deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38746
Published: 2023-08-03
Description: Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU93286117/; https://www.ia.omron.com/product/vulnerability/OMSR-2023-005_en.pdf; https://jvn.jp/en/vu/JVNVU93286117/
CVE: CVE-2023-3346
Published: 2023-08-03
Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://jvn.jp/vu/JVNVU90352157/index.html; https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-03; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdf
CVE: CVE-2023-3932
Published: 2023-08-03
Description: An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies.
CVSS Score: 8.2 (HIGH)
CWE: CWE-286
References: https://gitlab.com/gitlab-org/gitlab/-/issues/417594; https://hackerone.com/reports/2057633; https://gitlab.com/gitlab-org/gitlab/-/issues/417594
CVE: CVE-2023-4112
Published: 2023-08-03
Description: A vulnerability was found in PHP Jabbers Shuttle Booking Software 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235959. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173930/PHPJabbers-Shuttle-Booking-Software-1.0-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235959; https://vuldb.com/?id.235959
CVE: CVE-2023-4113
Published: 2023-08-03
Description: A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235960. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/173931/PHPJabbers-Service-Booking-Script-1.0-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235960; https://vuldb.com/?id.235960
CVE: CVE-2023-38747
Published: 2023-08-03
Description: Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU93286117/; https://www.ia.omron.com/product/vulnerability/OMSR-2023-005_en.pdf; https://jvn.jp/en/vu/JVNVU93286117/
CVE: CVE-2023-38748
Published: 2023-08-03
Description: Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://jvn.jp/en/vu/JVNVU93286117/; https://www.ia.omron.com/product/vulnerability/OMSR-2023-005_en.pdf; https://jvn.jp/en/vu/JVNVU93286117/
CVE: CVE-2023-4114
Published: 2023-08-03
Description: A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173932/PHPJabbers-Night-Club-Booking-1.0-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235961; https://vuldb.com/?id.235961
CVE: CVE-2023-4115
Published: 2023-08-03
Description: A vulnerability classified as problematic has been found in PHP Jabbers Cleaning Business 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. VDB-235962 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173936/PHPJabbers-Cleaning-Business-1.0-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235962; https://vuldb.com/?id.235962
CVE: CVE-2023-21407
Published: 2023-08-03
Description: 
A broken access control was found allowing for privileged escalation of the operator account to gain
administrator privileges.
CVSS Score: 8.8 (HIGH)
References: https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf; https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf
CVE: CVE-2023-21408
Published: 2023-08-03
Description: 
Due to insufficient file permissions, unprivileged users could gain access to unencrypted user credentials
that are used in the integration interface towards 3rd party systems.


CVSS Score: 8.4 (HIGH)
CWE: CWE-755
References: https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf; https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf
CVE: CVE-2023-21409
Published: 2023-08-03
Description: 
Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator
credentials allowing the configuration of the application.



CVSS Score: 8.4 (HIGH)
CWE: CWE-755
References: https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf; https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf
CVE: CVE-2023-21410
Published: 2023-08-03
Description: User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for
arbitrary code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf; https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf
CVE: CVE-2023-21411
Published: 2023-08-03
Description: User provided input is not sanitized in the “Settings > Access Control” configuration interface allowing for
arbitrary code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf; https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf
CVE: CVE-2023-21412
Published: 2023-08-03
Description: User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for
SQL injections.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf; https://www.axis.com/dam/public/0b/1c/96/cve-2[PII_REDACTED]-en-US-409778.pdf
CVE: CVE-2023-4008
Published: 2023-08-03
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible to takeover GitLab Pages with unique domain URLs if the random string added was known.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-708
References: https://gitlab.com/gitlab-org/gitlab/-/issues/415942; https://gitlab.com/gitlab-org/gitlab/-/issues/415942
CVE: CVE-2023-4116
Published: 2023-08-03
Description: A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173937/PHPJabbers-Taxi-Booking-2.0-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235963; https://vuldb.com/?id.235963
CVE: CVE-2023-4117
Published: 2023-08-03
Description: A vulnerability, which was classified as problematic, has been found in PHP Jabbers Rental Property Booking 2.0. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235964. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173939/PHPJabbers-Rental-Property-Booking-2.0-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235964; https://vuldb.com/?id.235964
CVE: CVE-2023-4118
Published: 2023-08-03
Description: A vulnerability, which was classified as problematic, was found in Cute Http File Server 2.0. This affects an unknown part of the component Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235965 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/goodric/chfs; https://vuldb.com/?ctiid.235965; https://vuldb.com/?id.235965
CVE: CVE-2023-4119
Published: 2023-08-03
Description: A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-235966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/173941/Academy-LMS-6.0-Cross-Site-Scripting.html; https://vuldb.com/?ctiid.235966; https://vuldb.com/?id.235966
CVE: CVE-2023-4120
Published: 2023-08-03
Description: A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235967. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/RCEraser/cve/blob/main/rce.md; https://vuldb.com/?ctiid.235967; https://vuldb.com/?id.235967
CVE: CVE-2023-4121
Published: 2023-08-03
Description: A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722. It has been classified as critical. Affected is an unknown function. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235968. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/torres14852/cve/blob/main/upload.md; https://vuldb.com/?ctiid.235968; https://vuldb.com/?id.235968
CVE: CVE-2023-37545
Published: 2023-08-03
Description: In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019; https://cert.vde.com/en/advisories/VDE-2023-019
CVE: CVE-2023-3662
Published: 2023-08-03
Description: In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://cert.vde.com/en/advisories/VDE-2023-021/; https://cert.vde.com/en/advisories/VDE-2023-021/
CVE: CVE-2023-3663
Published: 2023-08-03
Description: In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-940
References: https://cert.vde.com/en/advisories/VDE-2023-022/; https://cert.vde.com/en/advisories/VDE-2023-022/
CVE: CVE-2023-37546
Published: 2023-08-03
Description: In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019; https://cert.vde.com/en/advisories/VDE-2023-019
CVE: CVE-2023-37547
Published: 2023-08-03
Description: In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019; https://cert.vde.com/en/advisories/VDE-2023-019
CVE: CVE-2023-37548
Published: 2023-08-03
Description: In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019; https://cert.vde.com/en/advisories/VDE-2023-019
CVE: CVE-2023-37549
Published: 2023-08-03
Description: In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019; https://cert.vde.com/en/advisories/VDE-2023-019
CVE: CVE-2023-37550
Published: 2023-08-03
Description: In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37549.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019; https://cert.vde.com/en/advisories/VDE-2023-019
CVE: CVE-2023-37551
Published: 2023-08-03
Description: In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://cert.vde.com/en/advisories/VDE-2023-019/; https://cert.vde.com/en/advisories/VDE-2023-019/
CVE: CVE-2023-37552
Published: 2023-08-03
Description: In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019/; https://cert.vde.com/en/advisories/VDE-2023-019/
CVE: CVE-2023-37553
Published: 2023-08-03
Description: In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019/; https://cert.vde.com/en/advisories/VDE-2023-019/
CVE: CVE-2023-37554
Published: 2023-08-03
Description: In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019/; https://cert.vde.com/en/advisories/VDE-2023-019/
CVE: CVE-2023-37555
Published: 2023-08-03
Description: In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019/; https://cert.vde.com/en/advisories/VDE-2023-019/
CVE: CVE-2023-37556
Published: 2023-08-03
Description: In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019/; https://cert.vde.com/en/advisories/VDE-2023-019/
CVE: CVE-2023-37557
Published: 2023-08-03
Description: After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://cert.vde.com/en/advisories/VDE-2023-019/; https://cert.vde.com/en/advisories/VDE-2023-019/
CVE: CVE-2023-37558
Published: 2023-08-03
Description: After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019/; https://cert.vde.com/en/advisories/VDE-2023-019/
CVE: CVE-2023-37559
Published: 2023-08-03
Description: After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert.vde.com/en/advisories/VDE-2023-019/; https://cert.vde.com/en/advisories/VDE-2023-019/
CVE: CVE-2023-3669
Published: 2023-08-03
Description: A missing Brute-Force protection in CODESYS Development System prior to 3.5.19.20 allows a local attacker to have unlimited attempts of guessing the password within an import dialog.
CVSS Score: 3.3 (LOW)
CWE: CWE-307, CWE-307
References: https://cert.vde.com/en/advisories/VDE-2023-023; https://cert.vde.com/en/advisories/VDE-2023-023
CVE: CVE-2022-34453
Published: 2023-08-03
Description: 
Dell XtremIO X2 XMS versions prior to 6-4-1.11 contain an improper access control vulnerability. A remote read only user could potentially exploit this vulnerability to perform add/delete QoS policies which are disabled by default.


CVSS Score: 7.6 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000204809/dsa-2022-290-dell-xtremio-x2-security-advisory-for-xms-gui?lang=en; https://www.dell.com/support/kbdoc/en-us/000204809/dsa-2022-290-dell-xtremio-x2-security-advisory-for-xms-gui?lang=en
CVE: CVE-2022-4046
Published: 2023-08-03
Description: In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://cert.vde.com/en/advisories/VDE-2023-025/; https://cert.vde.com/en/advisories/VDE-2023-025/
CVE: CVE-2023-22314
Published: 2023-08-03
Description: Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22317.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://jvn.jp/en/vu/JVNVU92877622/; https://jvn.jp/en/vu/JVNVU92877622/