deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-14521
Published: 2022-02-11
Description: Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.
CVSS Score: 8.3 (HIGH)
CWE: CWE-428, CWE-276
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdf; https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-04
CVE: CVE-2020-14523
Published: 2022-02-11
Description: Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.
CVSS Score: 8.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://jvn.jp/vu/JVNVU90224831/; https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-03; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-008_en.pdf
CVE: CVE-2021-0524
Published: 2022-02-11
Description: In isServiceDistractionOptimized of CarPackageManagerService.java, there is a possible disclosure of installed packages due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-180418334
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/aaos/2022-02-01; https://source.android.com/security/bulletin/aaos/2022-02-01
CVE: CVE-2021-22748
Published: 2022-02-11
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when a file is saved. Affected Product: C-Bus Toolkit (V1.15.9 and prior), C-Gate Server (V2.11.7 and prior)
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01
CVE: CVE-2021-22785
Published: 2022-02-11
Description: A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker sends a HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02
CVE: CVE-2021-22787
Published: 2022-02-11
Description: A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02
CVE: CVE-2021-22788
Published: 2022-02-11
Description: A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02
CVE: CVE-2021-22796
Published: 2022-02-11
Description: A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolkit (V1.15.9 and prior), C-Gate Server (V2.11.7 and prior)
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-103-01
CVE: CVE-2021-22798
Published: 2022-02-11
Description: A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed when a Network is sniffed. Affected Product: Conext� ComBox (All Versions)
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://www.se.com/in/en/download/document/SEVD-2021-257-04/; https://www.se.com/in/en/download/document/SEVD-2021-257-04/
CVE: CVE-2021-22800
Published: 2022-02-11
Description: A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial of Service when a crafted packet is sent to the controller over network port 1105/TCP. Affected Product: Modicon M218 Logic Controller (V5.1.0.6 and prior)
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-04
CVE: CVE-2021-22801
Published: 2022-02-11
Description: A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configured with specially crafted event actions. Affected Product: ConneXium Network Manager Software (All Versions)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-02
CVE: CVE-2021-22802
Published: 2022-02-11
Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length check on user supplied data, when a constructed message is received on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03
CVE: CVE-2021-22803
Published: 2022-02-11
Description: A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an attacker, writes arbitrary files to folders in context of the DC module, by sending constructed messages on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03
CVE: CVE-2021-22804
Published: 2022-02-11
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files being read in the context of the user running IGSS, due to missing validation of user supplied data in network messages. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03
CVE: CVE-2021-22805
Published: 2022-02-11
Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IGSS due to lack of validation of network messages. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03
CVE: CVE-2021-22806
Published: 2022-02-11
Description: A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when accessing a malicious website. Affected Product: spaceLYnk (V2.6.1 and prior), Wiser for KNX (V2.6.1 and prior), fellerLYnk (V2.6.1 and prior)
CVSS Score: 7.5 (HIGH)
CWE: CWE-669
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-01
CVE: CVE-2021-22823
Published: 2022-02-11
Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IGSS due to lack of validation of network messages. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21320 and prior)
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-01
CVE: CVE-2021-22824
Published: 2022-02-11
Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due to missing length check on user-supplied data from a constructed message received on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21320 and prior)
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-01
CVE: CVE-2021-31932
Published: 2022-02-11
Description: Nokia BTS TRS web console FTM_W20_FP2_2019.08.16_0010 allows Authentication Bypass. A malicious unauthenticated user can get access to all the functionalities exposed via the web panel, circumventing the authentication process, by using URL encoding for the . (dot) character.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/165964/Nokia-Transport-Module-Authentication-Bypass.html; http://packetstormsecurity.com/files/165964/Nokia-Transport-Module-Authentication-Bypass.html
CVE: CVE-2021-34235
Published: 2022-02-11
Description: Tokheim Profleet DiaLOG 11.005.02 is affected by SQL Injection. The component is the Field__UserLogin parameter on the logon page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/165944/Tokheim-Profleet-DiaLOG-Fuel-Management-System-11.005.02-SQL-Injection-Code-Execution.html; http://packetstormsecurity.com/files/165944/Tokheim-Profleet-DiaLOG-Fuel-Management-System-11.005.02-SQL-Injection-Code-Execution.html
CVE: CVE-2021-39616
Published: 2022-02-11
Description: Summary:Product: AndroidVersions: Android SoCAndroid ID: A-204686438
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39619
Published: 2022-02-11
Description: In updatePackageMappingsData of UsageStatsService.java, there is a possible way to bypass security and privacy settings of app usage due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-197399948
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39631
Published: 2022-02-11
Description: In clear_data_dlg_text of strings.xml, there is a possible situation when "Clear storage" functionality sets up the wrong security/privacy expectations due to a misleading message. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-193890833
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39635
Published: 2022-02-11
Description: ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39658
Published: 2022-02-11
Description: ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，resulting in permission leaks。Third-party apps can use this service to arbitrarily modify and set system properties。Product: AndroidVersions: Android SoCAndroid ID: A-207479207
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39662
Published: 2022-02-11
Description: In checkUriPermission of MediaProvider.java , there is a possible way to gain access to the content of media provider collections due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-197302116
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-05-01; https://source.android.com/security/bulletin/2022-05-01
CVE: CVE-2021-39663
Published: 2022-02-11
Description: In openFileAndEnforcePathPermissionsHelper of MediaProvider.java, there is a possible bypass of a permissions check due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-200682135
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39664
Published: 2022-02-11
Description: In LoadedPackage::Load of LoadedArsc.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure when parsing an APK file with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-203938029
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39665
Published: 2022-02-11
Description: In checkSpsUpdated of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-204077881
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39666
Published: 2022-02-11
Description: In extract of MediaMetricsItem.h, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-204445255
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39668
Published: 2022-02-11
Description: In onActivityViewReady of DetailDialog.kt, there is a possible Intent Redirect due to a confused deputy. This could lead to local escalation of privilege that allows actions performed as the System UI, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-193445603
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39669
Published: 2022-02-11
Description: In onCreate of InstallCaCertificateWarning.java, there is a possible way to mislead an user about CA installation circumstances due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-196969991
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39671
Published: 2022-02-11
Description: In code generated by aidl_const_expressions.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-206718630
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39672
Published: 2022-02-11
Description: In fastboot, there is a possible secure boot bypass due to a configuration error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android SoC Android ID: A-202018701
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39674
Published: 2022-02-11
Description: In btm_sec_connected and btm_sec_disconnected of btm_sec.cc file , there is a possible use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-201083442
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39675
Published: 2022-02-11
Description: In GKI_getbuf of gki_buffer.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-205729183
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39676
Published: 2022-02-11
Description: In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-197228210
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2022-02-01; https://source.android.com/security/bulletin/2022-02-01
CVE: CVE-2021-39677
Published: 2022-02-11
Description: In startVideoStream() there is a possibility of an OOB Read in the heap, when the camera buffer is ‘zero’ in size.Product: AndroidVersions: Android-11Android ID: A-205097028
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/aaos/2022-02-01; https://source.android.com/security/bulletin/aaos/2022-02-01
CVE: CVE-2021-39687
Published: 2022-02-11
Description: In HandleTransactionIoEvent of actuator_driver.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204421047References: N/A
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-02-01; https://source.android.com/security/bulletin/pixel/2022-02-01
CVE: CVE-2021-39688
Published: 2022-02-11
Description: In TBD of TBD, there is a possible out of bounds read due to TBD. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-206039140References: N/A
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2022-02-01; https://source.android.com/security/bulletin/pixel/2022-02-01
CVE: CVE-2021-44111
Published: 2022-02-11
Description: A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/s-cart/s-cart/issues/102; https://github.com/s-cart/s-cart/issues/102
CVE: CVE-2021-4035
Published: 2022-02-11
Description: A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/wocu-monitoring-stored-cross-site-scripting-xss; https://www.incibe.es/en/incibe-cert/notices/aviso/wocu-monitoring-stored-cross-site-scripting-xss
CVE: CVE-2021-4046
Published: 2022-02-11
Description: The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking or theft of sensitive data.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/tcman-gim-cross-site-scripting-xss; https://www.incibe.es/en/incibe-cert/notices/aviso/tcman-gim-cross-site-scripting-xss