deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-24686
Published: 2021-02-26
Description: The vulnerabilities can be exploited to cause the web visualization component of the PLC to stop and not respond, leading to genuine users losing remote visibility of the PLC state. If a user attempts to login to the PLC while this vulnerability is exploited, the PLC will show an error state and refuse connections to Automation Builder. The execution of the PLC application is not affected by this vulnerability. This issue affects ABB AC500 V2 products with onboard Ethernet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://search.abb.com/library/Download.aspx?DocumentID=3ADR010645&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=3ADR010645&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-23964
Published: 2021-02-26
Description: Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662507%2C1666285%2C1673526%2C1674278%2C1674835%2C1675097%2C1675844%2C1675868%2C1677590%2C1677888%2C1680410%2C1681268%2C1682068%2C1682938%2C1683736%2C1685260%2C1685925; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://www.mozilla.org/security/advisories/mfsa2021-04/
CVE: CVE-2021-23965
Published: 2021-02-26
Description: Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497; https://www.mozilla.org/security/advisories/mfsa2021-03/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1670378%2C1673555%2C1676812%2C1678582%2C1684497
CVE: CVE-2021-23978
Published: 2021-02-26
Description: Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=786797%2C1682928%2C1687391%2C1687597; https://lists.debian.org/debian-lts-announce/2021/03/msg00000.html; https://security.gentoo.org/glsa/202104-09
CVE: CVE-2021-23979
Published: 2021-02-26
Description: Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663222%2C1666607%2C1672120%2C1678463%2C1678927%2C1679560%2C1681297%2C1681684%2C1683490%2C1684377%2C1684902; https://www.mozilla.org/security/advisories/mfsa2021-07/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1663222%2C1666607%2C1672120%2C1678463%2C1678927%2C1679560%2C1681297%2C1681684%2C1683490%2C1684377%2C1684902
CVE: CVE-2021-21297
Published: 2021-02-26
Description: Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. The vulnerability is patched in the 1.2.8 release. A workaround is to ensure only authorized users are able to access the editor url.
CVSS Score: 7.7 (HIGH)
CWE: CWE-915, CWE-1321, CWE-1321
References: https://github.com/node-red/node-red/releases/tag/1.2.8; https://github.com/node-red/node-red/security/advisories/GHSA-xp9c-82x8-7f67; https://www.npmjs.com/package/%40node-red/editor-api
CVE: CVE-2021-21298
Published: 2021-02-26
Description: Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API. The issue has been patched in Node-RED 1.2.8. The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED. The primary workaround is not give untrusted users read access to the Node-RED editor.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/node-red/node-red/commit/74db3e17d075f23d9c95d7871586cf461524c456; https://github.com/node-red/node-red/releases/tag/1.2.8; https://github.com/node-red/node-red/security/advisories/GHSA-m33v-338h-4v9f
CVE: CVE-2021-21273
Published: 2021-02-26
Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible. For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.
CVSS Score: 3.1 (LOW)
CWE: CWE-601, CWE-601
References: https://github.com/matrix-org/synapse/commit/30fba6210834a4ecd91badf0c8f3eb278b72e746; https://github.com/matrix-org/synapse/pull/8821; https://github.com/matrix-org/synapse/releases/tag/v1.25.0
CVE: CVE-2021-21274
Published: 2021-02-26
Description: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver. This affects any server which accepts federation requests from untrusted servers. Issue is resolved in version 1.25.0. As a workaround the `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/matrix-org/synapse/commit/ff5c4da1289cb5e097902b3e55b771be342c29d6; https://github.com/matrix-org/synapse/pull/8950; https://github.com/matrix-org/synapse/releases/tag/v1.25.0
CVE: CVE-2021-23345
Published: 2021-02-26
Description: All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/passwd'>.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/thecodingmachine/gotenberg/issues/261; https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTHECODINGMACHINEGOTENBERG-1062043; https://github.com/thecodingmachine/gotenberg/issues/261
CVE: CVE-2021-21302
Published: 2021-02-26
Description: PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78, CWE-1236
References: https://github.com/PrestaShop/PrestaShop/commit/782b1368aa4e94dafe28f57485bffbd8893fbb1e; https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-2rw4-2p99-cmx9
CVE: CVE-2021-21308
Published: 2021-02-26
Description: PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout system is not complete and an attacker is able to foreign request and executes customer commands. The problem is fixed in 1.7.7.2
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-287
References: https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee; https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcg
CVE: CVE-2021-0366
Published: 2021-02-26
Description: In vpu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05371580; Issue ID: ALPS05379093.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0367
Published: 2021-02-26
Description: In vpu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05371580; Issue ID: ALPS05379085.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0401
Published: 2021-02-26
Description: In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05418265.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0402
Published: 2021-02-26
Description: In jpeg, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05433311.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0403
Published: 2021-02-26
Description: In netdiag, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05475124.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0404
Published: 2021-02-26
Description: In mobile_log_d, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05457039.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0405
Published: 2021-02-26
Description: In performance driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05466547.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0406
Published: 2021-02-26
Description: In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05471418.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2020-27223
Published: 2021-02-26
Description: In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-407, CWE-400
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=571128; https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7; https://github.com/jetty/jetty.project/commit/10e531756b972162eed402c44d0244f7f6b85131
CVE: CVE-2021-21309
Published: 2021-02-26
Description: Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-190
References: https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0; https://github.com/redis/redis/pull/8522; https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf
CVE: CVE-2021-26560
Published: 2021-02-26
Description: Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-319, CWE-319
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1159; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-26561
Published: 2021-02-26
Description: Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-121, CWE-119
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1159; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-26562
Published: 2021-02-26
Description: Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary code via syno_finder_site HTTP header.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1159; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-26563
Published: 2021-02-26
Description: Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to execute arbitrary code via unspecified vectors.
CVSS Score: 8.2 (HIGH)
CWE: CWE-863, CWE-863
References: https://www.synology.com/security/advisory/Synology_SA_21_03; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1158; https://www.synology.com/security/advisory/Synology_SA_21_03
CVE: CVE-2021-26564
Published: 2021-02-26
Description: Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to spoof servers via an HTTP session.
CVSS Score: 8.3 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1160; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-26565
Published: 2021-02-26
Description: Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to obtain sensitive information via an HTTP session.
CVSS Score: 8.3 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1160; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-26566
Published: 2021-02-26
Description: Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle attackers to execute arbitrary commands via inbound QuickConnect traffic.
CVSS Score: 8.3 (HIGH)
CWE: CWE-201, CWE-200
References: https://www.synology.com/security/advisory/Synology_SA_20_26; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1160; https://www.synology.com/security/advisory/Synology_SA_20_26
CVE: CVE-2021-26567
Published: 2021-02-26
Description: Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/knik0/faad2/commit/720f7004d6c4aabee19aad16e7c456ed76a3ebfa; https://www.synology.com/security/advisory/Synology_SA_20_26; https://github.com/knik0/faad2/commit/720f7004d6c4aabee19aad16e7c456ed76a3ebfa
CVE: CVE-2021-27799
Published: 2021-02-26
Description: ean_leading_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API through an application that includes the Zint Barcode Generator library code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://zint.org.uk/Manual.aspx?type=p&page=3; http://zint.org.uk/Manual.aspx?type=p&page=4; http://zint.org.uk/Manual.aspx?type=p&page=5
CVE: CVE-2020-27618
Published: 2021-02-26
Description: The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html; https://security.gentoo.org/glsa/202107-07; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-36079
Published: 2021-02-26
Description: Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacker must navigate to the uploader plugin, check the elFinder box, and then drag and drop files into the Files(elFinder) portion of the UI. This can, for example, place a .php file in the server's uploaded/ directory. NOTE: the vendor disputes this because exploitation can only be performed by an admin who has "lots of other possibilities to harm a site.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/161569/Zenphoto-CMS-1.5.7-Shell-Upload.html; https://github.com/zenphoto/zenphoto/issues/1292; https://www.zenphoto.org/news/why-not-every-security-issue-is-really-an-issue/
CVE: CVE-2021-27198
Published: 2021-02-26
Description: An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbitrary File Upload in the web service when using a myspeed/sf?filename= URI. This application is written in Java and is thus cross-platform. The Windows installation runs as SYSTEM, which means that exploitation gives one Administrator privileges on the target system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/161571/VisualWare-MyConnection-Server-11.x-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2021/Feb/81; https://myconnectionserver.visualware.com/download.html
CVE: CVE-2021-27803
Published: 2021-02-26
Description: A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range.
CVSS Score: 7.5 (HIGH)
References: http://www.openwall.com/lists/oss-security/2021/02/27/1; https://lists.debian.org/debian-lts-announce/2021/03/msg00003.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZGUR5XFHATVXTRAEJMODS7ROYHA56NX/
CVE: CVE-2019-25020
Published: 2021-02-27
Description: An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the administrative configuration by sending a POST request to the /sdm-ws-rest/preconfiguration URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://suid.ch/research/CVE-2019-25020.html; https://suid.ch/research/CVE-2019-25020.html
CVE: CVE-2019-25021
Published: 2021-02-27
Description: An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providing admin as the admin password. A different password cannot be set because of the implementation in code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://suid.ch/research/CVE-2019-25021.html; https://suid.ch/research/CVE-2019-25021.html