deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22888
Published: 2023-07-12
Description: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/apache/airflow/pull/32293; https://lists.apache.org/thread/dnlht2hvm7k81k5tgjtsfmk27c76kq7z; https://github.com/apache/airflow/pull/32293
CVE: CVE-2023-30428
Published: 2023-07-12
Description: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role.
This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from 2.10.0 before 2.10.4, 2.11.0.

The vulnerability is exploitable when an attacker can connect directly to the Pulsar Broker. If an attacker is connecting through the Pulsar Proxy, there is no known way to exploit this authorization vulnerability.

There are two known risks for affected users. First, an attacker could produce garbage messages to any topic in the cluster. Second, an attacker could produce messages to the topic level policies topic for other tenants and influence topic settings that could lead to exfiltration and/or deletion of messages for other tenants.

2.8 Pulsar Broker users and earlier are unaffected.
2.9 Pulsar Broker users should upgrade to one of the patched versions.
2.10 Pulsar Broker users should upgrade to at least 2.10.4.
2.11 Pulsar Broker users should upgrade to at least 2.11.1.
3.0 Pulsar Broker users are unaffected.


CVSS Score: 8.2 (HIGH)
CWE: CWE-863
References: https://lists.apache.org/thread/v39hqtgrmyxr85rmofwvgrktnflbq3q5; https://lists.apache.org/thread/v39hqtgrmyxr85rmofwvgrktnflbq3q5
CVE: CVE-2023-30429
Published: 2023-07-12
Description: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar.

This issue affects Apache Pulsar: before 2.10.4, and 2.11.0.

When a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authentication to authenticate with the Pulsar Function Worker, the Pulsar Function Worker incorrectly performs authorization by using the Proxy's role for authorization instead of the client's role, which can lead to privilege escalation, especially if the proxy is configured with a superuser role.

The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version.

2.10 Pulsar Function Worker users should upgrade to at least 2.10.4.
2.11 Pulsar Function Worker users should upgrade to at least 2.11.1.
3.0 Pulsar Function Worker users are unaffected.
Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions.

CVSS Score: 9.6 (CRITICAL)
CWE: CWE-863
References: https://lists.apache.org/thread/v0gcvvxswr830314q4b1kybsfmcf3jf8; https://lists.apache.org/thread/v0gcvvxswr830314q4b1kybsfmcf3jf8
CVE: CVE-2023-31007
Published: 2023-07-12
Description: Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false.

This issue affects Apache Pulsar: through 2.9.4, from 2.10.0 through 2.10.3, 2.11.0.

2.9 Pulsar Broker users should upgrade to at least 2.9.5.
2.10 Pulsar Broker users should upgrade to at least 2.10.4.
2.11 Pulsar Broker users should upgrade to at least 2.11.1.
3.0 Pulsar Broker users are unaffected.
Any users running the Pulsar Broker for 2.8.* and earlier should upgrade to one of the above patched versions.

CVSS Score: 0.0 (NONE)
CWE: CWE-287
References: https://lists.apache.org/thread/qxn99xxyp0zv6jchjggn3soyo5gvqfxj; https://lists.apache.org/thread/qxn99xxyp0zv6jchjggn3soyo5gvqfxj
CVE: CVE-2023-35908
Published: 2023-07-12
Description: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/apache/airflow/pull/32014; https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw; https://github.com/apache/airflow/pull/32014
CVE: CVE-2023-36543
Published: 2023-07-12
Description: Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://github.com/apache/airflow/pull/32060; https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4; https://github.com/apache/airflow/pull/32060
CVE: CVE-2023-37579
Published: 2023-07-12
Description: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker.

This issue affects Apache Pulsar: before 2.10.4, and 2.11.0.

Any authenticated user can retrieve a source's configuration or a sink's configuration without authorization. Many sources and sinks contain credentials in the configuration, which could lead to leaked credentials. This vulnerability is mitigated by the fact that there is not a known way for an authenticated user to enumerate another tenant's sources or sinks, meaning the source or sink name would need to be guessed in order to exploit this vulnerability.

The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version.

2.10 Pulsar Function Worker users should upgrade to at least 2.10.4.
2.11 Pulsar Function Worker users should upgrade to at least 2.11.1.
3.0 Pulsar Function Worker users are unaffected.
Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions.


CVSS Score: 8.2 (HIGH)
CWE: CWE-863
References: https://lists.apache.org/thread/0dmn3cb5n2p08o3cpj3ycfhzfqs2ppwz; https://lists.apache.org/thread/0dmn3cb5n2p08o3cpj3ycfhzfqs2ppwz
CVE: CVE-2023-37582
Published: 2023-07-12
Description: The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. 

When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. 

It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.openwall.com/lists/oss-security/2023/07/12/1; https://lists.apache.org/thread/m614czxtpvlztd7mfgcs2xcsg36rdbnc; http://www.openwall.com/lists/oss-security/2023/07/12/1
CVE: CVE-2021-43757
Published: 2023-07-12
Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious 3GP ​file
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html
CVE: CVE-2021-43758
Published: 2023-07-12
Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MP4 file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html
CVE: CVE-2021-43759
Published: 2023-07-12
Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MP4 file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html
CVE: CVE-2021-43760
Published: 2023-07-12
Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious MOV file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html
CVE: CVE-2021-44696
Published: 2023-07-12
Description: Adobe Prelude version 22.1.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious JPEG file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/prelude/apsb21-114.html; https://helpx.adobe.com/security/products/prelude/apsb21-114.html
CVE: CVE-2020-20021
Published: 2023-07-12
Description: An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://mikrotik.com; http://router.com; https://www.exploit-db.com/exploits/48228
CVE: CVE-2023-33668
Published: 2023-07-12
Description: DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and takeover accounts on shared computers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-354
References: http://digiexam.com; https://github.com/lodi-g/CVE-2023-33668; http://digiexam.com
CVE: CVE-2023-38061
Published: 2023-07-12
Description: In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-38062
Published: 2023-07-12
Description: In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-38063
Published: 2023-07-12
Description: In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-38064
Published: 2023-07-12
Description: In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-38065
Published: 2023-07-12
Description: In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-38066
Published: 2023-07-12
Description: In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-38067
Published: 2023-07-12
Description: In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-38068
Published: 2023-07-12
Description: In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-799
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-38069
Published: 2023-07-12
Description: In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases
CVSS Score: 3.3 (LOW)
CWE: CWE-754
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-3595
Published: 2023-07-12
Description: 
Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010
CVE: CVE-2023-3596
Published: 2023-07-12
Description: 
Where this vulnerability exists in the Rockwell Automation 1756-EN4* Ethernet/IP communication products, it could allow a malicious user to cause a denial of service by asserting the target system through maliciously crafted CIP messages.


CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010
CVE: CVE-2023-20185
Published: 2023-07-12
Description: A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, remote attacker to read or modify intersite encrypted traffic.
 This vulnerability is due to an issue with the implementation of the ciphers that are used by the CloudSec encryption feature on affected switches. An attacker with an on-path position between the ACI sites could exploit this vulnerability by intercepting intersite encrypted traffic and using cryptanalytic techniques to break the encryption. A successful exploit could allow the attacker to read or modify the traffic that is transmitted between the sites.
 Cisco has not released and will not release software updates that address this vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-330, CWE-326
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX
CVE: CVE-2023-20207
Published: 2023-07-12
Description: A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system.
 This vulnerability exists because certain unencrypted credentials are stored. An attacker could exploit this vulnerability by accessing the logs on an affected system and obtaining credentials that they may not normally have access to. A successful exploit could allow the attacker to view sensitive information in clear text.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532, CWE-312
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-auth-info-JgkSWBLz; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-auth-info-JgkSWBLz
CVE: CVE-2023-20210
Published: 2023-07-12
Description: A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user on an affected device.
 The vulnerability is due to insufficient input validation by the operating system CLI. An attacker could exploit this vulnerability by issuing a crafted command to the affected system. A successful exploit could allow the attacker to execute commands as the root user. To exploit this vulnerability, an attacker must have valid BroadWorks administrative privileges on the affected device.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-250
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-privesc-yw4ekrXW; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-privesc-yw4ekrXW
CVE: CVE-2023-37455
Published: 2023-07-12
Description: The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability affects Firefox for iOS < 115.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1786934; https://www.mozilla.org/security/advisories/mfsa2023-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1786934
CVE: CVE-2023-37456
Published: 2023-07-12
Description: The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS < 115.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1795496; https://www.mozilla.org/security/advisories/mfsa2023-25/; https://bugzilla.mozilla.org/show_bug.cgi?id=1795496
CVE: CVE-2023-3600
Published: 2023-07-12
Description: During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1839703; https://www.mozilla.org/security/advisories/mfsa2023-26/; https://www.mozilla.org/security/advisories/mfsa2023-27/
CVE: CVE-2023-37627
Published: 2023-07-12
Description: Code-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. Through SQL injection, an attacker can bypass the admin panel and view order records, add items, delete items etc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://code-projects.org/online-restaurant-management-system-in-php-with-source-code/; https://gist.github.com/1337kid/d3e7702bd19cc9355a6b3f153eb2fe8e; https://code-projects.org/online-restaurant-management-system-in-php-with-source-code/
CVE: CVE-2023-3618
Published: 2023-07-12
Description: A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://access.redhat.com/security/cve/CVE-2023-3618; https://bugzilla.redhat.com/show_bug.cgi?id=2215865; https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
CVE: CVE-2023-29298
Published: 2023-07-12
Description: Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29298
CVE: CVE-2023-29300
Published: 2023-07-12
Description: Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29300
CVE: CVE-2023-29301
Published: 2023-07-12
Description: Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the confidentiality of the user. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html
CVE: CVE-2023-29308
Published: 2023-07-12
Description: Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb23-38.html; https://helpx.adobe.com/security/products/indesign/apsb23-38.html
CVE: CVE-2023-29309
Published: 2023-07-12
Description: Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb23-38.html; https://helpx.adobe.com/security/products/indesign/apsb23-38.html
CVE: CVE-2023-29310
Published: 2023-07-12
Description: Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb23-38.html; https://helpx.adobe.com/security/products/indesign/apsb23-38.html