deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-48940
Published: 2023-12-06
Description: A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://daicuo.com; https://gist.github.com/durian5201314/957af852a42dad9c07ceb3fb2f8359b2; https://www.daicuo.net/
CVE: CVE-2023-6508
Published: 2023-12-06
Description: Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html; https://crbug.com/1497984; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/
CVE: CVE-2023-6509
Published: 2023-12-06
Description: Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html; https://crbug.com/1494565; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/
CVE: CVE-2023-6510
Published: 2023-12-06
Description: Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific UI interaction. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html; https://crbug.com/1480152; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/
CVE: CVE-2023-6511
Published: 2023-12-06
Description: Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html; https://crbug.com/1478613; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/
CVE: CVE-2023-6512
Published: 2023-12-06
Description: Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-838
References: https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html; https://crbug.com/1457702; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMHY76AWPA46MAFXPWDGJX6FEGXZVR5Z/
CVE: CVE-2023-40053
Published: 2023-12-06
Description: A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously. 
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-4-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40053; https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-4-1_release_notes.htm
CVE: CVE-2023-41268
Published: 2023-12-06
Description: Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault. This issue affects Escargot: from 3.0.0 through 4.0.0.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-787
References: https://github.com/Samsung/escargot/pull/1260; https://github.com/Samsung/escargot/pull/1260
CVE: CVE-2023-22522
Published: 2023-12-06
Description: This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-74
References: https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/CONFSERVER-93502; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]
CVE: CVE-2023-22523
Published: 2023-12-06
Description: This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.
CVSS Score: 8.8 (HIGH)
References: https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery[PII_REDACTED].html; https://jira.atlassian.com/browse/JSDSERVER-14925; https://confluence.atlassian.com/security/cve-2023-22523-rce-vulnerability-in-assets-discovery[PII_REDACTED].html
CVE: CVE-2023-22524
Published: 2023-12-06
Description: Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code.
CVSS Score: 9.8 (CRITICAL)
References: https://confluence.atlassian.com/security/cve-2023-22524-rce-vulnerability-in-atlassian-companion-app-for-macos[PII_REDACTED].html; https://jira.atlassian.com/browse/CONFSERVER-93518; https://confluence.atlassian.com/security/cve-2023-22524-rce-vulnerability-in-atlassian-companion-app-for-macos[PII_REDACTED].html
CVE: CVE-2023-26154
Published: 2023-12-06
Description: Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.**Note:**In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-331, CWE-331
References: https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0; https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70; https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119
CVE: CVE-2023-6527
Published: 2023-12-06
Description: The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/email-subscribe/tags/1.2.19/wp-email-subscription.php?rev=3005188#L2125; https://www.wordfence.com/threat-intel/vulnerabilities/id/5f84814e-f7b7-4228-b331-63027a0770af?source=cve; https://plugins.trac.wordpress.org/browser/email-subscribe/tags/1.2.19/wp-email-subscription.php?rev=3005188#L2125
CVE: CVE-2023-2861
Published: 2023-12-06
Description: A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-284
References: https://access.redhat.com/security/cve/CVE-2023-2861; https://bugzilla.redhat.com/show_bug.cgi?id=2219266; https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html
CVE: CVE-2023-49897
Published: 2023-12-06
Description: An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://jvn.jp/en/vu/JVNVU92152057/; https://www.akamai.com/blog/security-research/zero-day-vulnerability-spreading-mirai-patched; https://www.cisa.gov/news-events/ics-advisories/icsa-23-355-01
CVE: CVE-2023-48849
Published: 2023-12-06
Description: Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/delsploit/CVE-2023-48849; https://github.com/delsploit/CVE-2023-48849
CVE: CVE-2023-34439
Published: 2023-12-06
Description: Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN96209256/; https://pleasanter.org/archives/vulnerability-update-202311; https://jvn.jp/en/jp/JVN96209256/
CVE: CVE-2023-44099
Published: 2023-12-06
Description: Vulnerability of data verification errors in the kernel module. Successful exploitation of this vulnerability may cause WLAN interruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-44113
Published: 2023-12-06
Description: Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-45210
Published: 2023-12-06
Description: Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://jvn.jp/en/jp/JVN96209256/; https://pleasanter.org/archives/vulnerability-update-202311; https://jvn.jp/en/jp/JVN96209256/
CVE: CVE-2023-46688
Published: 2023-12-06
Description: Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://jvn.jp/en/jp/JVN96209256/; https://pleasanter.org/archives/vulnerability-update-202311; https://jvn.jp/en/jp/JVN96209256/
CVE: CVE-2023-46773
Published: 2023-12-06
Description: Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49239
Published: 2023-12-06
Description: Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49240
Published: 2023-12-06
Description: Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-601, CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49241
Published: 2023-12-06
Description: API permission control vulnerability in the network management module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49242
Published: 2023-12-06
Description: Free broadcast vulnerability in the running management module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49243
Published: 2023-12-06
Description: Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49244
Published: 2023-12-06
Description: Permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49245
Published: 2023-12-06
Description: Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49246
Published: 2023-12-06
Description: Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49247
Published: 2023-12-06
Description: Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-49248
Published: 2023-12-06
Description: Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-6273
Published: 2023-12-06
Description: Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://consumer.huawei.com/en/support/bulletin/2023/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/12/
CVE: CVE-2023-6458
Published: 2023-12-06
Description: Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.


CVSS Score: 7.1 (HIGH)
CWE: CWE-74, CWE-22, CWE-74
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-6459
Published: 2023-12-06
Description: Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-6514
Published: 2023-12-06
Description: 
The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions. 

Successful exploitation of this vulnerability may allow attackers to access restricted functions.


CVSS Score: 8.8 (HIGH)
CWE: CWE-840, CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-ibvishssp-4bf951d4-en; https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-ibvishssp-4bf951d4-en
CVE: CVE-2023-32268
Published: 2023-12-06
Description: 
Exposure of Proxy Administrator Credentials

An authenticated administrator equivalent Filr user can access the credentials of proxy administrators.


CVSS Score: 7.2 (HIGH)
CWE: CWE-522, CWE-522
References: https://portal.microfocus.com/s/article/KM000020081?language=en_US; https://portal.microfocus.com/s/article/KM000020081?language=en_US
CVE: CVE-2023-6288
Published: 2023-12-06
Description: Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB_INSERT_LIBRARIES environment variable.










CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://devolutions.net/security/advisories/DEVO-2023-0021/; https://devolutions.net/security/advisories/DEVO-2023-0021/
CVE: CVE-2023-48859
Published: 2023-12-06
Description: TOTOLINK A3002RU version 2.0.0-B20[PII_REDACTED] has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security restrictions and execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-A3002RU-RCE.md; https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-A3002RU-RCE.md
CVE: CVE-2023-36655
Published: 2023-12-06
Description: The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user to login and obtain an authentication token by specifying a username with different uppercase/lowercase character combination.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://prolion.com/cryptospike/; https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36655; https://prolion.com/cryptospike/
CVE: CVE-2023-39538
Published: 2023-12-06
Description: 
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability. 






CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-434, CWE-434
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023009.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023009.pdf
CVE: CVE-2023-39539
Published: 2023-12-06
Description: 
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability. 






CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-434, CWE-434
References: https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023009.pdf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.kb.cert.org/vuls/id/811862
CVE: CVE-2023-39326
Published: 2023-12-06
Description: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
CVSS Score: 5.3 (MEDIUM)
References: https://go.dev/cl/547335; https://go.dev/issue/64433; https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
CVE: CVE-2023-45285
Published: 2023-12-06
Description: Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
CVSS Score: 7.5 (HIGH)
References: https://go.dev/cl/540257; https://go.dev/issue/63845; https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ