2024-02-20
Description: A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254179. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.5 (LOW)
CWE: CWE-798
References: https://github.com/WoodManGitHub/MyCVEs/blob/main/2024-Totolink/X6000R-Hardcoded-Password.md; https://vuldb.com/?ctiid.254179; https://vuldb.com/?id.254179